Meet India's DPDP Act 2023 and the EU AI Act for AI agent deployments. Structured consent records, purpose limitation, right to withdrawal, and audit-ready exports — built into the Grantex protocol.
Grantex maps your AI agent authorization infrastructure directly to regulatory requirements. No separate compliance layer needed.
India's Digital Personal Data Protection Act creates specific obligations for AI agents that process personal data of Indian residents.
The world's first comprehensive AI regulation. Key provisions for AI agent deployments become binding in August 2026.
The first industry threat taxonomy for AI agents. Published December 2025. Four of ten risks directly addressed by authorization infrastructure.
Every Grantex authorization creates a DPDPConsentRecord that maps directly to DPDP Act requirements. No bolted-on compliance layer — it is the authorization layer.
import { DPDPClient } from '@grantex/dpdp'; const dpdp = new DPDPClient({ apiKey: process.env.GRANTEX_API_KEY, }); // Create a DPDP-compliant consent record const consent = await dpdp.createConsentRecord({ principalId: 'user_rajesh_kumar', agentId: 'ag_calendar_assistant', purposes: [ { code: 'calendar:read', description: 'Read calendar events', dpdpSection: 'S.4', retention: '30d', }, { code: 'calendar:write', description: 'Create and modify events', dpdpSection: 'S.4', retention: '30d', }, ], consentNotice: { language: 'en', text: 'This agent will access your calendar to schedule and manage meetings on your behalf.', }, dataCategories: ['schedule', 'contacts'], crossBorder: false, }); // consent.id → "cns_01HZ..." // consent.status → "active" // consent.withdrawUrl → consent withdrawal endpoint // consent.grantId → linked Grantex grant
Each consent record captures the specific data principal, the agent, the purposes, and a plain-language consent notice. The record is immutable and timestamped.
Every purpose is tagged with its DPDP section reference and a retention period. The agent can only access data for the declared purposes. Enforcement happens at the grant token level — the JWT scopes match the declared purposes.
Every consent record includes a withdrawal URL. Withdrawal triggers instant revocation of the underlying Grantex grant, cascading to all delegated sub-agents. The withdrawal is as easy as granting consent.
The consent record links to all audit entries for that grant. Data principals can export their complete processing history via the portal or API.
The consent notice is stored alongside the technical authorization. Auditors can verify that the user saw a clear explanation of what the agent does.
Monitor consent status, purpose adherence, and withdrawal rates across all agents and data principals.
| Agent | Principal | Purposes | Status | Granted |
|---|---|---|---|---|
| calendar-assistant | rajesh.kumar@example.com | calendar:read, calendar:write | Active | 2026-04-01 |
| email-summarizer | priya.sharma@example.com | email:read | Active | 2026-03-28 |
| doc-analyzer | amit.patel@example.com | files:read, files:analyze | Withdrawn | 2026-03-15 |
| hr-assistant | deepa.nair@example.com | employee:read, payroll:view | Active | 2026-03-10 |
| travel-planner | vikram.singh@example.com | calendar:read, travel:book | Expired | 2026-02-20 |
DPDP Act Section 11 requires that data principals can access, correct, and withdraw their consent at any time. Grantex provides this out of the box.
Data principals see every agent that has access to their data, what scopes were granted, when consent was given, and retention periods.
Withdrawing consent is as easy as granting it. One click triggers instant revocation of the underlying grant token, cascading to all delegated sub-agents.
View the complete audit trail of what each agent did with the granted access. Hash-chained entries ensure the log cannot be tampered with.
Export consent records, processing history, and agent metadata in machine-readable JSON. Satisfies DPDP Section 11 and GDPR Article 20.
Integrated grievance form per DPDP Section 13. Data principals can flag consent violations, and the system routes to the designated Data Protection Officer.
Every DPDP obligation that applies to AI agent deployments has a corresponding Grantex feature. No gaps, no manual processes.
| DPDP Section | Obligation | Grantex Feature |
|---|---|---|
| Section 4 | Lawful purpose — personal data shall be processed only for a lawful purpose | Purpose-tagged consent records; JWT scp claim enforces scope at every API call |
| Section 5 | Notice — data fiduciary must give notice before processing | Consent notice stored in DPDPConsentRecord; human-readable consent UI |
| Section 6 | Consent — processing based on free, specific, informed consent | Structured consent flow; purpose-specific scope selection; immutable record |
| Section 6(6) | Withdrawal — consent withdrawal must be as easy as granting | One-click withdrawal in data principal portal; instant grant revocation |
| Section 8 | Data fiduciary obligations — accuracy, storage limitation, security | Retention periods per purpose; auto-expiry; audit trail; encryption at rest |
| Section 8(7) | Grievance redressal — data fiduciary must have a grievance mechanism | Integrated grievance form in data principal portal; DPO routing |
| Section 9 | Children's data — additional protections for minors | Age flag on consent records; separate approval flow for minor data principals |
| Section 11 | Data principal rights — access, correction, erasure, portability | Self-service portal; JSON export; processing history; correction requests |
| Section 13 | Grievance mechanism — respond within prescribed period | Grievance tracking with SLA timers; escalation to Data Protection Board |
| Section 16 | Cross-border transfer — restrictions on data transfer outside India | crossBorder flag on consent records; data residency controls in grant tokens |
| Section 17 | Data Protection Board — regulatory oversight and penalties | Audit export packages formatted for Board inspection requirements |
Generate compliance evidence packages formatted for DPDP, GDPR, and EU AI Act requirements. One API call, framework-specific output.
Complete consent and processing records formatted for India's Data Protection Board. Includes all mandatory fields from Sections 6, 8, 11, and 13.
Subject access request response package. All data processing activities related to a specific data principal, formatted per Article 15 requirements.
Technical documentation per Articles 9, 13, and 17. Maps your Grantex configuration to EU AI Act conformity requirements.
// Generate a DPDP audit export const pack = await dpdp.exportAudit({ framework: 'dpdp', dateRange: { from: '2026-01-01', to: '2026-04-01' }, format: 'json', // or 'csv', 'pdf' }); // Also available: 'gdpr', 'eu-ai-act' const gdprPack = await dpdp.exportAudit({ framework: 'gdpr', principalId: 'user_rajesh_kumar', format: 'json', });
The DPDP Act is active now. The EU AI Act is binding August 2026. Grantex gives you the compliance infrastructure so you can focus on shipping.
npm install @grantex/dpdp
Copy
pip install grantex-dpdp
Copy