DPDP overview

India’s Digital Personal Data Protection Act, 2023 (DPDP Act) and rules set out duties for organizations that process digital personal data, and rights for individuals (Data Principals). Many Indian product teams evaluate Erasure because consent, notice, and erasure become operational problems, not only policy problems.

This section maps common duties to what Erasure does today. It is not legal advice, not a certificate of compliance, and not a complete compliance program. Always involve counsel for your facts, sector, and contracts.

Key ideas in the Act (plain language)

These are simplified concepts for product/ops readers, not statutory text.

Idea	Why it matters operationally
Data Principal	The individual whose personal data is processed
Data Fiduciary	The organization that determines purpose and means of processing
Consent	A primary ground for processing; free, specific, informed, unambiguous, and withdrawable in principle
Notice	Principals should understand who processes data, for what purposes, and how rights work
Purpose limitation	Process for stated purposes; do not treat "accept" as a blank cheque
Rights	Including access, correction, and erasure (subject to law and retention duties)
Accountability	Fiduciaries must be able to show how they handled personal data and rights requests

Public summaries of the Act emphasize consent-driven processing, purpose limitation, and principal rights (access, correction, erasure). Exact applicability (e.g. when rights attach, legitimate use, children, penalties) depends on the Act, rules, and your counsel’s analysis, not this product docs site.

What "good" looks like in engineering

Duty (simplified)	Weak ops	Stronger ops with Erasure
Notice & purposes	One-off banner, no history	Versioned publish; purposes structured in Accord
Demonstrate consent	"They clicked Accept"	Receipts pinned to a consent version + export
Withdrawal	Unclear or impossible	Optional-purpose withdraw + new receipt (device-scoped v1)
Erasure	Email → ad-hoc SQL	Rights case, OTP/operator verify, jobs across Systems
Know where data lives	Tribal knowledge	Data Maps + discovery on connected systems
Show what happened	Scattered logs	Activity timeline + Evidence packages

Coverage map (product → duty)

Aligned with product documentation, not a legal opinion.

Obligation (simplified)	Erasure mechanism	Coverage
Purpose-bound collection / purpose structure	Accord purposes + published notice	Solves (ops) for notice + purpose structure at collection
Notice at / before collection	Notice builder, SDK banner / hosted prefs, versioned publish	Supports (copy & structure; legal polish still productizing)
Consent collection where applicable	Accord UI + receipts; withdraw optional purposes	Supports (device/browser-scoped in v1)
Record of consent	Immutable receipts, config snapshot, publish Evidence, export	Solves (ops) for technical evidence trail
Notice/purpose change over time	Immutable consent versions; receipts pin a version	Solves (ops)
Right to erasure (operational)	Rights cases, OTP intake API, worker + Systems + Data Maps, Activity + Evidence	Solves (ops) for DELETE end-to-end on connected systems
Right to access / correction	Rights lifecycle exists; types beyond DELETE	Partial / not first-class product types yet
Know where personal data lives	Data Maps, discovery, graph, readiness	Solves (ops) for operator-defined maps (not automatic discovery of every SaaS)
Act across systems	Postgres / MySQL / MongoDB / HTTP / Webhook Systems + jobs	Solves (ops) for systems you connected
Accountability for Erasure-mediated actions	Activity, Evidence, job metrics	Supports strongly for in-product actions
Product security safeguards	Secrets encryption, SSRF controls, rate limits, RBAC, privacy-preserving receipts	Supports product security, not customer app security
RoPA / DPIA templates, DPO suite	—	Not solved
Cookie/tracker auto-scanner	—	Not solved
Cross-border transfer tools, breach notification workflows	—	Not solved

Product	Job
Accord	Notice + purposes + collect/prove consent over time
Rights	Operationalize erasure with verification and audit (other rights later)
Systems + Data Maps	Make erasure real in customer databases/APIs
Evidence	Exportable proof packages (publish + deletion)
Operational Readiness	"Can we run privacy ops safely?" before the first case
Platform	Multi-tenant control plane, not a DPDP duty by itself

The operating loop

Notice & consent (Accord)
        │
        ▼
Map systems (Systems + Data Maps)
        │
        ▼
Fulfil erasure (Rights + worker)
        │
        ▼
Export Evidence

Pages in this section

Page	Focus
Consent	Collecting and proving consent
Notice	Versioned notices subjects see
Withdrawal	Preference changes as new receipts
Deletion requests	Rights lifecycle honesty
Evidence	Exportable packages
What Erasure does not solve	Explicit non-claims
Operational checklist	Practical readiness, not certification

Honest non-claims

Erasure does not:

Guarantee legal compliance or "DPDP certified" status
Replace a privacy policy, DPO, DPAs, or counsel
Automatically find every SaaS holding PII without configuration
Provide ACCESS/CORRECT/portability as complete products today
Draft or file regulatory notifications

What it does claim operationally:

If you configure purposes, publish notice, integrate the SDK, map systems, and run Rights with a worker, you get a repeatable engineering path for notice + consent proof + erasure fulfillment + exportable evidence, the hard part for many product companies under DPDP pressure.

What to do next

Start with Consent, or if you are new to the product, Getting Started.

For a plain-language overview of the work (not the product mechanics), see the privacy operations guide and the DPDP Act guide.

DPDP overview

On this page