DPDP readiness
How KaapiPass maps to the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025. This is our engineering view, not legal advice or a claim of compliance.
| Requirement | How KaapiPass handles it | Still needs |
|---|---|---|
| Notice before consent (s.5, Rule 3) | An itemised notice in English, Hindi and Kannada sits on the join page, above the consent boxes. It covers the data, the purpose, withdrawal, rights and how to complain. | Lawyer + native-speaker review |
| Free, specific, unambiguous consent (s.6) | Separate unticked boxes: one for the loyalty card (required) and one for offers (optional). Joining is blocked unless the card consent is ticked. | Lawyer review of wording |
| Withdrawal as easy as giving (s.6(4)) | One tap on the card's “My data” page switches off offers or deletes the card. Every change is logged. | None |
| Consent records | Each grant, withdrawal and erasure is logged with a timestamp, the notice version and the channel. | None |
| Purpose and data limitation | Only name and mobile number are collected, plus visit records needed for the stamp card. | None |
| Rights: access, correction, erasure (s.11–13) | Self-serve on the card: view, download as JSON, correct the name, delete one card or everything. | Process for requests by other channels |
| Grievance redressal (s.13) | Grievance officer section on the Trust page. | Officer name and contact: TO BE FILLED |
| Retention and erasure (s.8(7), Rule 8) | Inactive cards are purged automatically (365 days by default, configurable per cafe). A purge job is included. | Confirm retention period and pre-erasure notice |
| Security safeguards (s.8(5), Rule 6) | Phone numbers encrypted at rest, hashed passwords, role separation, audit log, security headers. | Independent security review |
| Breach notification (s.8(6), Rule 7) | A written breach response procedure (docs/BREACH-RESPONSE.md) with timelines for informing the cafe, affected people and the Board. | Lawyer review |
| Children (s.9) | Members must declare they are 18 or older; the declaration is logged. No under-18 sign-ups are knowingly accepted. | Lawyer review of the age-declaration approach |
| Fiduciary / processor roles | The cafe is the Data Fiduciary; KaapiPass is the Data Processor and acts on the cafe's instructions. See the DPA template. | Lawyer to finalise DPA |
| Data location | The deployment's data region is shown on the Trust page. Production must be hosted in India. | Hosting decision |
| No selling, no tracking | No ad or analytics cookies. Fonts are self-hosted. Member data is never sold or shared for marketing. | None |
Section references are indicative and must be checked by a lawyer. Timeline as we read it (not verified by a lawyer): the DPDP Rules, 2025 were notified on 13 November 2025 (announced 14 November), and most Data Fiduciary obligations start 18 months later, around 13 May 2027. In January 2026 MeitY consulted on shortening this to 12 months (13 November 2026); we have not seen a final amendment, so we are building as if the earlier date applies. Reviewed internally on 31 October 2026.