DPDP & GDPR Compliance Module

┌──────────────┐     ┌──────────────┐     ┌──────────────┐
│   Created    │────▶│   Active     │────▶│  Withdrawn   │
│              │     │              │     │              │
│  Record is   │     │  Agent has   │     │  Grant is    │
│  created     │     │  access via  │     │  revoked,    │
│  with grant  │     │  grant token │     │  sub-agents  │
│              │     │              │     │  cascade     │
└──────────────┘     └──────┬───────┘     └──────────────┘
                            │
                            ▼
                     ┌──────────────┐
                     │   Expired    │
                     │              │
                     │  Retention   │
                     │  period      │
                     │  lapsed      │
                     └──────────────┘

import { DPDPClient } from '@grantex/dpdp';

const dpdp = new DPDPClient({
  apiKey: process.env.GRANTEX_API_KEY,
  dpoContact: {
    name: 'Data Protection Officer',
    email: 'dpo@yourcompany.com',
  },
  defaultRetention: '90d',
  grievanceSla: '72h',
});

const consent = await dpdp.createConsentRecord({
  principalId: 'user_rajesh_kumar',
  agentId: 'ag_email_summarizer',
  purposes: [
    {
      code: 'email:read',
      description: 'Read email subjects and bodies to generate daily summaries',
      dpdpSection: 'S.4',
      gdprArticle: 'Art.6(1)(a)',
      retention: '7d',
    },
  ],
  consentNotice: {
    language: 'en',
    text: 'This agent reads your emails to create daily summaries. Email content is processed in memory and not stored beyond 7 days.',
    version: '1.0',
  },
  dataCategories: ['communications', 'contacts'],
  crossBorder: false,
});

console.log(consent.id);          // "cns_01HZ..."
console.log(consent.grantId);     // "grt_01HZ..."
console.log(consent.status);      // "active"
console.log(consent.withdrawUrl); // "https://..."

from grantex_dpdp import DPDPClient, CreateConsentParams, Purpose, ConsentNotice

dpdp = DPDPClient(
    api_key=os.environ["GRANTEX_API_KEY"],
    dpo_contact={"name": "Data Protection Officer", "email": "dpo@yourcompany.com"},
    default_retention="90d",
    grievance_sla="72h",
)

consent = dpdp.create_consent_record(CreateConsentParams(
    principal_id="user_rajesh_kumar",
    agent_id="ag_email_summarizer",
    purposes=[
        Purpose(
            code="email:read",
            description="Read email subjects and bodies to generate daily summaries",
            dpdp_section="S.4",
            gdpr_article="Art.6(1)(a)",
            retention="7d",
        ),
    ],
    consent_notice=ConsentNotice(
        language="en",
        text="This agent reads your emails to create daily summaries.",
        version="1.0",
    ),
    data_categories=["communications", "contacts"],
    cross_border=False,
))

// List consent records for an agent
const records = await dpdp.listConsentRecords({
  agentId: 'ag_email_summarizer',
  status: 'active',
});

// Check purpose adherence
const adherence = await dpdp.checkPurposeAdherence({
  consentId: consent.id,
  dateRange: { from: '2026-03-01', to: '2026-04-01' },
});

console.log(adherence.compliant);  // true
console.log(adherence.violations); // []

// Get all consents for a data principal
const consents = await dpdp.listConsentRecords({
  principalId: 'user_rajesh_kumar',
});

// Withdraw consent — triggers instant grant revocation
await dpdp.withdrawConsent(consent.id);

// After withdrawal:
// - Grant token is revoked (< 1 second)
// - All sub-agent delegations are cascade-revoked
// - Audit entry records the withdrawal
// - Developer receives webhook notification

// Export all data for a data principal (DPDP S.11 / GDPR Art.20)
const export = await dpdp.exportPrincipalData({
  principalId: 'user_rajesh_kumar',
  format: 'json',
});
// Returns: consent records, processing history, agent metadata

// Submit a grievance (DPDP S.13)
const grievance = await dpdp.submitGrievance({
  principalId: 'user_rajesh_kumar',
  consentId: consent.id,
  description: 'Agent accessed contacts that were not part of the declared purpose.',
  category: 'purpose_violation',
});

console.log(grievance.id);          // "grv_01HZ..."
console.log(grievance.status);      // "open"
console.log(grievance.slaDeadline); // ISO 8601 timestamp (72h from submission)

const pack = await dpdp.exportAudit({
  framework: 'dpdp',
  dateRange: { from: '2026-01-01', to: '2026-04-01' },
  format: 'json',
});

const pack = await dpdp.exportAudit({
  framework: 'gdpr',
  principalId: 'user_rajesh_kumar',
  format: 'json',
});

const pack = await dpdp.exportAudit({
  framework: 'eu-ai-act',
  dateRange: { from: '2026-01-01', to: '2026-07-31' },
  format: 'json',
});

import { DPDPClient } from '@grantex/dpdp';

const dpdp = new DPDPClient({
  apiKey: process.env.GRANTEX_API_KEY,
});

const consent = await dpdp.createConsentRecord({
  principalId: 'user_123',
  agentId: 'ag_my_agent',
  purposes: [{ code: 'calendar:read', description: 'Read calendar', dpdpSection: 'S.4', retention: '30d' }],
  consentNotice: { language: 'en', text: 'This agent reads your calendar.' },
  dataCategories: ['schedule'],
  crossBorder: false,
});

const adherence = await dpdp.checkPurposeAdherence({ consentId: consent.id });

await dpdp.withdrawConsent(consent.id);

const pack = await dpdp.exportAudit({ framework: 'dpdp', format: 'json' });