I Built a CLI to Scan JS/TS Apps for India's DPDP Act Compliance

India's Digital Personal Data Protection Act (DPDP) came into force recently. Applications serving Indian users may now be in violation if they fulfill certain conditions. These include loading analytics or tracking scripts without user consent, storing sensitive data like Aadhaar, PAN, or contact information in local storage without encryption, transmitting personal information to analytics platforms without consent, lacking a privacy policy page, and exporting bulk user data without audit logging. Penalties for non-compliance can reach up to ₹250 crore.

A new command-line interface (CLI) tool called '@dpdp-india/audit' has been introduced to assist developers in scanning their JavaScript/TypeScript codebases for DPDP compliance issues. It functions similarly to ESLint but focuses on privacy-related issues. By running the command "npx @dpdp-india/audit ./src", developers can receive a report highlighting any potential violations found in the specified directory.

The report format displays the framework being analyzed (e.g., Next.js), the number of files scanned, and details of each violation, including the file location, line number, and specific rule that was triggered. For example, a violation might indicate that Google Analytics was loaded without a consent mechanism in place, requiring the developer to implement a consent check before using the analytics service.

The tool targets three primary categories of compliance violations:

1. Unconsented data collection

2. Insecure storage of sensitive information

3. Leaking personal data through various means (such as HTTP headers or analytics calls)

The CLI also includes a built-in Consent SDK specifically designed for Next.js applications. This SDK provides a ConsentProvider component that handles user consent flow and stores the user's choices in a cookie named 'dpdp_consent'. By integrating this provider into the application's layout, developers can ensure that all scripts and tracking calls are executed only after obtaining explicit user consent.

Furthermore, the SDK offers pre-built components like ConsentBanner for displaying the consent options (Accept All, Reject All, or Customize Preferences) and a useConsent hook that can be utilized in individual components to verify whether the user has granted permission for specific types of data collection. This allows developers to conditionally load scripts or execute code only when the user has explicitly given their consent.

The '@dpdp-india/audit' tool also offers build-time enforcement, ensuring that the application will fail to build if any DPDP violations are detected. This can be achieved by adding the '@dpdp-india/audit/next' package to the project's 'next.config.js' file and configuring it with the 'withDpdpAudit' function. The tool allows developers to specify which directories to exclude from the audit process and defines the desired behavior when violations are found.

For Continuous Integration/Continuous Deployment (CI/CD) pipelines, the tool generates SARIF (Software Assurance Marketplace Integration Format) output that can be integrated with platforms like GitHub Code Scanning. This integration automatically flags any DPDP compliance issues in the CI/CD process, providing developers with real-time feedback during the development cycle.