India DPDP Act
The Digital Personal Data Protection Act, 2023 (DPDP Act) is India's data protection law. The DPDP Rules, 2025 fill in the details and switch the Act on in phases. Most duties are not in force yet as of October 2026, but they arrive in May 2027, and building for them takes longer than that. Everything here is as of October 2026.
Official text:
- DPDP Act, 2023 (Act No. 22 of 2023), MeitY
- DPDP Rules, 2025, G.S.R. 846(E), notified 13 November 2025, MeitY
How it works
Some sources count the dates from 14 November. MeitY consulted in early 2026 on shortening the 18-month window to 12 months; we found no notification of that change. Verify the current dates before relying on them.
Key terms
| DPDP term | Plain meaning | Closest GDPR term |
|---|---|---|
| Data Principal | The person the data is about. For a child, includes the parent | Data subject |
| Data Fiduciary | Decides why and how data is processed | Controller |
| Data Processor | Processes on behalf of a fiduciary | Processor |
| Significant Data Fiduciary (SDF) | A fiduciary the government names for volume, sensitivity or risk | No direct equivalent |
| Consent Manager | A registered company that lets people give, manage and withdraw consent across fiduciaries | No equivalent |
| Data Protection Board of India | The regulator that hears complaints and imposes penalties | Supervisory authority |
| Legitimate uses | A short, closed list of cases where no consent is needed | Some lawful bases, but much narrower |
The Act applies to digital personal data processed in India, and to processing outside India connected with offering goods or services to people in India (s.3).
What engineers must know
| Topic | What it says | What it means for us | Where |
|---|---|---|---|
| Grounds | Process only with consent or for a listed legitimate use | No "legitimate interests". Most product features need consent or must be strictly necessary for a service the person asked for | s.4, s.7 |
| Notice | Before or with the consent request: itemised data, the purpose, how to withdraw, how to use rights, how to complain to the Board | An itemised, plain notice per purpose; available in English or a language of the Eighth Schedule of the Constitution | s.5, Rule 3 |
| Consent | Free, specific, informed, unconditional, unambiguous, by clear affirmative action, limited to necessary data | No bundling; unticked boxes; one purpose per choice | s.6(1) |
| Withdrawal | As easy as giving consent; processing then stops within a reasonable time | One switch in Settings; signed links for people with no account | s.6(4)-(6) |
| Consent managers | People may use a registered consent manager. Must be an Indian company with net worth of at least INR 2 crore | Plan an integration point; registration opens about November 2026 | s.6(7)-(9), Rule 4, First Schedule |
| Security | Reasonable security safeguards, including encryption or masking, access control, logs, and keeping logs for at least one year | Logging and retention of logs is now a legal duty | s.8(5), Rule 6 |
| Breach | Tell the Board and each affected person | See Breach response | s.8(6), Rule 7 |
| Erasure | Erase when consent is withdrawn or the purpose is served, unless a law needs it kept | Retention rules plus purge jobs | s.8(7) |
| Retention for large platforms | E-commerce (2 crore+ users in India), online gaming (50 lakh+) and social media (2 crore+) must erase 3 years after last use, with a 48-hour warning before erasure | Dormant-account jobs with a warning email | Rule 8, Third Schedule |
| Contact and grievances | Publish who answers privacy questions; run a grievance mechanism | A privacy contact and a published response period | s.8(9)-(10), Rule 9, Rule 14 |
| Children | Under 18 is a child. Verifiable parental consent; no tracking, behavioural monitoring or targeted ads directed at children | See Children's data | s.9, Rule 10 |
| SDF duties | DPO based in India, independent data auditor, DPIA and audit every 12 months, algorithm due diligence; named data may have to stay in India | Applies only if named; know if you are | s.10, Rule 13 |
| Rights | Access a summary of data and who it was shared with; correction, completion, updating and erasure; grievance redressal; nominate someone | No portability right as such; build export anyway for GDPR | s.11-14 |
| Rights deadline | Rule 14 says the grievance response period must not exceed 90 days | A 30-day target meets it | Rule 14 |
| Transfers abroad | Allowed except to countries the government restricts, and subject to any conditions it sets | Watch for a restricted list | s.16, Rule 15 |
| Duties of people | People must not give false details or file frivolous complaints | s.15 |
Penalties
| Failure | Up to |
|---|---|
| Reasonable security safeguards | INR 250 crore |
| Breach notification to Board or people | INR 200 crore |
| Children's obligations | INR 200 crore |
| SDF obligations | INR 150 crore |
| Anything else in the Act or Rules | INR 50 crore |
| A data principal breaking their duties | INR 10,000 |
Source: the Schedule to the Act.
The Data Protection Board
The Board exists in law from 13 November 2025. MeitY invited applications for a Chairperson and Members in May 2026. As of October 2026 we could not confirm that members were appointed or that the Board has a working website. Verify before relying on this.
Rules
Do not use "legitimate interests" for Indian users. DPDP has no such ground. If a feature is not strictly necessary for what the person asked for, and not on the legitimate-uses list, it needs consent.
Build for May 2027 now. Notice, consent, withdrawal, breach reporting, log retention and children's rules all start together, and each one is a product change, not a policy edit.
Mistakes we made
- Bundled consent on a public form. One tick covered the terms, the processing the person asked for, and marketing. DPDP calls consent for unnecessary processing not free. Split it: one mandatory tick for the service, one optional tick for marketing. See Marketing and email.
- Withdrawal harder than the grant. Leads gave consent with one click on a public page, but withdrawing meant emailing and proving identity. The fix was a signed withdrawal link, issued at submit time, that never expires.
- Uploads before consent. The form uploaded photos and documents to storage before the consent tick was submitted, and abandoned uploads were kept forever. Gate the upload, or expire unclaimed uploads within a day.
- A missing grievance contact. A new privacy policy version accidentally dropped the shared section with the grievance contact, retention and rights. DPDP needs these. See Staying current for the versioning check that catches it.
Checklist
- Each purpose has consent or a named legitimate use. No legitimate interests.
- Itemised notice per purpose, in the user's language where needed.
- Withdrawal is one action, for people with and without accounts.
- Security logs kept at least one year.
- Breach runbook includes the Board and per-person notices.
- Under-18 rules decided; no tracking or targeted ads to children.
- Privacy contact and grievance period published.
- Dormant-account erasure with 48-hour warning, if you are a large platform.
- Consent manager integration on the roadmap.