DPDP Rules 2025: The Website and App Compliance Checklist for India (Deadline 14 May 2027)

02

When do the DPDP Rules apply?

The Rules were notified on 13 November 2025 with a phased start. The 18-month runway is meant for building, testing and fixing, not for starting in April 2027.

03

The DPDP checklist for websites and apps

Each item below is a requirement in the SafeLaunch rulebook, with the section of the Act or rule it comes from. Work top to bottom: the first four are visible from the outside, which is where complaints start.

1. 01

   A standalone notice before you ask for consent (§5; Rule 3)

   Before or at the moment you ask for consent, show a notice that stands on its own, not buried inside your terms. It must itemise the personal data you collect, the specific purpose for each, and explain how to withdraw consent, how to exercise rights and how to complain to the Data Protection Board.

2. 02

   Consent that is free, specific, informed and unambiguous (§6)

   Consent needs a clear affirmative action: no pre-ticked boxes, no consent bundled into unrelated terms, no 'by using this site you agree'. Withdrawing must be as easy as giving it. Ask only for data necessary for the stated purpose.

3. 03

   Children's data: verifiable parental consent (§9; Rule 10)

   Under the DPDP Act, a child is anyone under 18. If under-18s can use your product, you need verifiable consent from a parent or guardian, and you may not track, behaviourally monitor or target ads at children.

4. 04

   Reasonable security safeguards (§8(5); Rule 6)

   Encryption, access control so people only see their own data, and logs kept for a year so you can detect and investigate misuse. For AI-built apps the usual gaps are open database tables and API keys shipped to the browser.

5. 05

   Breach intimation within 72 hours (§8(6); Rule 7)

   Tell the Board and each affected person without delay when personal data is breached, and send the Board a detailed report within 72 hours. Write the plan now: who decides, who drafts, which template, which contact details.

6. 06

   Rights: access, correction, erasure, grievance, nomination (§11 to 14)

   People can ask what you hold about them, correct it, have it erased, raise a grievance and nominate someone to act for them. Publish how, and make it work: a form or an email address that someone actually answers.

7. 07

   Grievances answered within 90 days (§13; Rule 14)

   Set a process and a deadline tracker. If you also sell online in India, the Consumer Protection (E-Commerce) Rules require complaints to be acknowledged within 48 hours and resolved within one month.

8. 08

   A published contact for data questions (§8(9); Rule 9)

   Publish the business contact information of a person who can answer questions about your processing. Significant data fiduciaries must appoint a Data Protection Officer based in India.

9. 09

   Erase data you no longer need (§8(7))

   When consent is withdrawn or the purpose is served, erase the data and have your processors erase it too, unless another law requires you to keep it.

10. 10

    Check where data goes abroad (§16)

    Transfers outside India are allowed except to countries the government restricts. Keep a list of where your providers store and process data so you can act if a restriction is published.

04

What does a DPDP-ready notice look like?

Short, itemised and separate from your terms. A sign-up form can link to it right above the button. A workable structure:

What we collect and why
- Name and email: to create and secure your account
- Phone number: to send order updates (optional)
- Payment details: processed by our payment provider to take payment
- Usage data: to fix bugs and improve the product (only with your consent)

Your choices
- Withdraw consent at any time in Settings > Privacy, or email privacy@example.in
- Ask to access, correct or erase your data, or nominate someone to act for you
- Raise a grievance with our contact below; we reply within 90 days
- If you're not satisfied, you can complain to the Data Protection Board of India

Contact
[Name], [role], privacy@example.in, [business address]

SafeLaunch drafts this notice from what it finds in your product: the fields your forms collect, the services your pages call and the markets you choose. Read the sample report to see the format.

05

Which other Indian rules apply to a website?

The DPDP Act is the headline, but Indian websites usually meet four more sets of rules. SafeLaunch checks them in the same scan when you pick India as a market.

06

How SafeLaunch checks DPDP readiness

• The notice: finds your privacy notice and checks it itemises data and purposes, explains withdrawal, rights and complaints, and names a contact.
• Consent: reads trackers in the page source, and on paid audits records in a real browser which trackers load before a choice and after Reject.
• Forms: traces every field to what it collects, and flags data the stated purpose doesn't need.
• Security: exposed keys, open database tables, missing HTTPS and security headers.
• Rights and grievances: looks for a working way to access, correct and erase data, and a published contact.
• Children: asks whether under-18s use the product only if the scan can't tell, and applies §9 if so.

Every finding cites the section and rule, scores India alongside any other markets you choose, and gives the exact fix. Launch Fix adds the code change, prompts for your AI builder and a draft DPDP notice. Start with a free scan to see where you stand.