A three-person startup ships an MVP. It stores user phone numbers, email addresses and rough location data in a shared Postgres instance. There is no consent banner, no data retention job, no documented breach process. When a co-founder raises the Digital Personal Data Protection Act, the answer from the team is: “relax, it’s not even fully in force yet.”
That answer is half right and half dangerous. Understanding which half applies to your product is the difference between a weekend of groundwork now and a scramble later.
The Core Question
India’s Digital Personal Data Protection Act, 2023 received presidential assent in August 2023 but sat without operative rules for two years. On November 13, 2025, the Ministry of Electronics and Information Technology notified the Digital Personal Data Protection Rules, 2025, along with the establishment of the Data Protection Board of India. That single notification changed the Act from a law on paper to a law with a working timetable.
The question developers actually need answered is not “is the DPDP Act in force.” It is: which obligations are live today, which are switched off until a later date, and what should get built into the product architecture in the meantime.
Applicable Legal Framework
Three documents matter here.
The Digital Personal Data Protection Act, 2023 is the parent statute. It defines core roles: the Data Fiduciary (the entity that decides how and why personal data is processed, meaning most product companies), the Data Processor (anyone processing data on the fiduciary’s behalf, which can include your cloud vendor or analytics tool), and the Data Principal (the individual whose data it is).
The Digital Personal Data Protection Rules, 2025 operationalise the Act’s provisions, filling in procedural detail the Act itself left to delegated legislation, things like exact breach notification timelines, consent notice content, and children’s data verification.
The enforcement notification issued alongside the Rules sets a staggered timeline. Provisions establishing the Data Protection Board came into force immediately on notification. Rules relating to Consent Managers become operative from November 13, 2026. The bulk of the substantive obligations, including detailed consent requirements, data principal rights, and the full breach notification and penalty regime, become enforceable from May 13, 2027.
So as of today, the regulator exists, the rulebook is published, but most compliance obligations carry an eighteen-month runway rather than an immediate deadline.
Regulatory and Constitutional Position
It helps to know why this framework exists in the first place. In Justice K.S. Puttaswamy (Retd.) v. Union of India, (2017) 10 SCC 1, a nine-judge bench of the Supreme Court held that privacy is a fundamental right under Article 21 of the Constitution. That judgment is the constitutional foundation the DPDP Act was eventually built on, and it is why courts are likely to read the Act’s provisions in favour of individual control over personal data where the statutory language leaves room for interpretation.
On the regulatory side, the Data Protection Board of India is now a functioning body, though independent commentary has noted a lag between its formal establishment in November 2025 and its Chairperson and Members being fully appointed, which happened only around mid-2026. Enforcement capacity is still being built even as the legal obligation exists. That gap between “law is in force” and “regulator is fully staffed and enforcing” is common for new regulatory regimes and is worth factoring into your risk assessment, not your compliance timeline.
Practical Examples for Developers
Consider four situations that come up in ordinary product work.
A signup form collects a phone number and email for OTP-based login. Once the relevant consent provisions are live, that form needs a notice, in clear language and not just legalese buried in a privacy policy link, describing what data is collected and why, at or before the point of collection.
A mobile app uses a third-party analytics SDK. Under the Act, that SDK vendor is likely a Data Processor. The Data Fiduciary, meaning the app’s own company, remains accountable for how that processor handles the data, so vendor contracts need data protection clauses even if the vendor is a well-known name.
A gaming or edtech app has users who are, or might be, under 18. Rule provisions on children’s data require verifiable parental consent before processing a minor’s data, and the Rules set out specific mechanisms considered acceptable for that verification.
A production database is exposed by a misconfigured access control setting. Under Rule 7 of the DPDP Rules, once the organisation becomes aware of a personal data breach, it must intimate the Board without delay with an initial description, followed by a detailed report within 72 hours of becoming aware, and must notify affected individuals as well. This is one of the provisions scheduled to become fully enforceable in the later phase of rollout, but building the internal detection and escalation workflow now is far cheaper than building it under pressure after an incident.
Common Mistakes
Founders and engineering leads tend to make the same handful of errors. Treating “not yet fully enforced” as “does not apply to us” is the biggest one; the obligations exist in the statute now and will become enforceable on a fixed date, not on a date of the company’s choosing. Assuming GDPR compliance automatically covers DPDP compliance is another; the two frameworks overlap conceptually but differ on specifics like the definition of significant data fiduciary, breach notification content, and children’s data thresholds. Treating the privacy policy as a substitute for an actual data inventory is a third; without knowing what personal data lives where, in which database, in which log file, in which third-party tool, a company cannot honestly assess its own exposure.
Practical Steps to Take Now
Start with a data inventory: list every place personal data is collected, stored, or sent to a third party, including logs and backups. Map every third-party processor, from your email service to your customer support tool, and check whether their terms include data protection commitments. Draft a breach response runbook that assumes a 72-hour clock starting from the moment the team becomes aware of an incident, not from when the investigation concludes. Build consent capture into the product now, even ahead of the enforceable date, since retrofitting consent UI into an existing user base is far more disruptive than designing it in from the start. Finally, keep a compliance log, dated notes of what was built and when, because demonstrating good-faith preparation matters if the Board ever asks.
Conclusion
The DPDP Act’s phased rollout is not a grace period to ignore the law. It is a runway to build the right architecture before the obligations become enforceable and the penalty schedule, which runs up to several hundred crore rupees for serious violations, becomes a live risk rather than a future one. Treat the current phase as free engineering time, not free legal exposure.
Disclaimer: This article is intended for general legal awareness and does not constitute legal advice. Readers should consult a qualified advocate for guidance specific to their organisation’s data processing activities and compliance obligations under the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025.
답글 남기기