Dhristhi DPDP
Legal Register
Product Showcase
Governance Engine Production Live App
Launch Live App Product Showcase

DPDP Obligation Register

Automated Statutory Applicability & Compliance Decision Engine

Engineered By: Dhristhi Privacy Engineering
Edition: Enterprise Edition
Release: Live in Production (2026)
Live URL: https://register.dpdp.dhristhi.app/

Product Overview & Key Capabilities

An intelligent statutory decision engine that automates the classification of digital personal data processing activities, determines applicability across primary Act and subordinate Rules, establishes enforcement milestones across all 3 commencement tranches, and assigns operational control ownership with full audit traceability.

Core Enterprise Capabilities
Tri-state applicability evaluation engine (Applicable, Not Applicable, Unresolved) with deterministic factual prerequisite validation.
Complete canonical provision registry mapping all 102 statutory limbs to verified Gazette SHA-256 digests.
Automated tranche enforcement tracker calculating real-time statutory countdowns and compliance cliff gates.
Portable snapshot engine generating immutable JSON, CSV, and PDF audit dossiers with zero vendor lock-in.
Deliverable & Core Artifact

Versioned enterprise applicability decision register: canonical provision references, entity facts, effective-date basis, source locators, legal interpretations, control owners, and review sign-off history.

Target Roles & Operational Impact

Target Persona & Role Decision Authority Operational Value & Impact
Data Protection Officer & Compliance Lead Operational Sign-Off Record deterministic APPLICABLE, NOT_APPLICABLE, or UNRESOLVED decisions with automated evidence requirement checks.
General Counsel & Legal Advisor Legal Interpretation Veto Validate entity facts against statutory thresholds, exemptions under Section 17, and subordinate rule notifications.
Programme Sponsor & CISO Budget & Resource Allocation Identify unassigned control obligations and track compliance countdowns across all 3 statutory commencement tranches.

Data Schema & Architecture Interface Contracts

The following data schemas and interface contracts define the structured payloads and integration endpoints of this product:

applicability_record
decision_id; canonical_provision_id; activity_id; entity_facts; source_version_hash; act_commencement_basis; dependent_rule_basis; applicability_state (APPLICABLE, NOT_APPLICABLE, UNRESOLVED); legal_interpretation; control_owner; reviewer; signoff_date
decision_snapshot
snapshot_id; manifest_digest; evaluated_provisions_count; unresolved_count; change_history; export_format (JSON, CSV, PDF)

Operational Workflow & Product Invariants

Execution Workflow Procedure

  1. Catalog business activities, data categories, and processing purposes across business units.
  2. Evaluate against all 102 canonical Act sections and subordinate Rules using deterministic fact gates.
  3. Assign statutory applicability states (APPLICABLE, NOT_APPLICABLE, UNRESOLVED) with rationale.
  4. Calculate effective commencement tranches (Tranche 1 Nov 2025, Tranche 2 Nov 2026, Tranche 3 May 2027).
  5. Map applicable provisions to operational controls (OBL-01 to OBL-54) and assign accountable internal owners.
  6. Export immutable, digest-bound decision packages in JSON, CSV, or executive PDF audit reports.

Mandatory Product Invariants

  • P01-R01: Preserve canonical statutory provision IDs exactly without simplifying into generic advice labels.
  • P01-R02: Require explicit tri-state classification (APPLICABLE, NOT_APPLICABLE, UNRESOLVED) with reviewer attribution.
  • P01-R03: Automatically track Gazette amendments and trigger freshness re-evaluation upon statutory changes.
  • P01-R04: Generate portable, tamper-evident audit dossiers with SHA-256 integrity digests.

Operational Boundaries & Architecture Assumptions

  • • Does not constitute binding legal representation before the Data Protection Board of India.
  • • Does not automate real-time network traffic filtering without integration with enforcement engines.

Built-in Quality Verification & Compliance Test Harness

P01-A01-TEST Verified
Deterministic Applicability Classification

Verify that mapping activity facts to statutory provisions correctly generates traceable applicability proposals.

P01-A02-TEST Verified
Missing Evidence Blocking

Validate that absence of required entity facts forces an UNRESOLVED state and blocks compliance sign-off.

P01-A03-TEST Verified
Gazette Change Invalidation

Confirm that updating a statutory source digest automatically marks affected historical reviews for re-evaluation.

Statutory Grounding & Regulatory Crosswalk

10 Enforced Provisions

The following primary Act sections and subordinate Rule provisions establish the direct legal grounding, mandatory statutory constraints, and operational compliance duties enforced by this product:

Direct Citations: Section 1Section 2Section 3Section 4Section 7Section 8Section 10Section 17Section 33Rule 1
ACT-1 s.1
Tranche 1 (13 Nov 2025)

Section 1

Actor: Central Government
Trigger: Commencement by Gazette notification

Different provisions may have different dates; reference to commencement follows the provision.

Product Invariant: Read the applicable tranche before stating an obligation is live.
Exception: No blanket commencement inferred.
Gazette Verified View Provision (s.1)
ACT-2 s.2
Tranche 1 (13 Nov 2025)

Section 2

Actor: All statutory actors
Trigger: Interpretation of defined terms

Child: below 18; fiduciary: alone or jointly determines purpose and means; processor: acts on behalf; breach: CIA-compromising unauthorised processing or specified accidental events.

Product Invariant: Roles are activity-specific; nationality and product labels do not determine them.
Exception: Unless context otherwise requires.
Gazette Verified View Provision (s.2)
ACT-3 s.3
Tranche 3 (13 May 2027)

Section 3

Actor: Person processing digital personal data
Trigger: India processing or offshore goods/services connection

Includes later-digitised collection; offshore nexus is principals within India, not Indian citizenship.

Product Invariant: Publicly accessible does not by itself meet the public-data exclusion.
Exception: Individual personal/domestic use; principal-made public data or legally obliged publication by another.
Gazette Verified View Provision (s.3)
ACT-4 s.4
Tranche 3 (13 May 2027)

Section 4

Actor: Person processing personal data
Trigger: Processing

Lawful purpose plus consent or a section 7 use.

Product Invariant: Contract, reasonable business purposes and vendor consent hashes are not a third freestanding ground.
Exception: Subject to other applicable provisions and exemptions.
Gazette Verified View Provision (s.4)
ACT-7 s.7
Tranche 3 (13 May 2027)

Section 7

Actor: Data Fiduciary; State-specific actors in (b)/(c)
Trigger: Facts satisfy a listed use

Complete (a)-(i) subrows govern; there is no s7(1)(h).

Product Invariant: Do not authorise reuse merely because a notice names a purpose.
Exception: No open-ended commercial legitimate-interest ground.
Gazette Verified View Provision (s.7)
ACT-8 s.8
Tranche 3 (13 May 2027)

Section 8

Actor: Data Fiduciary
Trigger: Processing by it or its processor

Responsibility despite agreements/principal default; valid processor contract; conditional data accuracy; safeguards; breach intimation; erasure; contact and grievance mechanism.

Product Invariant: Receipt is not proof of erasure; fulfilment of one test is not statutory assurance.
Exception: s8(7) lawful-retention exception; s17 preserves s8(1),(5) under subsection (1).
Gazette Verified View Provision (s.8)
ACT-10 s.10
Tranche 3 (13 May 2027)

Section 10

Actor: Central Government; notified SDF
Trigger: Notification of fiduciary or class following relevant-factor assessment

India-based individual DPO responsible to governing body; independent auditor; periodic DPIA/audit and prescribed measures.

Product Invariant: Voluntary readiness is not a legal designation; independence is not an express firm-wide ban here.
Exception: Not automatic from scale/sensitivity; designation and effective timing matter.
Gazette Verified View Provision (s.10)
ACT-17 s.17
Tranche 3 (13 May 2027)

Section 17

Actor: Actors specified in exemption subrows
Trigger: Clause-specific conditions or notifications

Differently scoped disapplications in (1)-(5); see complete subrows.

Product Invariant: Determine activity, facts, disapplied provisions, preserved provisions and notification evidence before use.
Exception: Not all exemptions are partial, and not all have an identical necessity test.
Gazette Verified View Provision (s.17)
ACT-33 s.33
Tranche 3 (13 May 2027)

Section 33

Actor: Board; person found in significant breach
Trigger: Conclusion of inquiry, significant breach and hearing

May impose scheduled penalty; seven statutory factors.

Product Invariant: No expected-loss formula from fixture pass rate; aggregate exposure requires separate legal analysis.
Exception: Discretionary maximum, no fixed multiplier from mitigation.
Gazette Verified View Provision (s.33)
RULE-1 r.1
Tranche 1 (13 Nov 2025)

Rule 1

Actor: Rulemaker / all actors
Trigger: Commencement

rr1,2,17-21 publication; r4 one year; rr3,5-16,22,23 eighteen months.

Product Invariant: Ordinary calendar tranche dates, not upload dates.
Exception: Read corrigendum replacing publication wording.
Gazette Verified View Provision (r.1)

Target Systems Topology (SYS-001..014)

View Complete Architecture Topology →
SYS-001 System Spec →
Customer App & Web Portal

Public client boundary & untrusted intake surface for notices and consent capture

SYS-005 System Spec →
Analytics & AI/ML Training Environment

Model training and algorithm development node gated against unconsented data

SYS-006 System Spec →
HRMS & Applicant Tracking System

Internal employer database holding employee payroll and candidate records

SYS-010 System Spec →
Consent Ledger & Policy Decision Point

Immutable consent event store and Policy Decision Point issuing authority tokens

Enterprise Evidence Artifacts Vault

The following verifiable artifacts and test workpapers are generated by this product:
APPLICABILITY_DECISION_LEDGER.json
STATUTORY_TRANCHE_SCHEDULE.pdf
CONTROL_ASSIGNMENT_MATRIX.csv
Next Product
Consent Enforcement Engine