OpenAI Select PartnerIndia's Digital Personal Data Protection Act: A Plain-English Guide for App and SaaS Founders
India's Digital Personal Data Protection Act, 2023 sets rules for how digital personal data is collected, used and protected. If your app or SaaS product handles personal data of people in India, it shapes what you build: consent, notices, user rights and security. This guide explains the practical parts for founders. It is not legal advice.
In this guide 10 sections
I am not a lawyer, and this is not legal advice. But the DPDP Act affects product decisions, and founders ask us how to build for it. Here is the practical view from a product team, with links to the official sources.
Start with the source
The Act and related rules are published by the Ministry of Electronics and Information Technology (MeitY). Check the latest official text and take legal advice for your specific product.
What the Act covers
The Digital Personal Data Protection Act, 2023 applies to digital personal data: data about an identifiable person that is collected digitally, or collected offline and later digitised. The organisation deciding how data is used is the data fiduciary. The person the data is about is the data principal.
Consent and notices
- Tell users clearly what data you collect and why, in a notice they can understand.
- Ask for consent that is specific to the purpose, not bundled into one checkbox for everything.
- Make withdrawing consent as easy as giving it.
- Record when and how consent was given.
User rights you need to support
- Access to a summary of their data and how it is used.
- Correction and erasure of their data.
- A way to raise grievances and get a response.
- Nominating someone to act for them.
Building a product that handles personal data?
Book a free 30-minute call. We design consent, data access and deletion into the product from the first release.
Book a free 30-minute call →What to build into your product
| Requirement | Product feature |
|---|---|
| Informed consent | Clear notice screens and purpose-specific consent toggles |
| Withdrawal | Privacy settings to withdraw consent |
| Erasure | Account and data deletion that actually removes data |
| Security | Encryption, access control, audit logs |
| Breach response | Monitoring and an incident process |
Security safeguards
The Act expects reasonable security safeguards against breaches. In practice: encryption, least-privilege access, logs and regular testing. Our mobile app security checklist is a good starting point.
Your vendors and processors
Cloud providers, analytics tools and software vendors that process data for you are data processors. Check their terms and keep a list of who processes what.
A starting checklist
- List every piece of personal data you collect, where it is stored and why.
- Remove fields you do not need.
- Write a clear, specific privacy notice and show it at the point of collection.
- Record consent with a timestamp and the notice version.
- Build simple ways for users to access, correct and delete their data, and withdraw consent.
- Decide how long you keep each type of data, and delete it after that.
- Prepare a plan for handling a data breach.
Children's data
If children may use your product, the Act sets stricter requirements, including verifiable consent from a parent or guardian, and limits on tracking and targeted advertising. Education and gaming apps should plan for this from the first design, not after launch.
This guide is general information, not legal advice. Read the official framework from MeitY and speak to a lawyer for decisions specific to your business.
How we approach it
At Creuto we design consent, access and deletion into the product from the first release, which is far cheaper than adding them later. This matters most in sectors such as healthcare, financial services and education.
Frequently asked questions
Does the DPDP Act apply to my startup?
If you process digital personal data of individuals in India, it very likely applies, including small startups. Some obligations depend on your size and the nature of the data, so check the current rules and take legal advice for your case.
What is a data fiduciary?
The organisation that decides why and how personal data is processed, usually the company that owns the app or service. A data processor processes data on its behalf, such as a cloud or software vendor.
Do I need consent for everything?
Consent is the main basis for processing, and it must be free, specific, informed and clear, with an easy way to withdraw. The Act also lists certain legitimate uses where consent is not required.
What rights do users have?
Users can access information about their data, ask for correction and erasure, have grievances addressed and nominate someone to exercise their rights.
Where can I read the official text?
The Ministry of Electronics and Information Technology (MeitY) publishes the Act and related rules on its website. Always check the latest official version.
Need privacy built into your app?
We build apps and SaaS products with consent records, role-based access, audit logs and account deletion from day one.
About Nihar Ranjan Rout
Founder & CEO of Creuto. Over the past 8+ years Nihar has led product strategy and engineering for 50+ products, including mobile apps, custom ERPs and B2B platforms. Creuto is an OpenAI Select Partner. He works directly with founders to turn an idea into a clear plan and a launched product.
More about Nihar · LinkedIn