> ## Documentation Index
> Fetch the complete documentation index at: https://docs.responsibleailabs.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# India DPDP

> What the DPDP Act 2023 requires, and how RAIL turns those obligations into a working compliance lifecycle for AI systems.

<Info>
  **API:** [India DPDP overview](/api-reference/dpdp-overview) | **SDK:** [Python DPDP](/sdk/python/dpdp)
</Info>

India's **Digital Personal Data Protection Act, 2023 (DPDP)** governs how organizations process the personal data of individuals in India. For AI systems the Act is not a one-time checkbox — obligations attach across the whole lifecycle of a data principal's interaction: before you collect data, while you process it, when an individual exercises a right, and if a breach occurs.

RAIL turns those obligations into a small set of composable operations. This page explains the concepts; the [API overview](/api-reference/dpdp-overview) and [Python SDK](/sdk/python/dpdp) show the calls.

## The vocabulary

* **Data Principal** — the individual whose personal data is processed.
* **Data Fiduciary** — the organization that decides why and how data is processed (you).
* **Significant Data Fiduciary (SDF)** — a fiduciary the government designates as higher-risk, with extra duties (audits, DPO, impact assessments).
* **Personal data** — anything that identifies an individual. In India this prominently includes Aadhaar, PAN, UPI IDs, and mobile numbers.

## Obligations RAIL helps you meet

| Obligation                                          | DPDP section | How RAIL helps                                                                                      |
| --------------------------------------------------- | ------------ | --------------------------------------------------------------------------------------------------- |
| Notice before processing                            | S.5          | `emit` a `notice.shown` event; it is retained as evidence.                                          |
| Consent, and easy withdrawal                        | S.6          | `emit` `consent.granted` / `consent.withdrawn`; `evaluate` blocks actions that lack a lawful basis. |
| Purpose limitation                                  | S.4          | `scan` detects **purpose drift** — content that strays from the declared purpose.                   |
| Data minimization & accuracy                        | S.8          | `scan` surfaces Indian PII so you can mask or drop what you do not need.                            |
| Children's data (no tracking, no targeted ads)      | S.9          | `scan` flags **child signals**; `evaluate` blocks profiling of minors.                              |
| Data principal rights (access, correction, erasure) | S.11–S.14    | `emit` a `dsr.received` event to start the statutory response clock; `timers` tracks it.            |
| Breach notification                                 | S.8(6)       | `emit` `breach.detected` to start CERT-In and Data Protection Board timers.                         |
| SDF additional duties                               | S.10         | `evidence` produces the SDF annual report packet.                                                   |

## The compliance lifecycle

A session is the thread that ties one data principal's journey together. Events accumulate on it, timers start from those events, and evidence is assembled from the resulting trail.

```mermaid theme={null}
flowchart LR
    A["Before collection<br/>notice + consent"] --> B["At processing time<br/>scan + evaluate"]
    B --> C["Ongoing rights & events<br/>emit + require"]
    C --> D["Deadlines<br/>timers"]
    D --> E["Audit time<br/>evidence"]
    A -. "all attached to" .-> S(["DPDP session"])
    B -. "all attached to" .-> S
    C -. "all attached to" .-> S
    D -. "all attached to" .-> S
    E -. "reads from" .-> S
```

## Which operation do I reach for?

<CardGroup cols={2}>
  <Card title="I have model output to publish" icon="magnifying-glass-chart" href="/api-reference/dpdp-scan">
    **Scan** it for Indian PII, child signals, and purpose drift — then detect, mask, or block.
  </Card>

  <Card title="I am about to act on personal data" icon="scale-balanced" href="/api-reference/dpdp-evaluate">
    **Evaluate** the action for a deterministic allow / block / require\_action verdict.
  </Card>

  <Card title="Something happened I must record" icon="list-check" href="/api-reference/dpdp-emit">
    **Emit** the event (consent, DSR, breach). Statutory timers start automatically.
  </Card>

  <Card title="An auditor is asking for proof" icon="file-shield" href="/api-reference/dpdp-evidence">
    **Generate evidence** — a packet built from the session's recorded trail.
  </Card>
</CardGroup>

## Hosted vs. enterprise

The same DPDP capability is available two ways. On the **hosted** API your application sends content to RAIL. In **enterprise self-hosted** deployments the RAIL agent runs inside your own environment and content never leaves it — appropriate when data residency or air-gapping is required. The endpoint contract is identical, so code written against one runs against the other.

## Related

<CardGroup cols={2}>
  <Card title="India DPDP API overview" icon="shield-halved" href="/api-reference/dpdp-overview">
    The seven endpoints, credit costs, and a complete walkthrough.
  </Card>

  <Card title="Compliance frameworks" icon="book" href="/concepts/compliance">
    How DPDP sits alongside GDPR, CCPA, HIPAA, and the EU AI Act.
  </Card>
</CardGroup>