India's DPDP Act: What App and Website Owners Need to Do

India's Digital Personal Data Protection (DPDP) Act, 2023, together with the DPDP Rules notified in 2025 and their phased compliance timelines, sets out how organisations must handle digital personal data. If you run an app, website or SaaS product with Indian users, it applies to you. This is a practical overview, not legal advice.

Key roles

• Data Principal: the individual whose data it is
• Data Fiduciary: your organisation, which decides why and how data is processed
• Data Processor: vendors processing data on your behalf (cloud, SMS, analytics)
• Consent Manager: registered entities that help people manage consents

What your product needs

Clear notices

Before or at the time of collecting data, tell users in clear language what you collect, why, and how they can exercise their rights and complain. Offer notices in English and relevant Indian languages where appropriate.

Valid consent

Consent must be free, specific, informed, unconditional and unambiguous, with a clear affirmative action. Pre-ticked boxes and bundled consents are risky. Withdrawing consent must be as easy as giving it.

Purpose limitation and minimisation

Collect only what you need for the stated purpose and delete it when it is no longer needed.

Children's data

For users under 18, you need verifiable parental consent, and tracking, behavioural monitoring and targeted advertising directed at children are restricted. Edtech, gaming and social apps need special care.

Security safeguards

Reasonable security measures: encryption, access controls, logging, monitoring and secure development.

Breach notification

Personal data breaches must be reported to the Data Protection Board and affected users, within the timelines set by the Rules.

User rights

Users can request access to a summary of their data, correction, completion and erasure, and nominate someone to exercise rights on their behalf. Build self-service flows for these.

Vendor contracts

Ensure processors are bound by contract to process data only on your instructions and with appropriate safeguards.

A practical checklist

1. Map every personal data field you collect and why
2. Rewrite privacy notices in plain language
3. Redesign consent flows, including withdrawal
4. Add age-gating and parental consent where relevant
5. Implement data retention and deletion jobs
6. Build user-rights request handling
7. Review processor contracts
8. Prepare a breach response plan

Penalties

Penalties for serious failures, such as inadequate security safeguards, can be very large. Compliance is far cheaper than enforcement.

Our engineers build privacy-by-design into mobile and web products for Indian and international markets.