New Drupal DPDP Toolkit Records Consent and Data Rights Requests

Created for Drupal 11, the DPDP Compliance Toolkit debuted on 24 October 2026 with tools for recording consent decisions and Data Principal requests under India's Digital Personal Data Protection (DPDP) Act, 2023. Two subsequent alpha releases on 27 October introduced guardian-consent records, corrected access permissions and addressed Drupal compatibility. The project was created by Vinod Padayachi with StellerSight Private Limited listed as its supporting developer and maintainer.

The module maintains an append-only consent ledger recording each Data Principal, the purpose of consent, whether consent was granted or refused, and the language and version of the notice presented. Withdrawals are recorded without removing the original consent history. It also tracks requests involving access, correction, erasure, grievance redressal, and nomination, recording their progress, elapsed time and outcomes. Rejected requests must include documented reasons.

Developers can integrate existing consent interfaces through the dpdp.consent_recorder service rather than having those interfaces write records directly. The toolkit does not render consent forms or carry out data rights requests. Existing modules such as Klaro and EU Cookie Compliance can handle consent interactions, while the toolkit preserves associated records.

The 1.0.0-alpha2 release corrected an access-permission defect in the initial version. Although alpha1 defined five permissions, neither entity had an access handler to enforce them. According to the maintainer, access failed closed, meaning the defect did not expose records to unauthorised users. Instead, administrators could not grant auditors read-only access without providing broader administrative privileges. Alpha2 introduced access handlers and functional tests covering the intended permission separation.

The second alpha also added distinct guardian-consent records for children and persons with disabilities who have lawful guardians, reflecting different verification requirements under India's DPDP Rules. The form rejects claims of guardian consent when the method of verification has not been recorded. The maintainer reports 32 tests and 250 assertions against Drupal 11.4. Upgrading from alpha1 requires database updates and a review of existing consent records assigned the default adult category.

The latest release, 1.0.0-alpha3, corrects a compatibility issue involving Drupal 11.3's entity list builder method signature. It also introduces a GitLab CI pipeline and expands configuration documentation. The update does not change the consent or rights-request data model and requires no additional database update from alpha2.

The project arrives as India implements its DPDP legislation in phases. Under the government's commencement notification, Section 6(9) of the Act, concerning Consent Managers, is scheduled to take effect on 13 November 2026. Rule 4, governing Consent Manager registration and obligations, follows the same timetable under the Digital Personal Data Protection Rules, 2025. Major notice, consent, and Data Principal rights provisions are scheduled to take effect on 13 May 2027.

The toolkit remains an experimental alpha release and has not been used in production, according to its maintainer. Breach reporting, an itemised notice builder, and Consent Manager integration are not yet included. Although the ledger follows an append-only workflow, administrators retain deletion privileges, so records should not be considered immutable. The project is also outside Drupal's security advisory coverage and does not independently establish legal compliance. Organisations evaluating it must separately address consent collection, data retention and the actual fulfilment of rights requests.