Platform and compliance guides
7guides to the laws and store rules that decide whether an app can launch, read from the primary sources (Gazette notifications, regulators' directions, store policy pages) and tied to what they changed in apps we built. Each guide says what we could not confirm.
Not legal advice. This page explains official rules in plain words for people building apps. Rules and store policies change: check the linked primary sources, and ask a qualified lawyer before you act on anything with legal consequences.
- DPDP Act and Rules 2025
India's Digital Personal Data Protection Act, 2023 now has its Rules, published in the Gazette on 13 November 2025, but the duties that bind an app (notice, consent, erasure, children's data and breach reporting) start eighteen months after publication, which we count as 13 May 2027. Only the definitions and the Data Protection Board provisions are in force today, and the Consent Manager rule follows one year after publication. An app serving people in India should build for the Rules now: an itemised notice, withdrawal as easy as consent, a published contact for questions, parental consent for under-18s and a 72-hour breach report to the Board.
Data protection · IN · Verified against primary sources 2026-10-20 - RBI Payment Aggregator Rules
The RBI's Payment Aggregator Directions, 2025 apply to entities 'undertaking the business of Payment Aggregator'; a startup selling its own product through one is the merchant in that framework, and we found no provision asking merchants to be authorised. Razorpay Payments Private Limited and Stripe India Private Limited are both on the RBI's list of authorised online payment aggregators (as on 16 October 2026). What binds your app directly is card handling: only card issuers and networks may store card numbers, so you keep a token and, at most, the last four digits and the issuer's name.
Payments regulation · IN · Verified against primary sources 2026-10-20 - GST E-invoicing for Software
GST e-invoicing applies to a registered business whose aggregate turnover exceeded ₹5 crore in any financial year from 2017-18 onwards, for its B2B invoices and its export invoices; below that line you issue ordinary GST invoices. Above it, an invoice counts only if its details are registered on an Invoice Registration Portal first: your system sends the invoice as JSON and stores the IRN, acknowledgement number, signed invoice and signed QR code that come back. An IRN can be cancelled only within 24 hours, and since 1 April 2025 businesses at ₹10 crore and above cannot report an invoice more than 30 days old.
Tax and invoicing · IN · Verified against primary sources 2026-10-20 - Google Play Data Safety and Account Deletion
If your app lets people create an account, Google Play requires two ways to delete it: a path inside the app and a working web page where users can request deletion of the account and its data, and deactivating or freezing the account does not count. Every app on Google Play, including one that collects no data, must also complete the Data safety form, declare what its third-party SDKs collect, and link a privacy policy that covers retention and deletion. You may keep some data for security, fraud prevention or regulatory compliance, as long as you tell users what you keep.
App store policy · global · Verified against primary sources 2026-10-20 - App Store Rejections
Apple says over 40% of unresolved App Review issues fall under guideline 2.1, App Completeness: crashes, placeholder content and missing review information such as a demo account. The other rejections founders meet most are 5.1.1 (a privacy policy that covers retention and deletion, and account deletion inside the app if users can sign up), 3.1.1 (digital features sold through in-app purchase, while physical goods and services must not be) and 4.2 (an app has to do more than wrap a website). In 2025 Apple reviewed 9.1 million submissions and rejected 2.09 million.
App store policy · global · Verified against primary sources 2026-10-20 - UAE PDPL (Decree-Law 45/2021) for App Builders
Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data has been in force since 2 January 2022 and covers apps that process the personal data of people in the UAE, including apps run from outside the country. Its core rules are already written into the law: consent you can prove, easy withdrawal, correction on request and erasure in the cases the law lists, and a Data Protection Officer for high-risk or large-scale sensitive processing. But breach timelines and the six-month compliance window depend on an Executive Regulation, and penalties on a Cabinet decision, and we could not confirm from an official source that either has been issued.
Data protection · AE · Partly verified 2026-10-20 - UK GDPR for App Startups Based Outside the UK
UK GDPR applies to a company outside the UK that offers goods or services to people in the UK or monitors their behaviour, and such a company generally needs a UK representative unless its processing is occasional and low-risk. The duties that shape an app most are a 72-hour breach report to the ICO, erasure requests answered within one month (with backups put 'beyond use'), and, since 19 June 2026, a complaints process that acknowledges complaints within 30 days. Analytics cookies can now run without consent under a statistical-purposes exception, but only with clear information and a simple, free way to object.
Data protection · GB · Verified against primary sources 2026-10-20