← All guides

What does the DPDP Act mean for my indie app in India?

Updated 22 October 2026 · 6 min read

Short answer: If your app collects personal data from people in India, the DPDP Act applies, whatever your size. The Rules were notified on 13 November 2025 and most duties apply from about 13 May 2027. Start now: a clear consent notice, only collect what you need, reasonable security, a way to delete data, and a plan for breaches. This isn't legal advice.

When do the rules apply?

The DPDP Rules, 2025 were notified on 13 November 2025. Most duties, including notices, security safeguards, breach reporting and consent, take effect 18 months later, around 13 May 2027. Consent Manager rules start after one year. (Rules text, MeitY)

How big are the penalties?

Up to ₹250 crore for failing to keep reasonable security safeguards, up to ₹200 crore for not reporting a breach or breaking rules on children's data, and up to ₹50 crore for other violations. (PIB explainer) For a vibe-coded app, the scariest line is "reasonable security safeguards": an open Supabase table is exactly what that's about.

What do I need to do?

1. A clear consent notice listing what data you collect and why, in plain language.

   Write a short consent notice for my signup form that lists each piece of personal data we collect and exactly why, in plain language. Add a checkbox that isn't pre-ticked and a link to the privacy policy. Store the consent time in the database.

2. Collect less. Don't ask for phone, date of birth or address unless you use them.
3. Reasonable security: RLS on every table, no secret keys in the browser, HTTPS. Run a free Vibe Check.
4. Deletion and access: let users download and delete their data.

   Add 'Download my data' and 'Delete my account' options. Deletion must remove the user's personal data from every table and storage bucket, and confirm by email.

5. Breach plan: if data leaks, the Rules say you must tell affected people without delay, in plain language, with what happened and what you're doing. Write that email template now.
6. Children: if under-18s might sign up, you need verifiable parental consent. Most indie apps should simply say 18+.
7. A contact for data requests on your privacy page.

Related: Security checklist · Printable one-pager

FAQ

Does the DPDP Act apply to small startups?

Yes. There's no general size exemption: if you process personal data of people in India, it applies, although the government can exempt some startups from certain duties.

When does the DPDP Act come into force?

The Rules were notified on 13 November 2025. Most obligations apply 18 months later, around 13 May 2027.

Is a privacy policy enough?

No. You also need a clear consent notice, reasonable security, a way for users to exercise their rights, and a breach notification process.