Topic guide · 27 pages

Which data and payment rules apply to your app, market by market?

Updated 5 November 2026 · every page on this topic, checked against our own builds

Quick answer

Each market adds rules to the same app. In India: the DPDP Act, RBI payment rules and GST invoicing. In the UAE: the PDPL and VAT. In the UK: UK GDPR. Most of the work is the same everywhere: consent, a record of what you collect and why, account deletion, and keeping personal data secure. These guides explain what changes in the build; they are not legal advice.

We build from Bengaluru for clients in India, the UAE and the UK, so we design for these rules from the first sprint. Each guide below says what the rule means for screens, data and servers, and what we could not confirm.

Start here

01GuidesDPDP Act and Rules 2025
02GuidesUAE PDPL (Decree-Law 45/2021) for App Builders
03GuidesUK GDPR for App Startups Based Outside the UK

Every page on compliance by market

India

GuidesDPDP Act and Rules 2025What India's data protection law means for an app
ChecklistsDPDP Readiness Checklist for AppsA checklist to get an app ready for the DPDP Act
GuidesRBI Payment Aggregator RulesRBI rules for payments and marketplaces
GuidesGST E-invoicing for SoftwareGST invoices and e-invoicing
PagesApp development in BengaluruWorking with our Bengaluru studio

UAE and UK

GuidesUAE PDPL (Decree-Law 45/2021) for App BuildersThe UAE's data protection law for apps
ArticlesUAE VAT for Apps and Marketplaces: Decide Before You BuildVAT on subscriptions and commissions in the UAE
PagesWorking with us from the UAEWorking with us from the UAE: hours, currency and rules
GuidesUK GDPR for App Startups Based Outside the UKUK GDPR for app startups
PagesWorking with us from the UKWorking with us from the UK: hours, currency and rules

Everywhere

GuidesGoogle Play Data Safety and Account DeletionThe stores' own privacy and deletion rules
ChecklistsPre-Launch Security ChecklistSecurity basics before launch
GlossaryDPDP ActThe DPDP Act in one page
GlossaryData residencyWhere personal data is stored, and when it matters
GlossaryData deletionDeleting a user's data properly, backups included
GlossaryEncryption at restEncrypting stored data
GlossaryAudit logRecording who did what, for disputes and audits
GlossaryLeast privilegeGiving each person and service only the access it needs
GlossaryRBACRoles and permissions in an admin console
Glossary2FAA second check at sign-in for staff and sensitive accounts
GlossarySecure share linkSharing files without making them public
GlossaryBackupBackups you have restored, kept where your data rules allow
ServicesDeployment & HostingServers, backups and hardening done to these rules
ServicesCloud MigrationMoving data to a region your clients require
ServicesCustom Business Software & ERPGST invoicing and Tally exports in business software
Case studiesMedtrakrPharmacy software built for the UK
Case studiesTrainrA UAE marketplace charging in dirhams

Questions people ask about compliance by market

Does an app built in India have to follow UK or UAE data law?

If it serves users there, generally yes: these laws follow the user, not where the code was written. Build to the strictest market you serve; consent records, deletion and access logs carry across.

What is the minimum privacy work every app needs before launch?

A privacy policy that matches what the app really collects, consent where the law asks for it, in-app account deletion, and personal data kept encrypted and access-logged. The pre-launch security checklist covers the technical side.

Do I need to store data inside India or the UAE?

Not for most apps, but some sectors and some government clients require it. Check data residency before choosing a cloud region, because moving later is a migration.

Are these guides legal advice?

No. They explain what each rule means for the build, cite the official sources, and say what we could not confirm. Confirm your obligations with a lawyer in your market.

How do GST and VAT affect the app itself?

They change prices, invoices and reports: tax-inclusive or exclusive prices, a compliant invoice number series, and exports your accountant can use. See GST e-invoicing and UAE VAT.

Which market should a new app launch in first if it plans to go global?

The one where you can reach the first users fastest. Design the data model for every market you plan, so the second market adds settings rather than a rebuild.