India Digital Personal Data Protection (DPDP) Act 2023 - Local Privacy Impact Assessment (PIA) & Regulatory Risk Engine

GitHub Repository: BHARATPIA

What is this

The India DPDP Local PIA Engine (pia-india) is an air-gapped ready, full-stack enterprise Privacy Impact Assessment (PIA) and Data Protection Impact Assessment (DPIA) regulatory risk-scoring platform. Tailored specifically to India's Digital Personal Data Protection (DPDP) Act 2023, ISO/IEC 27701 (PIMS), and ISO/IEC 42001:2023 (AIMS), it provides:

7-Step DPIA Risk Scoring Matrix: Evaluates Impact vs. Likelihood with an interactive 5x5 matrix grid and residual risk rating calculations.
Dual-Role Persona Architecture: Switch seamlessly between Assessment Owner (Business/Dev) and SME Auditor / Data Protection Officer (DPO) modes.
Statutory Regulatory Framework Tailoring: Includes sector-specific rule sets for Banking & Open Banking, Telemedicine & Healthcare, E-Commerce & Retail, Fintech & Lending, and EdTech.
Configurable LLM Advisory Engine: Supports the default built-in Gemini 3.6-Flash model alongside custom connection settings for local air-gapped LLMs like OLLAMA, LM Studio, Anything LLM, Lemonade, or custom OpenAI-compatible endpoints.
Cryptographic Provenance & Audit Lineage: Immutable SHA-256 audit trail logs, version tracking (v1.0-draft, v1.0, v2.0), and dual-ID binding (FID for frontend server tracking, BID for backend audit tracking).
Official DPO Sign-Off & Certificates: Generates printable/exportable DPO compliance certificates with cryptographic hash verification.

Why

Mandatory DPDP Act 2023 & ISO/IEC 42001 Compliance: India's DPDP Act mandates strict data fiduciary duties, explicit notice & consent management, restrictions on child data processing, and penalties up to ₹250 Cr for breaches.
Data Sovereignty & Air-Gapped Security: Enterprise legal, security, and privacy teams cannot upload internal system architecture, PII data flow diagrams, or security vulnerabilities to public SaaS clouds.
Local & Custom LLM Integration: By supporting local LLM runtimes (Ollama, LM Studio, AnythingLLM, Lemonade) alongside Gemini, organizations maintain total data privacy without leaking sensitive corporate metadata over the public internet.
Cryptographic Tamper-Proof Audit Trail: Every assessment score update, SME override, and DPO decision is cryptographically chained with SHA-256 hashes to guarantee provenance during regulatory audits.

How

Risk Scoring Algorithm:
- Impact Score ($I$): $\text{Average}(Q_1, Q_2, Q_3)$ (Data Sensitivity, Data Volume, Potential Harm).
- Likelihood Score ($L$): $\text{Average}(Q_4, Q_5, Q_6, Q_7)$ (Storage & Cross-Border Flow, Access Control, Technical Security, Retention Period).
- Total Risk Score: $I \times L$ (Scale: $1.0$ to $25.0$).
- Risk Tiers:
  - LOW RISK (1.0 - 4.0): Accept & manage via standard procedures.
  - MEDIUM RISK (4.1 - 11.0): Monitor, annual review & logging.
  - HIGH RISK (11.1 - 19.0): Mitigate via encryption, Consent Manager & RBAC.
  - CRITICAL RISK (19.1 - 25.0): Stop processing until DPO & Legal review.
Custom LLM Routing:
- The Express backend (/api/ai-risk-advice & /api/ai/polish-scope) checks for custom endpoint parameters (e.g., http://localhost:11434/v1 for Ollama or http://localhost:1234/v1 for LM Studio).
- If configured, AI advisory requests proxy directly to the local model endpoint. Otherwise, the server defaults to built-in Gemini 3.6-Flash without exposing secret keys to the browser.
Dual-ID & Audit Lineage Binding:
- Draft creation and frontend submissions assign a Frontend Server ID (FID, e.g., PIA-FE-2026-X89K2L1P).
- DPO audit approvals append a Backend Audit ID (BID, e.g., PIA-BE-IN-2026-000412).
- SHA-256 hashes are computed across {FID, BID, Version, Decision, Timestamp, Payload}.

Schema

The database and state schema support complete assessment campaigns, question scores, provenance logs, and sector contexts:

`assessment_campaigns` Schema

Field	Type	Description
`id`	`VARCHAR(64) PRIMARY KEY`	Primary key identifier
`frontendServerId`	`VARCHAR(64)`	Frontend Tracking Identifier (`FID`)
`backendAuditId`	`VARCHAR(64)`	DPO / Auditor Tracking Identifier (`BID`)
`title`	`VARCHAR(255)`	Campaign / Project Name
`entityType`	`VARCHAR(64)`	Entity category (Data Fiduciary / Data Processor / Vendor)
`scopeCategory`	`VARCHAR(64)`	Scope category (Project, Product, Vendor, Infrastructure, AI/ML)
`contextScope`	`TEXT`	Scope description & operational context
`sectorId`	`VARCHAR(64)`	Sector profile (e.g., `SEC_FINANCE`, `SEC_HEALTH`)
`usesAiMlModels`	`BOOLEAN`	Toggles ISO/IEC 42001 (AIMS) AI controls
`processesChildData`	`BOOLEAN`	Toggles DPDP Section 9 child privacy controls
`status`	`VARCHAR(32)`	Status (`DRAFT`, `SUBMITTED`, `UNDER_REVIEW`, `APPROVED`, `REVISION_REQUESTED`)
`q1_sensitivity`	`INTEGER`	Data Sensitivity Score (1-5)
`q2_volume`	`INTEGER`	Data Volume Score (1-5)
`q3_harm`	`INTEGER`	Potential Harm Score (1-5)
`q4_storage`	`INTEGER`	Storage & Transborder Flow Score (1-5)
`q5_access`	`INTEGER`	Access Control Score (1-5)
`q6_security`	`INTEGER`	Technical Security Score (1-5)
`q7_retention`	`INTEGER`	Retention Period Score (1-5)
`impactScore`	`REAL`	Calculated Impact Score ($I$)
`likelihoodScore`	`REAL`	Calculated Likelihood Score ($L$)
`overallComplianceScore`	`INTEGER`	Compliance Percentage Score (0-100%)
`residualRiskRating`	`VARCHAR(32)`	Calculated Risk Rating (`LOW`, `MEDIUM`, `HIGH`, `CRITICAL`)
`smeOverrideRating`	`VARCHAR(32)`	Auditor Overridden Rating
`smeOverrideRationale`	`TEXT`	Mandatory justification for rating override
`dpoSignerName`	`VARCHAR(255)`	Name of approving DPO
`dpoSignoffDate`	`TIMESTAMP`	DPO approval timestamp
`version`	`VARCHAR(16)`	Version string (`v1.0-draft`, `v1.0`, `v2.0`)
`provenanceLogs`	`JSON / TEXT`	Cryptographic SHA-256 provenance log array

Provenance Log Entry Structure

{
  "id": "prov_1722415200000_a1b2",
  "timestamp": "2026-07-31T08:40:00.000Z",
  "actor": "amitkp.consulting@gmail.com",
  "role": "Data_Protection_Officer",
  "action": "DPO_SIGN_OFF",
  "version": "v2.0",
  "delta": "Approved with recommendation for quarterly audit",
  "sha256Hash": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
}

Platform

Frontend: React 18, TypeScript, Tailwind CSS, Lucide React Icons, React Markdown.
Backend: Express.js server (server.ts) with Vite middleware in development mode and static production serving via CommonJS bundle (dist/server.cjs).
AI Runtimes:
- @google/genai TypeScript SDK (built-in Gemini 3.6-Flash server-side integration)
- HTTP proxy for local OpenAI-compatible endpoints (OLLAMA, LM Studio, Anything LLM, Lemonade)
Container Ingress & Binding: Cloud Run / Docker containers bound to 0.0.0.0:3000.

How to install using git

Prerequisites

Node.js: v18.x or v20.x or higher
npm: v9.x or higher
Git: Installed on system

Installation Commands

# 1. Clone the GitHub repository
git clone https://github.com/amitkpconsulting-spec/pia-india.git

# 2. Navigate into the cloned directory
cd pia-india

# 3. Install required node dependencies
npm install

# 4. Configure optional Environment Variables (if using default Gemini API)
echo "GEMINI_API_KEY=your_gemini_api_key_here" > .env

# 5. Start the development server
npm run dev

# Open browser at http://localhost:3000

Using start.bat and setup.bat

For air-gapped Windows enterprise workstations or offline environments where automated setup scripts are preferred, the repository includes one-click executable batch files.

Step 1: Run `setup.bat` (Automated One-Click Setup)

Double-click setup.bat or run it from Command Prompt / PowerShell:

setup.bat

What setup.bat performs automatically:

Verifies local installation of Node.js and npm.
Creates required build directories (dist/, data/).
Installs all project dependencies (npm install).
Generates local .env configuration files for air-gapped execution.
Verifies local database schema setup (schema.sql).

Step 2: Run `start.bat` (Automated Application Launch)

Double-click start.bat or run it from Command Prompt / PowerShell:

start.bat

What start.bat performs automatically:

Boots the full-stack server on http://localhost:3000.
Connects to your configured local LLM (OLLAMA, LM Studio, Anything LLM) or Gemini API.
Opens http://localhost:3000 in your default web browser automatically.

📄 License



This software and associated documentation files (the "Software") are the proprietary property of Technoscope (Amit Kumar Pandey).

By downloading, accessing, or using the Software, you agree to the following terms:

1. Grant of Limited License
You are granted a limited, non-exclusive, non-transferable right to download, install, and evaluate the Software for internal, non-commercial testing purposes only.

2. Absolute Ownership
The Software is licensed, not sold. Technoscope (Amit Kumar Pandey) retains all intellectual property rights, title, and interest in and to the Software. You may not claim ownership of the Software, its source code, or any derivative works under any circumstances.

3. Restrictions on Use
Without prior explicit, written permission from the copyright holder, you MAY NOT:

Use the Software for commercial purposes, including in production environments.

Modify, alter, or create derivative works of the Software.

Distribute, sub-license, host, or sell the Software to any third party.

Remove or alter any copyright notices or proprietary markings.

4. Consultancy, Advisory, and Commercial Use
Any production deployment, commercial usage, or requirement for technical support, implementation advisory, and compliance consultancy must be obtained directly from Technoscope (Amit Kumar Pandey).

To request commercial licensing, advisory services, or permission for restricted uses, please contact: [amitkp.consulting@gmail.com / www.technoscope.com]

5. Limitation of Liability
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES, OR OTHER LIABILITY ARISING FROM, OUT OF, OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

Name		Name	Last commit message	Last commit date
src		src
README.md		README.md
bun.lock		bun.lock
index.html		index.html
metadata.json		metadata.json
package.json		package.json
schema.sql		schema.sql
server.ts		server.ts
setup.bat		setup.bat
start.bat		start.bat
tsconfig.json		tsconfig.json
vite.config.ts		vite.config.ts

Navigation Menu

Repository files navigation

India Digital Personal Data Protection (DPDP) Act 2023 - Local Privacy Impact Assessment (PIA) & Regulatory Risk Engine

What is this

Why

How

Schema

`assessment_campaigns` Schema

Provenance Log Entry Structure

Platform

How to install using git

Prerequisites

Installation Commands

Using start.bat and setup.bat

Step 1: Run `setup.bat` (Automated One-Click Setup)

Step 2: Run `start.bat` (Automated Application Launch)

About

Releases

Packages

Contributors

Languages

Latest commit

History

Folders and files

Repository files navigation

India Digital Personal Data Protection (DPDP) Act 2023 - Local Privacy Impact Assessment (PIA) & Regulatory Risk Engine

What is this

Why

How

Schema

assessment_campaigns Schema

Provenance Log Entry Structure

Platform

How to install using git

Prerequisites

Installation Commands

Using start.bat and setup.bat

Step 1: Run setup.bat (Automated One-Click Setup)

Step 2: Run start.bat (Automated Application Launch)

About

Topics

Resources

Stars

Watchers

Forks

Releases

Packages

Contributors

Languages

`assessment_campaigns` Schema

Step 1: Run `setup.bat` (Automated One-Click Setup)

Step 2: Run `start.bat` (Automated Application Launch)