Trustra DPDP Workbench

Open-source tooling for building a DPDP (India's Digital Personal Data Protection Act, 2023) readiness file: a structured data element register, an evidence collection and tracking layer, a chapter-level obligation reference, and a report generator that turns collected evidence into a findings document.

What this is, and what it deliberately is not

This repository is the rails layer: the plumbing for organizing a DPDP readiness effort. It is not a certified compliance tool, not legal advice, and not Trustra's actual DPDP readiness scoring methodology.

Specifically:

• Included: a data model for a data element/processing register, an evidence store with the same tamper-evident hash-chain pattern used across Trustra's other open-source rails projects, a chapter-level reference mapping to DPDP obligation categories (see docs/DPDP_REFERENCE_DISCLAIMER.md, this is a starting point for organizing your work, not a substitute for the Act's actual text), a pluggable scoring interface, and a basic, illustrative "completeness" scorer (what fraction of your checklist items have evidence attached).
• Not included: the actual weighted risk methodology that turns evidence into a genuine readiness rating. That is Trustra's product, built and maintained separately, and is not open-sourced here. The CompletenessScoringEngine shipped in this repository is intentionally naive: it counts evidence, it does not assess risk, adequacy, or DPDP compliance.

If you want an actual independent DPDP readiness assessment, that is a Trustra product, not something this repository provides on its own.

What it does

• Maintains a structured register of data elements and processing activities.
• Tracks evidence against a chapter-level DPDP obligation reference, hash-chained so the evidence trail is tamper-evident.
• Runs a basic completeness check (evidence coverage, not risk scoring).
• Generates a Markdown findings report summarizing coverage by obligation category, clearly labeled as a completeness snapshot, not a certified rating.
• Ships a CLI (dpdp-workbench) and a small FastAPI service.

Quickstart

pip install -e .
dpdp-workbench init
dpdp-workbench add-evidence --category consent_and_notice --description "Consent capture UI screenshot" --file evidence/consent_ui.png
dpdp-workbench score
dpdp-workbench report --out dpdp_findings.md
dpdp-workbench verify

Project layout

src/dpdp_workbench/
  data/dpdp_obligation_categories.json   Chapter-level reference data (see disclaimer)
  models.py        DataElement, EvidenceItem, ObligationCategory, AssessmentRun
  provenance.py     Hash-chain implementation (tamper-evident evidence trail)
  storage.py        SQLite-backed store
  reference.py      Loads and looks up the obligation category reference data
  scoring/          Pluggable ScoringEngine interface plus the basic completeness scorer
  report.py         Markdown findings report generator
  api/              FastAPI service
  cli.py            Command-line interface
docs/
  ARCHITECTURE.md
  DPDP_REFERENCE_DISCLAIMER.md
tests/              Unit tests

Legal disclaimer

This project, including the bundled reference data (src/dpdp_workbench/data/dpdp_obligation_categories.json), is provided for organizing compliance work and is not legal advice. DPDP obligations, penalties, and procedural requirements should be confirmed against the official Act text (Digital Personal Data Protection Act, 2023, No. 22 of 2023) and its rules, and with qualified counsel. See docs/DPDP_REFERENCE_DISCLAIMER.md.

Contributing

Contributions are welcome, see CONTRIBUTING.md. Licensed under AGPL-3.0-or-later. Note the scope restriction in CONTRIBUTING.md: contributions that add proprietary-grade risk scoring are out of scope for this repository.

License

GNU Affero General Public License v3.0 or later. See LICENSE.