Privacy reconciliation: /settings/privacy is the DPDP hub, /settings/data kept as sub-route

Decision

/settings/privacy is the DPDP hub (banner · bulk export · document list · consent toggles · grievance officer · danger zone). /settings/data is kept as a sub-route for export/deletion with deeper form treatment. /settings/privacy-consent is deleted.

Why

Wireframe settings-privacy-data.html is one DPDP-anchored page (banner · bulk export · document list · consent toggles · grievance officer · danger zone). Impl had split that across three routes, scattering the user's compliance surface and contradicting the source-of-truth wireframe.

Impact

• /settings/privacy rebuilt as the hub matching the wireframe — PrivacyIntro, DpdpBannerCard, RefundWindowCard, DpdpConsentCard, PrivacyBulkActionsCard, PrivacyDocumentsCard, DataLocationCard, GrievanceOfficerCard, PrivacyQuickDeleteCard all live under components/settings/privacy/.
• /settings/privacy-consent deleted (superseded by DpdpConsentCard).
• /settings/data kept as a dedicated export/deletion sub-route — same components, deeper form treatment.
• Affects infra-sub-processors (grievance officer + data location surfaces), copy-strings, and the deletion canonical messaging from 2026-06-10-account-deletion-messaging.

Status

Active.

Sources

• .context/wiki/decisions/* § "2026-06-01 — Privacy reconciliation: /settings/privacy is the DPDP hub, /settings/data kept as sub-route"