dpdpkit-fastapi

FastAPI adapter for dpdpkit. It adds consent, versioned notices, rights requests and retention to your FastAPI app, with tables in your own database. This is the reference implementation of the dpdpkit REST contract.

Disclaimer. dpdpkit is software that helps you implement obligations under India's Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025. It does not provide legal advice and does not guarantee compliance. Decisions about notices, purposes, retention and incident reporting must be made by you or your counsel.

Install

pip install "dpdpkit[fastapi]"                          # or: pip install dpdpkit-fastapi
pip install "dpdpkit-fastapi[scheduler,postgres]"       # APScheduler + psycopg

Quickstart

dpdpkit init            # writes dpdpkit.yaml: purposes, notice text, contact details

from fastapi import Depends, FastAPI
from dpdpkit.fastapi import DPDPKit, require_consent

app = FastAPI()
dpdp = DPDPKit(
    db_url=settings.DATABASE_URL,
    config="dpdpkit.yaml",  # policy pack, purposes, notice
    principal_resolver=lambda request: request.state.user.id,  # stable id, no personal data
    admin_guard=lambda request: "admin" if request.state.user.is_staff else None,
    signing_key=settings.DPDPKIT_SIGNING_KEY,  # signs consent receipts
    contact_resolver=lookup_contact,  # principal -> Contact(email=..., phone=...)
    notifier=SmtpNotifier("smtp.example.in", sender="privacy@example.in"),
)
dpdp.install(app, prefix="/dpdp")  # router + error handlers + activity middleware + admin


@dpdp.kit.retention.register_handler
def erase(principal: str, purposes: list[str]) -> None: ...  # delete or anonymise your own rows


@app.post("/offers/send", dependencies=[Depends(require_consent("marketing"))])
async def send_offer(): ...

dpdpkit migrate --db-url "$DATABASE_URL"        # Alembic migrations shipped in the package

Run the scheduler in one process (or call dpdpkit retention run from cron):

dpdp.start_scheduler(retention_minutes=15)  # retention run + daily ledger verification

What you get

Example

examples/fastapi_shop is a small shop with consent, requests and erasure handlers. It passes the conformance suite:

cd examples/fastapi_shop
uvicorn app:app --reload                                  # http://localhost:8000/docs
DPDPKIT_CONFORMANCE=1 DPDPKIT_ASGI_APP=app:app dpdpkit-conformance

Licence

Apache-2.0.