For years, privacy in Indian apps meant a long policy page nobody read and a checkbox on the sign-up screen. That's ending. The Digital Personal Data Protection Act, 2023 and the DPDP Rules notified in November 2025 put real obligations on any business that handles personal data of people in India, with penalties that run into hundreds of crores.
I build apps for Indian startups and for US and UK companies with Indian users, so I've been going through what the Rules mean in practice. This is a developer's reading, not legal advice. Use it to understand what needs to change in your product, then have a lawyer check your notices and contracts.
The dates that matter
| When | What starts |
|---|---|
| November 2025 | Rules notified. The Data Protection Board is set up on paper |
| 13 November 2026 | Consent Manager registration rules apply |
| 13 May 2027 | The main obligations apply to every business: notice, consent, security, breach reporting, children's data, deletion, grievance handling |
So the big deadline for most apps is May 2027. That sounds far away, but changing consent flows, logging and data deletion across an app, a backend and an admin panel is real work. If you're building something new now, build it compliant from the start. Retrofitting always costs more.
The Act also applies to companies outside India if they offer goods or services to people in India. A US startup with an Indian user base is in scope.
What changes in your app
1. A clear notice before you collect data
Before you ask for personal data, you have to tell people in plain language what you're collecting, why, and how they can withdraw consent or complain. It has to stand on its own, not be buried in your terms. In app terms that usually means a short, readable consent screen at sign-up, with a link to the full notice, rather than a single 'I agree to everything' checkbox.
2. Consent that's specific and easy to withdraw
Consent has to be for a specific purpose. Bundling 'we need your phone number to log you in' with 'we'll share your data with ad partners' won't fly. And withdrawing consent must be as easy as giving it. If it took one tap to agree, it shouldn't take an email to support to say no. Expect a privacy section in settings with real toggles.
3. Children's data needs a parent
Under the Act, a child is anyone under 18. You need verifiable consent from a parent before processing a child's data, and you can't track children's behaviour or target ads at them. For edtech, gaming and social apps this is the biggest change. When I built Bookvy, a school learning app, we ran a separate parent app linked to the student account. That kind of structure maps well to what the law now expects.
4. Security you can show
The Rules list reasonable security safeguards: encryption, access control, monitoring for unauthorised access, backups, and keeping logs. You're expected to keep access logs for at least a year. Most of this is good engineering anyway, but it now needs to be written down and provable.
5. Breach reporting
If personal data leaks, you have to tell affected users and the Data Protection Board without delay, with a detailed report to the Board within 72 hours. That means you need to be able to work out quickly who was affected, which comes back to logging and knowing where your data lives.
6. Deleting data you no longer need
Once the purpose is served, or a user withdraws consent, the data should go, unless another law requires you to keep it. Large e-commerce, gaming and social media platforms also have to delete data of users inactive for three years, after warning them 48 hours before. Every app should have a working 'delete my account' flow anyway. Apple and Google already require it.
7. A way to complain, and a person to reach
You need to publish who handles data questions and respond to grievances within 90 days. Larger companies classed as Significant Data Fiduciaries have more obligations, including a Data Protection Officer based in India, audits and impact assessments.
Penalties
This is why founders are paying attention. The maximum penalties go up to ₹250 crore for failing to take reasonable security safeguards, and up to ₹200 crore each for failing to report a breach or for breaking the rules on children's data. Fines are set by the Data Protection Board case by case, but those ceilings make 'we'll fix it later' an expensive bet.
A checklist for your app
This is the list I go through with clients. If you can tick all of it, you're in good shape for May 2027.
- Map your data. List every piece of personal data the app, backend, admin panel and third-party SDKs collect, where it's stored, and why.
- Cut what you don't need. Fewer fields means less risk and less to explain. Do you really need date of birth and full address at sign-up?
- Check your SDKs. Analytics, ads, crash reporting and attribution SDKs collect data too. You're responsible for them.
- Rewrite the consent screen. Short, plain language, purpose by purpose, with a link to the full notice. Offer it in Hindi or other Indian languages if your users need it.
- Add a privacy section in settings. Toggles for optional uses, a way to withdraw consent, download data and delete the account.
- Handle under-18 users. Age check at sign-up and a parent consent flow if children use the app. No behavioural ads for them.
- Log access and keep logs for a year. Who accessed which personal data and when, especially in the admin panel.
- Encrypt and restrict. Encryption in transit and at rest, role-based access in the admin panel, no shared admin logins.
- Write a breach plan. Who decides, who tells users, who files with the Board, and how you find affected accounts within hours.
- Set deletion rules. Automatic clean-up when data is no longer needed, and for inactive accounts if you're a large platform.
- Publish a contact. A named person or email for privacy questions and a grievance process with a 90-day response.
- Review vendor contracts. Cloud, SMS, payment and analytics providers that process data for you need proper agreements.
What it costs to get an existing app compliant
For a typical startup app with a backend and admin panel, the engineering side usually looks like this. Legal review is separate.
| Work | What it involves | Typical cost (INR) | Typical cost (USD) |
|---|---|---|---|
| Data and SDK audit | Map data flows, review SDKs, written gap list | ₹30,000 – ₹75,000 | $400 – $900 |
| Consent and privacy screens | New consent flow, settings toggles, account deletion, data export | ₹60,000 – ₹1,50,000 | $700 – $1,800 |
| Backend changes | Consent records, access logging, retention and deletion jobs, encryption fixes | ₹80,000 – ₹2,50,000 | $1,000 – $3,000 |
| Children's data flow | Age gate, parent verification and linking, ad and tracking changes | ₹75,000 – ₹2,00,000 | $900 – $2,400 |
If you're building a new app now, most of this adds only a little to the cost when it's planned in from day one. It's one of the things I scope in every app development estimate for Indian clients now.
For US and UK companies with Indian users
If you already comply with GDPR or UK GDPR, you're well placed. The concepts are similar: clear notice, purpose limits, deletion and breach reporting. The differences that catch people out are the strict under-18 definition of a child, the ban on tracking and targeted ads for children, and India-specific details like the grievance process and, for big platforms, an India-based DPO.
If your app works across markets, I'd build one privacy system that meets the strictest rule for each feature, rather than separate flows per country. It's simpler to maintain and safer.
Need a second pair of eyes on your app before the deadline? I can audit what your app, backend and SDKs collect and send you a plain list of what to change. Tell me about your app.
