Architecting DigiLocker Document Verification Under the Indian DPDP Act

India's Digital Personal Data Protection (DPDP) Act establishes strict principles of purpose limitation, data minimization, and user-centric consent.

Consent-First Handshake

AuthSetu ensures that every DigiLocker interaction begins with explicit user consent:

1. The citizen is redirected to the official DigiLocker portal.

2. The user authenticates and grants permission for specified document types.

3. An authorization code is returned and exchanged securely via backend channels.

Ephemeral Storage & Retention Rules

Unless explicit document storage is configured by the tenant, AuthSetu verifies document metadata and purges raw documents from temporary memory, delivering verified identity signals directly to the customer webhook.