Short answer: The DPDP Act never mentions SDKs, but from 13 May 2027 every attribution, analytics and ad SDK that receives personal data sits inside the app's duties. The app stays responsible for processing done on its behalf whatever the contract says (s.8(1)), so each SDK needs a stated purpose, only the data that purpose needs (s.6(1)), a valid contract (s.8(2)) and a way to stop and erase (s.6(6), s.8(7)).
What is a marketing SDK under the DPDP Act?
A marketing SDK is third-party code inside an app that collects or receives personal data for attribution, analytics or advertising, and the DPDP Act treats its vendor by what it does with that data: a Data Processor if it processes on the app's behalf (s.2(k)), or a Data Fiduciary if it decides the purpose and means (s.2(i)).
- Specified purpose: the purpose stated in the app's notice (s.2(za)). Every SDK should map to one.
- Valid contract: the only basis on which an app may engage a processor (s.8(2)). Rule 6(1)(f) requires it to provide for reasonable security safeguards.
The general rules are on the processors and SDKs page. This page turns them into a review you can run on each SDK.
The twelve checks for each SDK
Run every check against every SDK that touches user data. A blank answer is a gap to close before 13 May 2027.
| # | Check | Question to answer | Source |
|---|---|---|---|
| 1 | Purpose | Which specified purpose does it serve, and does the notice name it? | s.2(za), s.5(1), Rule 3 |
| 2 | Necessary data | Is every data item it collects needed for that purpose? | s.6(1) |
| 3 | Role | Does the vendor act only on your instructions? | s.2(i), s.2(k) |
| 4 | Contract | Is there a contract with a security safeguards clause? | s.8(2), Rule 6(1)(f) |
| 5 | Start point | Does it start only once the lawful basis exists? | s.4, s.6(1) |
| 6 | Withdrawal | Can you make it stop processing a user's data? | s.6(6) |
| 7 | Erasure | Can you make it erase a user's data when erasure is due? | s.8(7) |
| 8 | Logs | Will it keep processing logs for at least one year? | Rule 8(3) |
| 9 | Breach notice | Will the vendor tell you in time for the 72-hour Board report? | s.8(6), Rule 7(2) |
| 10 | Children | Can it be switched off for users identified as children? | s.9(3) |
| 11 | Recipients | Can you name it in an access response? | s.11(1)(b) |
| 12 | Location | Where is the data processed? | s.16, Rule 15 |
Interpretation: Rule 7(2) gives the app 72 hours from becoming aware of a breach to send the Board detailed information, and sets no separate deadline for processors, so check 9 has to be settled in the contract.
Does every marketing SDK need consent?
Probably most do. The Act allows processing with consent or for a legitimate use in the closed list in s.7 (s.4), and that list has no general legitimate interests ground.
- Interpretation: law firm AMLEGALS reads this as meaning analytics, attribution and marketing processing outside s.7(a) generally needs s.6 consent obtained before tracking starts. Whether first-party product analytics can rest on s.7(a) is untested.
- Interpretation: for check 5, that points to starting attribution and ad SDKs after the consent choice, not at first launch. The ad tracking consent page maps this to an onboarding flow.
How do you tell a processor SDK from a fiduciary SDK?
Read the vendor's terms for any right to use your users' data for its own purposes. The Act does not classify SDK vendors.
- Interpretation: a vendor that processes only on the app's instructions fits the processor definition and needs a s.8(2) contract.
- Interpretation: a vendor that also builds cross-app profiles or improves its own models with the data is likely a Data Fiduciary in its own right or jointly with the app, since s.2(i) covers anyone acting "alone or in conjunction with other persons".
- Either way, s.11(1)(b) requires the app to name every Data Fiduciary and Data Processor it shared a user's data with, if she asks.
What should the SDK register record?
One row per SDK keeps the twelve checks answerable. Useful columns:
- vendor, SDK version and data items collected, including advertising ID, device ID and IP address
- specified purpose, lawful basis and the point at which the SDK starts
- role (processor or likely fiduciary) and contract reference
- how withdrawal and erasure reach the vendor (API, setting or manual request)
- log retention period and vendor breach notice period
- whether it is disabled for accounts identified as children
To see what an attribution SDK sends from ad click to first open, App Attribution Guide's walk-through of install attribution is a useful primer before filling in the data column.
Where do configuration choices matter?
Check what each SDK collects in its default configuration, not only the events you send on purpose. Turning off fields you do not need is the most direct answer to check 2.
- Masking, obfuscation and virtual tokens are security measures under Rule 6(1)(a), not a way out of the Act. Interpretation: law firm commentary reports that a hashed identifier stays personal data if it remains linkable.
- Vendors differ in the controls they offer. As one example, Linkrunner offers a Bring Your Own Cloud option that keeps raw events, identifiers and PII inside the app's own cloud boundary, and hashes PII by default. Whether any setup meets the Act depends on the app's own consent, contracts and controls.
- A short vendor retention setting can conflict with the one-year log rule in Rule 8(3). See retention and erasure.
Because of s.8(1), a failed check is the app's exposure, not the vendor's. Breach of any provision not covered elsewhere in the Schedule carries up to ₹50 crore (Schedule item 7). Interpretation: a missing s.8(2) contract would fall under item 7.
What this means for your app
These are practical steps teams commonly consider. They are not a guarantee of compliance.
- Consider building the register from the app's dependency list, not from memory.
- A common approach is to remove any SDK that cannot answer checks 1, 2 and 6.
- Add vendor breach notice timing to your breach notification runbook, and re-run the checks whenever an SDK is added, alongside the readiness checklist.