Consent Docs
Open console

Law and project events

The webhook events for a changed DPDP rule set, a published privacy policy and a project that is closing or deleted, with examples.

Reference3 min readFor developers calling the REST API

Four webhook events report changes to the law the checks use, to your privacy policy and to the project itself. Each arrives in the envelope described in Webhook format. In all of them the envelope's test is false.

Events#

ruleset.changed#

Sent when

The DPDP rule set in force differs from the one someone in the project last acknowledged. The cause is a new release, or a change the platform team recorded because the Government notified one. It is sent once for each change. That is within minutes of an operator's change or of the API starting, and otherwise at 07:00 in the API's time zone. Review the DPDP Act check.

Payload

Field in data Type Description
law string DPDP.
version string The rule set version now in force, such as 2026.1.
reviewedOn date When that version was last checked against the Gazette.
fingerprint string SHA-256 over the commencement dates and values now in force.
previousVersion string The version the project last acknowledged.
previousFingerprint string The fingerprint of the dates and values it last acknowledged.
changes array One entry for each date that moved: key, provisions, from, to, setBy (RELEASE or OPERATOR) and setOn.
valueChanges array One entry for each value that changed: key, label, unit (days or hours), provisions, from, to, effectiveFrom, setBy and setOn.
ruleChanges array One entry for each threshold, list, wording or written rule that changed: key, label, change (CREATED, CHANGED or RETIRED) and effectiveFrom.
dates array Every commencement date now in force, with key, provisions, date, releaseDate, setBy, setOn, instrument, citation and url.
values array Every value, with key, label, unit, value, inForce, releaseValue, effectiveFrom, provisions, setBy, setOn, instrument, citation and url. value is the amended value; inForce is the one in force today.

The keys are listed in DPDP rule set.

Example

JSON
{
  "id": "6b1f0e2a-3c4d-4e5f-8a9b-0c1d2e3f4a5b",
  "type": "ruleset.changed",
  "createdOn": "2026-10-10T07:00:04.118Z",
  "projectId": "c2a6f0de-51b3-4f0a-9d7e-8b1f3a6c4e90",
  "test": false,
  "data": {
    "law": "DPDP",
    "version": "2026.2",
    "reviewedOn": "2026-11-07",
    "fingerprint": "9c3e…",
    "previousVersion": "2026.2",
    "previousFingerprint": "41d7…",
    "changes": [
      {
        "key": "act-eighteen-months",
        "provisions": "Sections 3 to 5, 6(1) to (8) and (10), 7 to 17, …",
        "from": "2027-05-13",
        "to": "2026-11-13",
        "setBy": "OPERATOR",
        "setOn": "2026-10-10T06:58:41.000Z"
      }
    ],
    "valueChanges": [
      {
        "key": "board-report-hours",
        "label": "Full report of a breach to the Board",
        "unit": "hours",
        "provisions": "Rule 7(2)(b)",
        "from": 72,
        "to": 48,
        "effectiveFrom": "2027-01-01",
        "setBy": "OPERATOR",
        "setOn": "2026-11-07T06:58:41.000Z"
      }
    ],
    "ruleChanges": [
      {
        "key": "eighth-schedule-languages",
        "label": "Languages a notice and request must be offered in",
        "change": "CHANGED",
        "effectiveFrom": "2027-02-01"
      }
    ],
    "dates": [],
    "values": []
  }
}

policy.published#

Sent when

A privacy policy or other notice is published. Forms linked to it that still show an earlier version are listed, with the current records collected under them. After a material change, ask those people again or tell them. See Update the privacy policy.

Payload

Field in data Type Description
policyId UUID The policy's id.
policyKey string The policy's key.
title string Its title.
type string PRIVACY_POLICY, COOKIE_POLICY, NOTICE_AT_COLLECTION, TERMS or DPA.
version integer The version now published.
changeType string WORDING when nothing new is asked of anyone, MATERIAL when what people agreed to changes. The publisher chooses.
contentHash string The hash of the published wording.
publishedOn time When it was published.
changeNote string The publisher's note. Empty when none was given.
affectedFormIds array of UUIDs Published forms linked to the policy that show an earlier version.
affectedRecords integer Current live records, granted or partly granted, collected under those forms' earlier versions.

Example

JSON
{
  "id": "0f4e8d2c-9b7a-4c61-8e5d-3a2b1c0d9e8f",
  "type": "policy.published",
  "createdOn": "2026-10-09T11:20:45.902Z",
  "projectId": "c2a6f0de-51b3-4f0a-9d7e-8b1f3a6c4e90",
  "test": false,
  "data": {
    "policyId": "8d2f6a10-4b3c-4e9d-a1f7-5c6b2e9d0a34",
    "policyKey": "privacy-policy-en",
    "title": "Kaveri Stores privacy policy",
    "type": "PRIVACY_POLICY",
    "version": 3,
    "changeType": "MATERIAL",
    "contentHash": "b5c2…",
    "publishedOn": "2026-10-09T11:20:45.000Z",
    "changeNote": "Orders are now shared with our courier partner",
    "affectedFormIds": ["0b9c6f0e-6a55-4c1e-9d0a-2f6f0f4f7a11"],
    "affectedRecords": 1840
  }
}

project.closing#

Sent when

An owner schedules the project's deletion, or cancels it. Stop sending new data to the project before deleteOn. See Close a project.

Payload

Field in data Type Description
closureId UUID The closure's id.
status string SCHEDULED, or CANCELLED when the owner cancels.
scheduledOn time When the deletion was scheduled.
deleteOn time When the deletion starts.
deletionDays integer Days between scheduling and deletion.
rows object Rows held in each table when it was scheduled.

Example

JSON
{
  "id": "a3c5e7f9-1b2d-4f6a-8c0e-2d4f6a8c0e1b",
  "type": "project.closing",
  "createdOn": "2026-10-09T12:02:10.300Z",
  "projectId": "c2a6f0de-51b3-4f0a-9d7e-8b1f3a6c4e90",
  "test": false,
  "data": {
    "closureId": "5e7a9c1b-3d5f-4a7c-9e1b-3d5f7a9c1e3b",
    "status": "SCHEDULED",
    "scheduledOn": "2026-10-09T12:02:10.000Z",
    "deleteOn": "2026-11-08T12:02:10.000Z",
    "deletionDays": 30,
    "rows": { "consent_record": 6200, "consent_event": 12000 }
  }
}

project.deleted#

Sent when

The deletion has removed the project's data. The webhook endpoints themselves go after this event is delivered, or seven days later.

Payload

Field in data Type Description
closureId UUID The closure's id.
deletedOn time When the data was deleted.
rows object Rows deleted from each table.
kept array of strings Tables that are kept: audit_log, project_closure and legal_hold.

Example

JSON
{
  "id": "c7e9a1b3-5d7f-4b9d-a1c3-5e7f9b1d3f5a",
  "type": "project.deleted",
  "createdOn": "2026-11-09T02:31:40.512Z",
  "projectId": "c2a6f0de-51b3-4f0a-9d7e-8b1f3a6c4e90",
  "test": false,
  "data": {
    "closureId": "5e7a9c1b-3d5f-4a7c-9e1b-3d5f7a9c1e3b",
    "deletedOn": "2026-11-09T02:31:40.000Z",
    "rows": { "consent_record": 6200, "consent_event": 12000 },
    "kept": ["audit_log", "project_closure", "legal_hold"]
  }
}

↑↓ to move, Enter to open