India's DPDP Act: a checklist for app and website owners
What India's data protection law and its 2025 Rules mean for your app or website, when the duties start, and a checklist to prepare.
Short answer: the Digital Personal Data Protection Act, 2023 and its Rules, notified on 13 November 2025, apply to any app or website that handles the digital personal data of people in India. Most duties for businesses apply from May 2027, so now is the time to prepare: clear notices, consent you can prove, proper security, a plan to report breaches within 72 hours, and deleting data you no longer need.
This is a practical overview for product teams, not legal advice. Confirm your obligations with a lawyer.
Who it applies to
If your app or website collects personal data of people in India, such as names, phone numbers, emails, locations or payment details, you are a data fiduciary under the Act. Companies that process data on your behalf, such as cloud or SMS providers, are data processors, and you are responsible for how they handle it.
The timeline
- 13 November 2025: the Rules were notified, and the Data Protection Board was set up.
- November 2026: rules for registering consent managers apply.
- May 2027: consent, notice and the main duties of data fiduciaries apply.
The checklist
- Map your personal data. What you collect, why, where it is stored, who can see it and which vendors process it.
- Collect less. Drop fields you do not need. Data you never collect cannot leak.
- Write clear notices. Tell people, in plain language, what you collect and why, how to withdraw consent and how to complain. Offer the notice in English or an Indian language listed in the Constitution.
- Get consent you can prove. Consent must be free, specific, informed and clear, with no pre-ticked boxes, and withdrawing must be as easy as giving it. Log every consent.
- Protect the data. Encryption, masking, access controls, monitoring and logs kept for at least a year.
- Prepare for breaches. Tell affected users without delay, and send the Data Protection Board a detailed report within 72 hours.
- Delete what you no longer need. Erase data once its purpose is served. Large platforms covered by the Rules must erase inactive users' data after three years, with 48 hours' notice.
- Handle children carefully. Get verifiable consent from a parent or guardian before processing data of anyone under 18.
- Answer people's requests. Make it easy for users to access, correct and erase their data, and publish a contact for grievances.
- Update vendor contracts. Processors must protect data and delete it when the contract ends.
What it means for your product
- Sign-up and permissions: short, specific consent screens, separate from your terms.
- Settings: a privacy section where people can download, correct or delete their data and withdraw consent.
- Backend: encryption, role-based access, audit logs and automatic deletion of old data.
- Operations: a breach response plan, with owners and a 72-hour clock.
Why it matters
Penalties under the Act can reach ₹250 crore for failing to protect personal data. More importantly, people now expect apps to respect their data, and good privacy design builds trust.
Humanoid Systems helps teams build privacy into new apps and audit existing ones, alongside VAPT. Talk to our cyber security team.
Frequently asked questions
When does the DPDP Act apply to my app?
The Rules were notified on 13 November 2025 and apply in phases. Consent managers follow from November 2026, and most duties for businesses, including notice, consent and security safeguards, apply from May 2027.
How quickly must a data breach be reported under the DPDP Rules?
Affected users must be told without delay, and the Data Protection Board must receive a detailed report within 72 hours of becoming aware of the breach, unless the Board allows longer.
Does the DPDP Act apply to apps outside India?
It can. The Act also covers processing outside India when it is connected to offering goods or services to people in India.
