What the DPDP Act Requires in Plain Language
The Digital Personal Data Protection Act 2023 (DPDP Act) establishes rights for Indian data principals (users) and obligations for data fiduciaries (businesses that collect data). It is India's version of GDPR. The key requirements: you must obtain free, specific, informed, and unambiguous consent before collecting personal data; you must use data only for the stated purpose; users can withdraw consent and you must delete their data when they do; you must implement security safeguards; and you must report data breaches to the Data Protection Board within 72 hours.
What You Must Implement in Your App
Consent mechanism: Before collecting any personal data (name, email, phone, location, financial info), show a clear consent notice explaining what data you collect and why. The consent must be explicit (a checkbox the user actively checks, not pre-ticked). Privacy policy: A comprehensive privacy policy written in plain language accessible in all languages your app supports. Account and data deletion: An in-app option for users to delete their account and all associated personal data. This must work completely — not just hide the account, but actually delete data from your database. Purpose limitation: Data collected for one purpose cannot be used for another without fresh consent.
Penalties for Non-Compliance
The Act provides for penalties up to ₹250 crore for significant violations. For startups, the more immediate risk is the reputational damage from a breach or complaint, and the App Store risk — both Apple and Google now require apps to accurately complete privacy nutrition labels, and discrepancies between declared and actual data collection can trigger app removal.
Implementation Checklist
Consent screen before first data collection, clear privacy policy linked from app store listing, in-app data deletion flow, data minimisation review (are you collecting anything you do not use?), encryption of stored personal data, breach response plan. Contact hello@devxaitechnologies.com to implement DPDP compliance in your application.