The DPDP Act skill for Claude Code
A free, open-source skill that makes Claude answer Indian data protection questions from the verbatim Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025, with a section or rule anchor on every claim.
Install in two commands
Inside Claude Code, run:
/plugin marketplace add mksd0398/dpdp-act-skill
/plugin install dpdp-analyze@dpdpThen type /dpdp-analyze, or just ask an Indian privacy question. The skill triggers on its own whenever a question touches Indian data protection law, whether or not you say “DPDP”. Update with /plugin marketplace update dpdp.
Prefer to copy the folder by hand?
git clone https://github.com/mksd0398/dpdp-act-skill.git
cp -r dpdp-act-skill/skills/dpdp-analyze ~/.claude/skills/Claude Code reads personal skills from ~/.claude/skills/ and project skills from .claude/skills/ in a repository, so you can also commit it to a project and share it with your team.
Use it in Claude.ai, Copilot, Gemini, Codex and Cursor
The skill is a standard SKILL.md folder in the open Agent Skills format, so it is not tied to Claude Code.
| Tool | How |
|---|---|
| Claude.ai (web, desktop, mobile) | Download dpdp-analyze.zip, then Customize › Skills › + › Create skill › Upload a skill. Code execution must be on. |
| GitHub Copilot (CLI, VS Code, coding agent) | gh skill install mksd0398/dpdp-act-skill dpdp-analyze |
| Gemini CLI | gemini skills install https://github.com/mksd0398/dpdp-act-skill.git --path skills/dpdp-analyze |
| Many agents at once | npx skills add mksd0398/dpdp-act-skill |
| OpenAI Codex, Cursor, Goose, OpenCode, Junie, Amp | Copy skills/dpdp-analyze into ~/.agents/skills/, or into .agents/skills/ in a project |
| Claude API | Upload the folder with the Skills API |
| Anything else (RAG, custom GPTs, prompt libraries) | Index the reference files or this site's llms-full.txt |
What you can ask
Review documents
Is this privacy policy DPDP compliant? [paste or attach it]
Review this consent screen against section 6 and Rule 3.
Check this vendor DPA for what section 8(2) and Rule 6(1)(f) require.
Audit a product
Audit our signup and onboarding flow against the DPDP Act.
Run the full DPDP compliance checklist against this repository.
Our app has users under 18. What has to change before 14 May 2027?
Answer a question
Do we need a DPO in India?
Can we store Indian customer data on AWS Frankfurt?
Are we a Significant Data Fiduciary?
Handle an incident
We had a data breach. What do we have to do, and by when?
Draft the Rule 7 notice to affected users.
Is a ransomware lockout a personal data breach under the DPDP Act?
Why it is more accurate than a general chatbot
Language models get Indian data protection law wrong in specific, repeatable ways, because they pattern-match to the GDPR. The skill pins the actual text and makes Claude follow seven hard rules:
- No proposition without an anchor. Every claim cites a section or rule, or Claude says it does not know.
- Quote only the verbatim Gazette text, never the Act from memory.
- Flag the Rules as secondary-sourced and tell you to verify them.
- Treat penalties as ceilings, gated on the Board finding a breach “significant”.
- Check commencement before calling anything binding.
- Never import the GDPR: no sensitive-data tier, no legitimate interests, no portability, no compensation.
- Say it is not legal advice, once, at the end.
What it looks like
Illustrative answer
“Do we need a DPO in India?”
No, unless the Central Government has notified you as a Significant Data Fiduciary. Only SDFs must appoint a Data Protection Officer, who must be an individual based in India and responsible to the board of directors (s.10(2)(a)). Every other Data Fiduciary publishes the business contact details of a person who can answer questions about its processing (s.8(9), Rule 9).
Trap: size alone does not make you an SDF, and you cannot self-classify (s.10(1)). No SDF had been notified as at the last check.
Not legal advice. Verify statutory text against the Gazette of India and consult qualified Indian legal counsel before acting.
What ships in the skill
| File | What it is |
|---|---|
| act-full-text.md | All 44 sections and the Schedule, verbatim from the Gazette, with all 14 Illustrations |
| rules-2025.md | All 23 Rules and 7 Schedules with commencement dates |
| doctrine.md | The five gates, consent architecture, exemptions, enforcement and 16 common misreadings |
| compliance-checklist.md | A 78-point audit checklist, every item anchored |
| section-index.md | One line per section, for fast lookup |
| report-template.md | A formal assessment report template |
Questions about the skill
Is the DPDP skill free?
Yes. The skill, the reference files and this site are open source under the MIT licence. The Act and Rules text are Government of India works reproduced under section 52(1)(q) of the Copyright Act, 1957.
What do I need to run it?
Claude Code, Anthropic's agentic coding tool, which runs in the terminal, IDEs, the desktop app and the web. The skill is a standard SKILL.md folder with plain Markdown references, so agents that support the Agent Skills format can load it too, and the reference files work in any RAG index or prompt library unchanged.
Does the skill send my data anywhere?
The skill itself makes no network calls. It is instructions plus reference files that Claude reads locally. Your prompts and any documents you share are processed by Claude under the terms of your own Claude plan, as with any other Claude Code session.
How is it different from asking a chatbot about the DPDP Act?
General-purpose models pattern-match Indian law to the GDPR and invent things that are not in the DPDP Act, such as a sensitive-data category or a legitimate interests ground. The skill makes Claude walk the Act's five gates, quote only from the verbatim Gazette text, cite a section or rule for every proposition, check commencement dates, and say what is still unsettled.
Is the output legal advice?
No. The output is machine-generated analysis and can be wrong. The skill closes every substantive answer with a reminder to verify against the Gazette of India and consult qualified Indian legal counsel.
How do I update it?
Run /plugin marketplace update dpdp inside Claude Code. Corrections and new government notifications are tracked in the GitHub repository.
Last updated . Report an error.