dpdp

Compliance is an API, not a scramble

India's DPDP Act wants purpose-level consent, withdrawal, and Data Principal rights. NexAuth stores consent as records — hash-chained, tamper-evident.

Consent at auth-time

otp + consent

POST /v1/otp/verify
{
  "identifier": "+91…", "code": "…",
  "consent": [{ "purpose": "txn_auth", "version": "v1.2" }]
}
→ consent row persisted with the session — timestamped, versioned

Withdrawal + DSR

POST /v1/dpdp/consent/withdraw — records withdrawal, propagates to your webhooks
GET /v1/dpdp/export/:user — full data export (DSR)
DELETE /v1/dpdp/erase/:user — erasure with audit receipt
Every record hash-chains to the previous — retroactive edits are detectable