Security and privacy

DPDP Act (India)

India's Digital Personal Data Protection Act, 2023, which sets out how businesses may collect and use people's personal data and what they owe those people.

Updated October 2026 · with examples from our own builds

What does DPDP Act mean in practice?

The DPDP Act applies to digital personal data processed in India, and to processing outside India that is connected with offering goods or services to people in India. It centres on consent, clear notice of purpose, security safeguards and people's rights to access, correct and erase their data.

Building for Indian users means it shapes product decisions: consent that is recorded and can be shown later, a route for people to ask for deletion, and collecting only what a feature needs. These are cheaper to design in than to retrofit.

Treat this page as orientation, not legal advice. The detailed rules and their timelines matter, so check the current text and take legal advice for your situation.

DPDP Act at a glance

Applies to
Digital personal data of people in India
Product impact
Recorded consent, notices and deletion requests
Check with
A lawyer, for your specific case

Where has DPDP Act come up in our builds?

Every form submission carries an immutable DPDP consent stamp, alongside honeypot and time-trap spam checks and optional Google sign-in for respondents.
AskForth (built, not launched)
The risk register delivered with the proposal lists DPDP Act obligations for Indian users alongside LinkedIn's terms, maintenance, LLM cost and voice-consent risks. Discovery only.
ZenFlow (discovery)
Privacy and terms pages, with a deletion channel for waitlist data, were built before launch.
Petym (built, not deployed)

Common questions about DPDP Act

Does the DPDP Act apply to a startup based outside India?

It can, if you process the personal data of people in India in connection with offering them goods or services. Check the current text and take legal advice for your case.

What should a consent record contain?

At least what the person agreed to, when, through which form or screen, and the version of the notice they saw, stored so it can't be changed afterwards.

Related terms

Sources

Planning a product and not sure where DPDP Act fits? Ask us, or browse all 116 terms in the glossary.