India's DPDP Act and Rules 2025: what an app has to do, and from when

Is the DPDP Act in force yet, and when do the app duties start?

Parliament enacted the Act on 11 August 2023. On 13 November 2025 the government published two Gazette notifications that set its timetable. G.S.R. 843(E) brings the Act into force in three steps: on publication, the definitions and the Data Protection Board chapter (sections 1(2), 2, 18 to 26, 35, 38 to 43 and parts of 44); one year later, section 6(9) on Consent Managers and section 27(1)(d); and eighteen months later, everything an app has to do, including sections 3 to 17, most of section 27 and sections 28 to 34, which give the Board its powers to inquire and penalise.

The DPDP Rules, 2025 (G.S.R. 846(E)) follow the same pattern. Rules 1, 2 and 17 to 21 took effect on publication, Rule 4 on Consent Managers takes effect after one year, and Rules 3, 5 to 16, 22 and 23 take effect after eighteen months. Counting from the Gazette date, that last step falls on 13 May 2027.

Does the Act cover an app run from outside India?

Yes, where the processing is connected to offering goods or services to people in India. Section 3 applies the Act to digital personal data processed in India and also to processing outside India 'in connection with any activity related to offering of goods or services to Data Principals within the territory of India'. Data processed by an individual for personal or domestic purposes is outside it.

What must an app tell users before it asks for consent?

Rule 3 sets the minimum. The notice must stand on its own, separate from other information, and give in clear and plain language an itemised description of the personal data, the specified purpose, and a description of the goods, services or uses the processing enables. It must give a link to the website or app and explain how the user can withdraw consent (as easily as they gave it), exercise their rights and complain to the Board.

Under section 6, consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the data the purpose needs. The Act's own illustration is a telemedicine app that also asks for the phone's contact list: consent counts only for the telemedicine purpose. Section 5(3) requires the notice to be available in English or any language in the Eighth Schedule to the Constitution, and section 5(2) requires a notice, as soon as reasonably practicable, to people who consented before the Act began.

What does an app owe a user who asks to see, correct or erase their data?

Section 12 gives users the right to correction, completion, updating and erasure; the app must erase on request unless keeping the data is necessary for the specified purpose or required by law. Section 13 requires a grievance mechanism, and users must use it before going to the Board.

Rule 14 requires the app to publish prominently how users can make these requests and what identifier (such as a username, email or mobile number) it needs, and to answer grievances within a period it publishes, which may not exceed ninety days. Rule 9 requires every app to publish the business contact of its Data Protection Officer, if it has one, or of a person who can answer questions about the processing, and to repeat that contact in every reply to a rights request. Users may also nominate someone to exercise their rights (Rule 14(4)).

Can an app keep data after a user deletes their account?

Some of it, and the Rules require some of it. Section 8(7) says data must be erased when consent is withdrawn or the purpose is no longer served, unless the law requires it to be kept, and the app must make its processors erase too. Rule 8(3) then requires the app to keep the personal data, traffic data and logs of each processing for at least one year from the date of processing, for purposes in the Seventh Schedule, and to erase them after that unless another law needs them longer. The Rules' own example is an e-book platform that must keep order, payment and delivery logs for a year 'even if X deletes her account'.

Three classes of large platform must also erase data from users who go quiet: e-commerce entities with at least two crore registered users in India, online gaming intermediaries with at least fifty lakh, and social media intermediaries with at least two crore. For them the period is three years from the user's last contact (Third Schedule), and the user must be warned at least forty-eight hours before erasure (Rule 8(2)).

What changes when the user is a child?

Under the Act a child is anyone under eighteen. Section 9 requires verifiable consent from a parent before processing a child's data, forbids processing likely to harm a child's well-being, and forbids tracking, behavioural monitoring and targeted advertising directed at children.

Rule 10 says how to verify the parent: check that the person is an identifiable adult using identity and age details the app already holds reliably, or details (or a virtual token mapped to them) issued by an authorised entity, which can come through a DigiLocker service provider. The Fourth Schedule exempts some cases from the consent and tracking rules, including clinics and health professionals, educational institutions tracking for education or safety, crèches, school transport tracking location, creating an account used only for email, real-time location for a child's safety, and checking that a user is not a child.

What must an app do after a personal data breach?

Rule 7 asks for two reports. Each affected user must be told without delay, through their account or a contact they registered, what happened, the likely consequences for them, what the app has done, what they can do to protect themselves, and who to contact. The Board must be told without delay, and within seventy-two hours it must receive the detailed facts, the mitigation, any findings about who caused the breach, the steps against recurrence and a report on the user notices. The Board can allow longer on a written request.

Rule 6 lists the minimum security safeguards: encryption, obfuscation, masking or virtual tokens; access control; logs and monitoring that can detect and investigate unauthorised access; backups for continued processing; keeping those logs for a year; security clauses in contracts with processors; and organisational measures to make all of it work.

What are the penalties?

The Schedule to the Act sets maximums: up to ₹250 crore for failing to take reasonable security safeguards, up to ₹200 crore for failing to notify the Board or users of a breach, up to ₹200 crore for breaching the duties on children's data, up to ₹150 crore for a Significant Data Fiduciary's additional duties, and up to ₹50 crore for breaching any other provision of the Act or the Rules. A user who breaches their own duties under section 15 can be fined up to ₹10,000.