One customer. One purchase.
Every obligation the Act creates.

Each purpose is the unit of consent, of retention, and of the ROPA record. Define it once and the banner, the privacy notice, the retention worker and the Records of Processing Activities export all stay in sync.

Scripts in the analytics and marketing buckets stay inert until the matching signal flips to granted. Denied is the default state on first load, so nothing leaks in the gap before the visitor answers.

• The public key ships inside the receipt, so a regulator or the principal can verify it without contacting you.
• The email is masked in the receipt body — the proof does not itself become a data spill.
• Every receipt names the exact notice version displayed, linking back to the immutable notice record.
• A public verification endpoint accepts a pasted receipt and returns valid or invalid, with no login.

Opt-in rate is a compliance metric, not just a marketing one: a rate near 100% usually means the banner is coercing, and a rate near zero means the value exchange was never explained. The A/B testing module lets you test banner copy against both consent rate and complaint rate.

A hash chain proves internal consistency. It does not, by itself, prove the whole chain was not rebuilt last night. So the head of the chain is periodically anchored to an RFC 3161 timestamp authority outside your control.

Withdrawal is not just a flag on a row. The platform stops the purpose at the edge and notifies every processor linked to it, so the obligation to cease processing actually reaches the systems doing the processing.

• T − 5 days
  REMINDER
  Assigned handler is nudged. Nothing leaves the team yet.
• T − 2 days
  ESCALATED
  Owners and admins are alerted; the request is pinned to the top of the queue.
• T + 0
  OVERDUE_FINAL
  Status flips to OVERDUE automatically and the DPO is notified. The flip is written to the audit log — you cannot quietly reset the clock.
• Next report
  BREACH_LOGGED
  Recorded in the compliance report as a missed target, with the delay in days.

When the Grievance Officer changed in March, every document naming the old officer was auto-patched and re-versioned. Aarav's consent record still points at notice v6 — the text he actually saw — not at today's v7.

• 12 Jun 2026 · v7
  New purpose added: Personalised recommendations
  Existing consents flagged REQUIRES_RECONSENT for that purpose only. The other purposes stay valid — you do not re-prompt for everything.
• 14 Mar 2026 · v6
  Grievance Officer changed
  Auto-patched across 4 documents. Logged as NOTICE_AUTO_PATCHED.
• 02 Jan 2026 · v5
  Retention shortened on marketing data
  730 → 365 days. Retention worker recalculated 22,908 expiry dates overnight.

Each vendor carries its DPA document, a risk score from the last audit, its own DPO contact, and the list of purposes it is linked to — which is what makes the downstream erasure signal in Chapter 7 possible at all.

Each purpose in the registry generates a ROPA entry — data categories, principal categories, recipients, retention, sensitivity, cross-border flag. Reviewed on a cycle, snapshotted on every review, exportable as CSV or PDF for an auditor.

Anonymise and delete are different obligations with different business consequences. Analytics keeps its value once identifiers are stripped; a marketing profile does not, so it is destroyed outright.

• 21 Jul · 09:14
  Detected
  Reported by external researcher. Incident opened; severity set HIGH. Both clocks start here — CERT-In and DPDP.
• 21 Jul · 09:22 T+8 min
  CERT-In notified
  "Data breach" is a reportable cyber incident under the CERT-In Directions, with a 6-hour window from noticing. Filed via the designated point of contact; acknowledgement reference stored.
• 21 Jul · 09:31
  Board of India intimated
  Initial intimation filed without delay on becoming aware. Acknowledgement reference stored on the incident.
• 21 Jul · 11:47
  Contained
  Bucket ACL corrected; partner credentials rotated; access logs preserved.
• 21 Jul · 16:20
  Affected principals notified
  12,400 notices sent in EN and हिं, describing the breach, its likely consequences, the measures taken, and how to contact the Grievance Officer.
• 23 Jul · 18:00
  Detailed report to the Board
  Full particulars, remediation and findings filed within the window set by the DPDP Rules.
• Open
  Vendor audit & DPA review
  Delhivery risk score raised 2 → 6; out-of-cycle audit scheduled; DPA amendment requested.

This is the point most breach registers miss. A data breach at an Indian company is simultaneously a DPDP event and a CERT-In cyber incident, under different statutes, to different authorities, on different clocks. Miss either and the other one does not save you.

Reporting is the visible part. The Directions also impose continuous obligations that only matter on the day you need them — which is this day.

One button produces what an inquiry asks for, assembled from records that already existed rather than reconstructed after the fact.

• Incident record with the full timeline and every status change, attributed and timestamped.
• Copies of both notifications — to the Board and to principals — with delivery receipts.
• The exact list of affected principals and the data categories involved.
• The processor's DPA, its audit history, and the risk score before and after.
• Audit-chain extract covering the incident window, with its anchor proof.

The Act lets the Government weigh volume and sensitivity of data, risk to data principals' rights, and impact on sovereignty, electoral democracy, State security and public order. Designation is not something you opt into — but it is something you can see coming.

A DPIA is not a form you file. It is the record of a decision: here is what we intend to process, here is what could go wrong for the people involved, here is what we changed as a result. Toggle the mitigations and watch residual risk move.

Meru's backend asks before it acts. The answer below is computed from the consent you gave back in Chapter 3 — change it there and this changes with it.

A control that costs a developer extra keystrokes is a control that gets skipped under deadline. So the SDK is written so that checking is shorter than not checking.

// One principal, one purpose
if (await dpdp.allows({ externalId: user.id }, "marketing")) {
  await sendCampaignEmail(user);
}

// The case that actually bites — filter before a bulk send
const sendable = await dpdp.filterAllowed(allUsers, (u) => u.id, "marketing");
await esp.send(sendable);

• Fails closed. If the gate is unreachable the SDK denies — not being able to establish that processing is permitted is a reason to stop, not to continue.
• Cached both sides, so a check costs less than the branch you would have written anyway.
• Withdrawal is immediate. Withdrawing drops the cached snapshot, so the very next check reflects it.
• Never a bare boolean. Every answer carries a reason, so a refusal is actionable and a support ticket is answerable.

This is the sentence that changes the conversation with a regulator. Not "we hold 48,219 consents" — a claim about paperwork — but "the application asked 4.2 million times and was refused 380,000 times", a claim about behaviour, with counts to back it.

A gate only governs the code that calls it. The layer above it is reconciliation — comparing what consent permits against what the world actually observed.

The cookie scanner in Chapter 1 is this same idea pointed at the browser. This is it pointed at the server.