Unity DPDP

Open-source, policy-enforcement and evidence kernel for privacy controls in Frappe and ERPNext.

Architectural position

Unity DPDP is a control plane above Frappe. Frappe remains the execution and data plane. The kernel does not fork or monkey-patch Frappe; it exposes supported adapters and policy contracts at operation boundaries.

request / API / job / integration
        |
        v
DPDP preflight -> allow | flag | require approval | deny
        |
        v
Frappe operation -> post-commit decision evidence

The kernel is generic. Vertical packs such as education add domain vocabulary and controls without changing the generic enforcement engine.

Current status

The first implementation slice now defines:

• versioned policy controls and scoped bindings;
• explicit enforcement modes and failure modes;
• a pure-Python inspector decision contract;
• privacy-minimised decision evidence;
• the adapter boundary for Frappe document, API, job, export, file, and integration operations.
• Frappe DocTypes for policy controls, scoped bindings, protected resources, and decision evidence;
• a global document lifecycle adapter for insert/update/delete preflight decisions;
• an explicit server API for operations outside document hooks.

The repository now includes a bench integration test module, seeded generic and education metadata, and a metadata-only education vertical catalog. A local Frappe bench is still required to execute the integration gate; this checkout does not contain a bench.

Non-goals

• automatic legal advice or a claim of legal compliance;
• storing raw student, parent, or employee records in the compliance register;
• a fork of Frappe or a universal monkey-patch;
• silently weakening a platform baseline through tenant configuration.

Development

The pure inspector tests can be run without a Frappe bench:

python -m unittest discover -s tests -v

Frappe integration tests will run through the consuming bench once the app is installed there.

See docs/TESTING.md for the install and integration-test commands. CI runs the pure-Python and packaging gates on every push and pull request.