DPDPStack
DPDP-compliant data erasure for Indian apps - handled in your code.
Indian engineering teams keep hitting the same wall: the DPDP Act says erase a user's data on withdrawal, but RBI (KYC, 5 years), PMLA, CERT-In (logs, 180 days) and the Companies Act say keep it. So teams hand-delete data across tables, can't prove what they did, and enterprise tools "cost more than a month's revenue."
dpdpstack is a small, zero-egress Python library that handles the hard part.
What it does
- Legal-hold-aware erasure - delete now, or defer under an RBI/PMLA/CERT-In hold (with the legal basis recorded), then erase automatically when the hold lapses.
- PII anonymization - irreversibly null/hash PII while keeping the ledger row, so referential integrity and regulated records survive.
- Tamper-evident audit - every decision is appended to a hash-chained log you can verify at any time.
- Certificate of Erasure - a verifiable, signed proof that you erased (or are lawfully holding) a user's data.
Not a cookie banner. Not a consultant. A deletion/retention engine for developers.
Zero-egress: the core principle
DPDPStack is a layer, not a data store. The engine decides what to delete or anonymize and records tamper-evident evidence - but your code performs the actual mutation in your own database. Personal data never leaves your systems.
This is what makes it safe for fintech/BFSI: your legally-required deletion path
has no hard runtime dependency on anyone's uptime. If getdpdp.net is down,
your erasure and audit still work, locally and identically.
Two parts
| Part | What it is |
|---|---|
dpdpstack library | Free, open-source, runs entirely in your app. Does everything locally. |
| Hosted platform (getdpdp.net) | Optional. An evidence vault + dashboard that counter-signs your certificates and verifies your audit chain - third-party-attested proof you can show an auditor. |
The library is the wedge and is never crippled. The platform adds proof you can't self-fabricate - see Hosted dashboard.
Next steps
- Installation - install the package and optional extras.
- Quickstart - your first erasure + certificate in ~10 lines.
- How it works - the engine, the audit chain, and certificates.
DPDPStack is tooling, not legal advice; you remain the Data Fiduciary. MIT licensed.