dpdpa

What it does

The skill guides an AI agent to function as an India DPDPA compliance advisor. It covers the scope of digital personal data, two lawful bases for processing (Consent and Certain Legitimate Uses), and requires using DPDPA terminology (Data Fiduciary, Data Principal, Data Processor, Signficant Data Fiduciary, Data Protection Board). It instructs to cite obligations with section or rule numbers (e.g., Section X or Rule Y of the DPDP Rules 2025). It emphasizes phase-aware guidance with timelines, and to flag items dependent on future notifications.

How it works

It provides concrete, section-based guidance across core topics:

• Data Fiduciary obligations (Sections 4–10): grounds for processing (Section 4), notice obligations (Section 5, Rule 3), consent (Section 6), legitimate uses (Section 7), general duties (Section 8), and children processing (Section 9).
• Notice drafting requires Rule 3 elements: standalone notice, itemised data categories, purposes, recipients, retention, rights, Board complaint pathway, and withdrawal mechanism.
• Consent criteria (Section 6): must be free, specific, informed, unconditional, unambiguous; details invalid forms of consent and withdrawal (Section 6(4)).
• Certain Legitimate Uses (Section 7): eight enumerated purposes; emphasizes exhaustivity and non-derivation from “business necessity” concepts.
• General obligations (Section 8): processor contracts (Rule 16), data quality, security safeguards (Rule 7), erasure on purpose fulfilment/withdrawal, breach notification timelines.
• Children processing (Section 9) with parental consent (Section 9(1)) and verification methods (Rule 12), plus prohibited activities (Section 9(2)) and penalties.
• SDF obligations (Section 10, Rule 13): DPO appointment, DPIA, independent data audits, data localization, and future-notified designations.

When to use it

Use when addressing specific DPDPA topics or conducting gap analyses, breach response planning, privacy policy reviews, consent mechanism reviews, rights request handling, SDF assessments, and children’s data controls. The skill frames guidance with explicit section/rule references and requires alignment to the Act and Rules timelines (e.g., full compliance deadline 13 May 2027). It also notes when guidance depends on unnotified items and to flag those accordingly.

What it can touch

• Mentions and references to: Section 4–10, Section 6, Section 7, Section 8, Section 9, Section 10, Rule 3, Rule 6, Rule 7, Rule 12, Rule 13, Rule 16.
• Discusses roles and terms: Data Fiduciary, Data Principal, Data Processor, Significant Data Fiduciary, Data Protection Board.
• Advises on documentation outputs like gap analyses, notices, DPIAs, audits, and compliance roadmaps.

Caveats

• Licenses under MIT.
• Notes that as of April 2026, no SDF designations publicly exist yet; guidance may depend on future notifications.
• Emphasizes digital-only scope and the absence of a general legitimate interests basis (only Consent or Certain Legitimate Uses).
• Penalty details for children’s data violations (₹200 crore) are specified.
• Requires referencing both Act and Rules where applicable; does not extrapolate beyond stated sections/rules.