India's Digital Personal Data Protection Act, 2023 became operational when the DPDP Rules were notified in November 2025. The Rules phase things in: the Data Protection Board came first, and most obligations on businesses (called “Data Fiduciaries”) take effect after an 18-month transition.
Eighteen months sounds generous until you remember that consent flows, retention jobs and deletion APIs have to be designed, built, tested and rolled out across every app that touches customer data. For most companies, the work needs to start now.
The obligations that change your software
| Obligation | What it means in the product |
|---|---|
| Notice and consent | A clear, itemised notice at collection; consent recorded per purpose and as easy to withdraw as to give. |
| Purpose limitation | Data collected for delivery is not silently reused for marketing. |
| Data minimisation | Forms and APIs collect only the fields a purpose needs. |
| Retention and erasure | Personal data deleted once the purpose is served, with automated jobs rather than manual clean-ups. |
| Security safeguards | Encryption, access control, logging and monitoring that you can show evidence of. |
| Breach notification | Inform the Data Protection Board and affected individuals when a breach occurs. |
| Data principal rights | Users can access, correct and erase their data, and nominate someone to act for them. |
| Children's data | Verifiable parental consent before processing a child's data. |
Penalties are significant: failing to take reasonable security safeguards can attract a penalty of up to ₹250 crore. More practically, enterprise customers are already adding DPDP clauses to vendor contracts.
A seven-step engineering checklist
- Inventory: list every system, table and third-party tool that stores personal data, and why.
- Classify: mark which fields are personal, which are sensitive (financial, health, identity numbers) and who can see them.
- Consent service: build one consent record per user and purpose, versioned, with timestamps and a withdrawal path.
- Retention rules: define how long each data type is kept and run scheduled deletion or anonymisation jobs.
- Rights requests: add self-service export, correction and deletion, or at least a tracked workflow behind a form.
- Security baseline: encryption at rest and in transit, MFA for admins, role-based access, and centralised logs.
- Breach runbook: who decides, who notifies, and the templates ready to send, rehearsed at least once.
Do not forget your vendors
Your CRM, email platform, analytics, payment gateway and any AI service are “Data Processors” acting on your behalf. You remain responsible for them. Review contracts, know where data is stored, and switch off what you do not use.
Logs and backups are personal data too
Application logs full of phone numbers and backups kept forever are the most common gaps we find. Mask personal fields in logs and give backups a retention period like everything else.
What good consent looks like in an app
A pre-ticked box buried in the terms and conditions will not meet the standard. Consent must be free, specific, informed and unambiguous, and withdrawing it must be as easy as giving it. In practice that means:
- A short notice at the point of collection that lists what data is collected and why, in plain language. The Act also lets users read notices in English or any language in the Eighth Schedule of the Constitution.
- Separate choices for separate purposes, for example order updates versus marketing messages.
- A visible “Privacy & consent” page in the account area where users can change their choices at any time.
- A consent log that records what the user agreed to, which notice version they saw, and when.
A realistic timeline
| Phase | Typical duration | Output |
|---|---|---|
| Data discovery and gap assessment | 3–6 weeks | Data map, risk list, prioritised backlog |
| Design | 2–4 weeks | Consent model, retention schedule, rights-request workflow |
| Build and integrate | 2–5 months | Consent service, deletion jobs, masked logs, admin tools |
| Test, train and document | 4–6 weeks | Evidence pack, staff training, breach drill |
Small apps with one database can move faster. Groups with many legacy systems should start with the systems that hold the most customer data and work outward.
Compliance done well looks like good product design: fewer fields, clearer choices, and data that disappears when it is no longer needed.
