India's data protection law, explained for app teams.
The main obligations take effect on 13 May 2027, about 7 months from now. Here's what your app has to change, in plain English, with a link to the official text for every point.
Key dates
- 11 Aug 2023DPDP Act published in the Gazette
- 13 Nov 2025DPDP Rules notified; Data Protection Board established
- 13 Nov 2026Consent Manager registration begins
- 13 May 2027Main obligations for apps take effect
What the law asks of your app
Each topic links to the section of the Act and the Rule it comes from.
Notice requirements
What a DPDP notice must contain for a mobile app, from an itemised list of data and purposes to withdrawal links, language choice and the Rule 3 standard.
Consent
How consent works under India's DPDP Act for apps, covering the s.6 standard, data minimisation, withdrawal as easy as opt-in and the burden of proof.
Legitimate uses
The closed list of legitimate uses in s.7 of the DPDP Act, when an app can process personal data without consent, and why there is no legitimate interests test.
Children's data
How the DPDP Act treats users under 18, with verifiable parental consent under Rule 10, the ban on tracking and targeted ads, and Fourth Schedule exemptions.
Data principal rights
The rights app users get under the DPDP Act, from access, correction and erasure to grievance and nomination, with Rule 14 duties and the 90-day ceiling.
Grievance redressal
What the DPDP Act requires of an app's grievance process, from published contact details under Rule 9 to the 90-day response ceiling and the route to the Board.
Security safeguards
The minimum security measures in Rule 6 of the DPDP Rules for mobile apps, from encryption and access controls to one-year logs and processor contracts.
Breach notification
How an app must report a personal data breach under the DPDP Act, with notice to each affected user, a Board report without delay and details within 72 hours.
Retention and erasure
When an app must erase personal data under the DPDP Act, the three-year rule for large platforms, the 48-hour warning and the one-year log minimum in Rule 8.
Processors and SDKs
How the DPDP Act treats vendors and SDKs inside an app, from the valid contract rule and fiduciary responsibility to withdrawal, erasure and naming recipients.
Cross-border transfers
How the DPDP Act treats transfers of app user data outside India, from the negative list in s.16 to Rule 15 conditions, sector laws and the SDF data rule.
Significant data fiduciaries
What a Significant Data Fiduciary is under the DPDP Act, how designation works, and the extra duties of an Indian DPO, independent audits and yearly DPIAs.
Consent managers
What a Consent Manager is under the DPDP Act, when Rule 4 registration starts on 13 November 2026, and why users can still give consent to an app directly.
Penalties
The DPDP Act penalty schedule for apps, from ₹250 crore for weak security to ₹50 crore for other breaches, with how the Board sets amounts and hears appeals.
Personal data in attribution
What the DPDP Act may mean for analytics, attribution and marketing SDKs, advertising IDs and IP addresses, separating the law from law firm interpretation.
Marketing SDK checklist
Twelve DPDP checks for each attribution, analytics and ad SDK in your app: purpose, necessary data, processor role, contract, withdrawal, erasure and logs.
Consent for ad tracking
How DPDP consent rules apply to ad tracking and attribution, mapped screen by screen to an app's onboarding flow, from first launch to withdrawal in settings.
Children and ad tracking
What the DPDP ban on tracking and targeted ads at children means for apps with young users: what parental consent does not unlock, exemptions and age signals.
How the law is being phased in
DPDP Act published in the Gazette
The Digital Personal Data Protection Act, 2023 becomes law. Most of it waits for commencement notifications.
Source: Act, Gazette of India, 11 Aug 2023
DPDP Rules notified; Data Protection Board established
The Rules are notified. Definitions, the Board provisions and Rules 1, 2 and 17 to 21 take effect, and the Data Protection Board of India is established.
Source: G.S.R. 843(E), 844(E), 846(E)
Proposal to shorten the timeline (not law)
MeitY reportedly proposed cutting the 18-month window to 12 months, at least for large businesses. No amending notification has been found, so the published dates still apply.
Source: Secondary reports
Removal of Difficulties Order (reported)
Reported to correct wording in sections 9 and 10. It does not move any commencement date.
Source: Secondary reports
Consent Manager registration begins
Section 6(9) and Rule 4 take effect, so Consent Managers can register with the Board.
Source: G.S.R. 843(E)(b); Rules r.1(3)
Main obligations for apps take effect
Notice, consent, security, breach notification, retention, children's data, user rights, Significant Data Fiduciary duties, cross-border rules and penalties all take effect. Section 43A of the IT Act is omitted.
Source: G.S.R. 843(E)(c); Rules r.1(4)
Common questions
When does the DPDP Act apply to apps?
Most obligations for apps, including notice, consent, security, breach notification, children's data and user rights, take effect on 13 May 2027. The Rules were notified on 13 November 2025 with an 18-month phase-in.
What is a Data Fiduciary?
A Data Fiduciary is any person or company that decides the purpose and means of processing personal data. An app that decides what user data to collect and why is a Data Fiduciary.
What is the maximum penalty under the DPDP Act?
The highest penalty in the Schedule is up to ₹250 crore, for failing to take reasonable security safeguards to prevent a personal data breach.
Does the DPDP Act cover data collected before it took effect?
Yes. Where consent was given before commencement, the Act requires a notice to be given as soon as reasonably practicable, and processing can continue until the user withdraws consent.
Who is a child under the DPDP Act?
Anyone under 18. Processing a child's personal data needs verifiable consent from a parent or lawful guardian, and tracking, behavioural monitoring and targeted advertising directed at children are prohibited.
Is this site legal advice?
No. It is an educational summary of the Act and Rules with links to the official texts. Speak to a qualified lawyer before making compliance decisions.