India's DPDP Rules for Developers: What to Build Before 13 May 2027
If your app or API has users in India, the Digital Personal Data Protection (DPDP) Act applies to you, even if your servers and company are elsewhere (Section 3). The Act passed in 2023, the Rules were published on 13 November 2025, and the obligations that matter to engineers switch on in phases. I'm not a lawyer, and this isn't legal advice. This is the engineering view of the text. The…
The Digital Personal Data Protection (DPDP) Act, passed in 2023, introduced regulations for developers with users in India. The rules, published on 13 November 2025, will take effect in phases, with the final obligations on 13 May 2027. The law treats developers as Data Fiduciaries responsible for processing data of Data Principals, which are users, including minors.
Consent, a record, must be free, specific, informed, unconditional, and unambiguous, and must be obtained through a clear affirmative action. Developers must store a consent event for every user, purpose, and data item. They also need to build an inventory of all systems holding personal data and provide users with the right to access, export, correct, erase, and nominate a data nominee. The law also mandates retention periods for logs and data, security measures, and breach alerts.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
