The DPDP Act for app builders: four things your app must do

Does it apply to your app?

Yes, if your app handles personal data of people in India in digital form. That holds even if you and your servers are outside India, as long as you offer your app to people in India.

It doesn’t cover data a person uses for purely personal reasons, like your own phone contacts, or data someone has chosen to make public themselves.

When does it start?

The Act became law in August 2023. The Rules that switch on its duties were published on 13 November 2025, with a phased start:

The government has discussed bringing the May 2027 date forward, so check for updates before you plan around it. Either way, an app you launch today will still be running when the duties begin. Building them in now costs far less than retrofitting them later.

Before you ask someone for their data, you must show them a notice. A clear link to your privacy policy on the signup page does the job, as long as the policy itself covers what the Rules ask for.

What the notice must say

• A list of the personal data you collect. Not “we may collect information”. Itemise it: name, email, phone, location, and so on.
• Why you need each one, and what the user gets in return.
• How to withdraw consent. Leaving must be as easy as joining was.
• How to use their rights: see their data, correct it, delete it.
• How to complain to the Data Protection Board.
• Who to contact with questions: a named person or team, with an email address, published on your site or app.

Write it in plain language, and make sure it makes sense on its own, without the reader opening three other pages. Users must also be able to read it in English or in any of the 22 languages listed in the Constitution.

Ask for consent the right way

Consent has to be a clear action by the user, like ticking a box or tapping a button. It must be specific to a purpose, and it only covers the data you actually need for that purpose.

The Act gives its own example. A telemedicine app asks for consent to provide consultations and to read the user’s phone contacts. The user agrees to both. Because the contacts aren’t needed for consultations, the consent only counts for the consultations.

The same logic applies to marketing. Your app works without sending promotional emails, so ask for that separately, with a checkbox that starts unticked.

Create your account Email     [                  ]Password  [                  ] By creating an account, youconfirm you've read our PrivacyNotice, which explains what wecollect and why. [ ] Send me product updates and    offers (optional) [ Create account ]

The Act requires “reasonable security safeguards” to prevent a data breach. The Rules spell out the minimum:

• Access control. Only the right people and systems can reach the data.
• Protection of the data itself, such as encryption or masking.
• Logs and monitoring, so you can spot unauthorised access, investigate it, and stop it happening again. Keep these logs for a year.
• Backups, so the app keeps working if data is lost or locked.
• Contracts with your Data Processors that require them to keep the data secure too.

Where apps usually go wrong

The most common gap isn’t a hacker breaking in. It’s an app that checks whether you’re logged in, but not whose data you’re asking for. Change /orders/1042 to /orders/1041 and a stranger’s name, address and phone number appear.

It’s easy to miss, because everything looks fine when you test with one account.

How to check10 min

1. Create two accounts, A and B, and add some data to each.
2. Logged in as A, open one of A’s pages and copy its URL, or an API request from your browser’s Network tab.
3. Log in as B and open that same URL or request.
4. If B can see A’s data, you’ve found a breach waiting to happen.

We walk through this test in more detail, with fixes, in our pre-launch security checklist.

Users have the right to ask you to erase their personal data. You must also erase it when they withdraw consent, or once it’s no longer needed for the purpose they gave it for.

A button in account settings is the simplest way to honour that. An email address that nobody checks is not.

What “delete” has to cover

• Every table that holds their data, not just the users row: profiles, orders, messages, uploaded files.
• Every outside service you shared it with. The Act makes you responsible for getting your Data Processors to erase it too: your email list, analytics, CRM.

What you’re allowed, and sometimes required, to keep

Deleting doesn’t mean wiping everything that second. The Rules require you to keep logs of how you processed personal data, and the personal data in them, for at least one year. Other laws, such as tax rules for invoices, may require longer.

The Rules give an example. Someone buys an e-book, then deletes their account. The platform must still keep the order, payment and delivery records for a year from the purchase.

So in practice: remove the account from your app straight away, move what you must keep to a locked-down store that nothing in the app reads from, and erase that once its period runs out.

Answer requests and complaints

Publish on your site or app how users can make these requests, and answer complaints within a reasonable time, never more than 90 days. Users can also ask for a summary of the data you hold about them and who you’ve shared it with.

A personal data breach is wider than a hack. It includes any unauthorised access, accidental disclosure, sharing, change or loss of personal data. An admin panel left open, a public storage bucket, and an email sent to the wrong list all count.

Who to tell, and when

The 72 hours start when you become aware of the breach. The Board can allow more time, but only if you ask in writing. Seventy-two hours goes fast in the middle of a crisis, so prepare before you need it.

Write the message before you need it

The Rules list exactly what your note to users must cover. Keep a template ready, and make sure you can email every user from outside your app, in case the app itself is the problem.

Subject: Security incident affectingyour [App] account What happenedOn [date], we found that [what wasexposed, e.g. names and emails] ofsome users were accessed withoutpermission between [start date]and [end date]. What this could mean for you[e.g. You may get phishing emailsthat pretend to be us.] What we've done[e.g. Closed the gap, signedeveryone out, reset access keys.] What you can do[e.g. Change your password. We willnever ask for it by email.] Questions[Name], [email], [phone]

When deciding the amount, the Board looks at how serious the breach was and how long it lasted, what kind of data was affected, whether it has happened before, whether you profited from it, and what you did to limit the damage.

That last factor is the one you control. An app with logs, a fixed gap and users told promptly is in a very different position from one that found out from the news.

A “child” is anyone under 18

Not 13, as many apps assume. Before processing a child’s data, you need verifiable consent from a parent or guardian. You also can’t track children, monitor their behaviour or target ads at them. If under-18s can sign up, plan for this from day one.

You’re responsible for your providers

If Supabase, AWS or your email provider handles data for you, the Act still holds you responsible for it. Use providers with clear security commitments, and check that their data processing terms cover security and deletion.

Existing users count too

If people consented before the Act’s duties began, you must send them a notice as soon as reasonably practicable, by email or in-app message, explaining what you hold and why.