DPDPA Compliance Skill for Coding Agents

Quick Context: Who Does DPDPA Apply To?

• Data Fiduciary — determines purpose and means of processing (your app/company)
• Data Processor — processes data on behalf of a Data Fiduciary (your vendors, cloud providers)
• Data Principal — the individual whose data is being processed (your users)
• Significant Data Fiduciary — notified by Central Government based on volume, sensitivity, risk

How to Use This Skill

Mode 1: Compliance Audit

1. Read

   references/audit-checklist.md

   for the full checklist
2. Systematically walk through the codebase examining each compliance area
3. For each finding, report: the section of DPDPA violated, the file/line, severity (Critical / High / Medium / Low), and a concrete remediation with code
4. Produce a summary report at the end with pass/fail counts per category

• Consent collection and management
• Notice/disclosure to Data Principals
• Data retention and erasure
• Security safeguards
• Breach notification mechanisms
• Children's data protections
• Data Principal rights (access, correction, erasure, grievance, nomination)
• Cross-border data transfer controls
• Data Processor oversight

Mode 2: Implementation

1. Read

   references/implementation-patterns.md

   for framework-specific patterns
2. Identify which DPDPA obligations apply to the requested feature
3. Generate production-ready code with inline comments referencing DPDPA sections
4. Include database migrations, API endpoints, and UI components as needed
5. Add tests that verify compliance behavior

Mode 3: Guidance

1. Read

   references/organizational-guidelines.md

2. Clearly explain what falls outside the application scope
3. Provide actionable recommendations the user can take to their legal/compliance team
4. Where possible, suggest tooling or process automation that can help

Core DPDPA Obligations — Quick Reference

1. Lawful Processing (Section 3-4)

• Free (no bundling with unrelated terms)
• Specific (to a stated purpose)
• Informed (clear, plain language notice given)
• Unconditional (no coercion)
• Unambiguous (clear affirmative action — no pre-ticked boxes)
• Limited to data necessary for the specified purpose

• Pre-checked consent checkboxes → violation
• Consent buried in Terms of Service → violation
• Collecting data beyond what's needed for the stated purpose → violation
• No mechanism to withdraw consent → violation
• Withdrawal harder than giving consent → violation

2. Notice (Section 5)

• Description of personal data being collected and purpose
• How to exercise rights (withdrawal, correction, erasure)
• How to file a complaint with the Data Protection Board

• Data collection without prior notice display → violation
• Notice not in clear, plain language → violation
• Missing grievance/complaint mechanism → violation

3. Legitimate Uses Without Consent (Section 6)

• Voluntarily provided data where processing is reasonably expected
• Employment-related purposes
• Legal compliance (court orders, judgments)
• Medical emergencies
• Epidemics or public health threats
• Disaster response or public order breakdown

• Ensure the legal basis is documented in code comments or config
• Don't rely on "legitimate use" as a blanket bypass — scope it narrowly

4. Data Fiduciary Obligations (Section 7)

• Ensure accuracy and completeness of data used for decisions
• Implement reasonable security safeguards
• Notify the Board AND each affected Data Principal of breaches
• Erase data when no longer needed (unless legal retention required)
• Publish contact info of Data Protection Officer or responsible person

• No encryption at rest or in transit → violation
• No breach detection/notification system → violation
• No data retention policy or auto-deletion → violation
• No DPO contact displayed → violation

5. Children's Data (Section 8)

• Obtain verifiable parental/guardian consent before processing
• Never process data that could detrimentally affect a child's well-being
• No tracking, behavioural monitoring, or targeted advertising for children

• No age verification gate → violation
• Tracking/analytics on children's sections without parental consent → violation
• Ad targeting based on children's data → violation

6. Data Principal Rights (Sections 11-14)

• Right to access — confirmation of processing, summary of data, list of recipients
• Right to correction — fix inaccurate/misleading data
• Right to erasure — delete data (unless legally required to retain)
• Right to grievance redressal — respond within prescribed period
• Right to nominate — designate someone to exercise rights after death/incapacity

• No self-service data export/download → gap
• No correction/update mechanism beyond profile edit → gap
• No account deletion flow → violation
• No grievance submission endpoint → violation

7. Significant Data Fiduciary Obligations (Section 10)

• Appoint a Data Protection Officer based in India
• Conduct periodic Data Protection Impact Assessments
• Appoint independent data auditor
• Undertake periodic audits

• No audit logging → gap
• No DPIA tooling integration → gap

8. Cross-Border Transfer (Section 16)

• Document where data flows
• Implement controls to restrict transfer to blocked territories when notified
• Maintain a data flow map

9. Penalties (Section 21 — The Schedule)

Audit Report Format

# DPDPA Compliance Audit Report
## Summary
- Total findings: N
- Critical: N | High: N | Medium: N | Low: N
- Compliance score: X/100

## Findings

### [SEVERITY] Finding Title
- **DPDPA Section:** Section X — Description
- **Location:** `path/to/file.ts:line`
- **Issue:** What is wrong
- **Risk:** What could happen (including penalty exposure)
- **Remediation:** Step-by-step fix with code

## Organizational Recommendations
(Items that require process/policy changes, not code changes)

## Out-of-Scope Notes
(Items that require legal counsel or government interaction)

Reference Files

• references/audit-checklist.md

  — Detailed 50+ point checklist for systematic auditing

• references/implementation-patterns.md

  — Code patterns for Node.js, Python, React, React Native, Laravel, and database schemas

• references/organizational-guidelines.md

  — Non-code obligations, DPO requirements, DPIA guidance, breach response playbook

• references/dpdpa-full-text.md

  — Complete Act text for precise section references

Important Notes

• DPDPA is still awaiting rules from the Central Government on many operational details (consent manager registration, breach notification format, cross-border restrictions). Flag this to users when relevant — recommend they monitor the Ministry of Electronics and IT for rule notifications.
• This skill provides technical compliance guidance, not legal advice. Always recommend users consult qualified legal counsel for definitive compliance opinions.
• When in doubt about whether something violates the Act, err on the side of caution and flag it as a potential issue.