DPDP Act 2023: What Every Indian App Developer Must Know
Penalty Alert: Non-compliance with the DPDP Act can result in penalties up to ₹250 crore per instance. The Data Protection Board of India has the power to block non-compliant applications from the Indian internet entirely.
The Digital Personal Data Protection Act, 2023 is India's first comprehensive data privacy law. It passed Parliament in August 2023 and received Presidential assent on August 11, 2023. The rules are expected to be notified in 2026 — meaning compliance deadlines are approaching fast.
What the DPDP Act Covers
- Personal Data: Any data that can identify an individual — name, email, phone, location, financial data, health data, biometric data.
- Data Fiduciaries: Any organization that determines the purpose and means of processing personal data. That's you — the app developer.
- Data Principals: The individuals whose data you process. Your users.
- Consent Managers: RBI-registered entities that manage user consent on behalf of data fiduciaries.
Key Compliance Requirements for App Developers
- Explicit Consent: You must obtain clear, specific, and informed consent before collecting any personal data. Pre-checked boxes are illegal.
- Notice: Every data collection point must include a notice describing what data is collected, for what purpose, and the user's rights.
- Purpose Limitation: You can only use data for the purpose you stated. Reusing email lists for marketing without consent violates the Act.
- Data Minimization: Collect only the data you actually need. Collecting "just in case" data is non-compliant.
- Right to Erasure: Users can request deletion of their data at any time. You must comply within a reasonable timeframe.
- Data Breach Notification: Report any data breach to the Data Protection Board and affected users within mandated timeframes.
- Grievance Officer: Appoint a grievance officer and publish their contact details prominently.
- Children's Data: Verifiable parental consent is required before processing data of anyone under 18.
How to Audit Your App for DPDP Compliance
- Map every data collection point in your application
- Verify consent mechanisms — no dark patterns, no pre-checked boxes
- Check data storage — is PII encrypted at rest and in transit?
- Implement data deletion workflows — can users easily delete their accounts?
- Review third-party data sharing — are all processors listed in your privacy policy?
- Test for data leakage — are you accidentally logging or exposing PII?
Audit Your App for DPDP Compliance
TestForge scans for PII exposure, missing consent flows, data leakage, and 162+ compliance checks — automatically.
Start DPDP Audit →