Open source · Apache-2.0 · v0.1.0

DPDP Act compliance for developers, done by AI agents that show their evidence

An open-source skill for Claude Code and other coding agents. It checks whether India's Digital Personal Data Protection Act, 2023 actually applies to your code, finds the privacy gaps, fixes them in your own stack, and proves each fix with tests that really ran.

View on GitHub Read the benchmark

Not legal advice. The skill is an engineering aid. It never certifies compliance, and it records legal questions for a lawyer instead of answering them.

The problem

Most DPDP duties for companies take effect on 13 May 2027: consent and notice, erasure, breach reporting, and children's data. Ask an AI coding agent to "make this DPDP compliant" and it usually adds a consent banner. It skips the first question: does the Act even apply to what this code does? "It's an internal tool" is not an exemption. "It only runs on the user's own laptop" often is.

What it does

Discover personal data, vendors, AI systems and data flows, from the code.
Assess applicability for each processing activity. There are five possible statuses, and "not applicable" is a valid, evidence-backed answer.
Find gaps. Mandatory obligations are kept separate from best practice, and every finding cites a file and line.
Plan the changes, stopping for human approval where the change alters behaviour, permissions or data.
Implement in the project's own architecture.
Verify with executed tests and an independent reviewer that didn't write the code.
Report with a requirement → code → test traceability matrix.

A validator runs after every phase. It rejects legal provisions that don't exist, "passed" tests that were never run, and phrases like "fully compliant".

Why independent verification matters

In the worked example, the agent that wrote the fixes had 17 of 17 tests passing. A second agent, one that hadn't written the code, then found that deleting an account let the database reuse that user's ID. The next person to sign up could read the deleted patient's symptoms through their own "my appointments" page.

# synthetic data, reproducible from the repo
a = register(db, "Patient A", ...); book_appointment(db, a, slot, "fever")
delete_user(db, a)
b = register(db, "Patient B", ...)
b == a                      # id reused
get_appointments(db, b, b)  # → A's "fever" record

Across three review rounds the reviewer found 11 defects that the passing tests missed. Those lessons are now written into the skill.

Measured results, including where it didn't help

Experiment	With skill	Plain agent	What it shows
5 behavioural cases, LLM-graded, 15 runs per arm	0.97	0.78	Better handling of legal uncertainty: escalating questions, separating "applies" from "in force".
12-case deterministic benchmark	0.984	1.000	No detection benefit. The plain agent already found every planted bug, so the benchmark is too easy.

The samples are small, the apps are synthetic, and I wrote the graders myself. The commands to reproduce all of it are in RESULTS.md.

Install

git clone https://github.com/annjan777/dpdp-compliance-engineering \
  ~/.claude/skills/dpdp-compliance-engineering

Then ask your agent: "Does DPDP apply to this repo? Assess it." For the Claude apps, download the .skill file from the latest release and upload it under Settings → Capabilities → Skills.

Questions developers ask

Does the DPDP Act apply to an internal tool or employee-only app?

Usually, yes. Employees are Data Principals. Processing for employment purposes is a lawful ground that needs no consent (section 7(i)), but it's not an exemption: duties such as security safeguards, breach reporting and erasure still apply.

When do the DPDP obligations come into force?

The DPDP Rules were notified on 13 November 2025 and phase in: Board and definitions immediately; Consent Manager registration from 13 November 2026; most duties on companies from 13 May 2027.

Does the Act apply to an app that runs only on the user's own device?

Often not. Processing by an individual for a personal or domestic purpose is excluded (section 3(c)(i)). But adding telemetry, sync or crash reporting that sends data to you can bring that part into scope.

Is there a data portability right in the DPDP Act?

No. The closest right is a summary of personal data and processing (section 11). An export feature can be good practice, but it isn't a DPDP requirement.

Will this make my application compliant?

No tool can promise that. The skill produces engineering evidence (what applies, what was changed, what was tested) for a lawyer and your team to review.