Digital Personal Data Protection Act, 2023 (India)
India's DPDP Act: Privacy Policy Requirements Explained
India's first comprehensive data protection law is here. If your app has Indian users, this is what your privacy notice must do.
Not legal advice. This guide is a plain-English summary for developers, not a substitute for advice from a qualified lawyer. For high-risk or regulated processing, get a professional review.
What the DPDP Act requires of your privacy policy
The Digital Personal Data Protection Act, 2023 (DPDP Act) is India's first comprehensive data protection law — passed in August 2023, with the implementing DPDP Rules notified in November 2025 and obligations phasing in on a staggered timeline through 2027. If you build apps and have Indian users, this law applies to you: it covers digital personal data processed in India, and processing anywhere in the world connected to offering goods or services to people in India.
The Act's vocabulary differs from GDPR's. You are a Data Fiduciary (the entity deciding why and how data is processed); your user is a Data Principal. The law is consent-centric: with narrow exceptions ("legitimate uses" like data voluntarily provided for a specified purpose, or legal obligations), you process personal data only with consent that is free, specific, informed, unconditional, and unambiguous, given by clear affirmative action. Pre-ticked boxes and bundled consent don't qualify.
The privacy-policy-shaped obligation is the notice (Section 5): before or at the moment you request consent, you must give users a notice with an itemized description of the personal data you want and the specified purpose for each item, how they can exercise their rights and withdraw consent, and how to complain to the Data Protection Board of India. Under the 2025 Rules, the notice must be understandable independently — plain language, no burying — and users must be able to access it in English or any of the 22 languages in India's Eighth Schedule.
Users get enforceable rights: to access a summary of their data and processing, to correction and erasure, to grievance redressal with your response required within set timelines, and to nominate someone to exercise their rights if they die or are incapacitated. Two provisions bite hardest for apps: processing a child's data (under 18) requires verifiable parental consent, with tracking and behavioral advertising directed at children prohibited; and withdrawal of consent must be as easy as giving it.
Penalties are serious — up to ₹250 crore (about $30 million) per violation for failures like inadequate security safeguards. For most developers, though, the first step is simple and cheap: an accurate privacy notice that itemizes your data collection, states purposes, and explains rights. That is precisely what PrivacyPage generates — built by an Indian developer, priced in INR, payable by UPI.
DPDP Act privacy notice checklist
- Itemized list of the personal data you collect (not vague categories)
- The specified purpose for each item of personal data
- Consent requested by clear affirmative action — no pre-ticked boxes or bundling
- How users withdraw consent, with withdrawal as easy as giving consent
- How users exercise rights: access summary, correction, erasure, nomination
- Your grievance redressal mechanism and response commitment
- How to complain to the Data Protection Board of India
- Notice available in English or any Eighth Schedule language your users need
- Verifiable parental consent flow if users under 18 are possible
- No tracking or behavioral advertising directed at children
- Data deletion when the purpose is served or consent withdrawn (retention limits)
- Contact details of your Data Protection Officer, if you're a Significant Data Fiduciary
How PrivacyPage covers the DPDP Act
Itemized, purpose-tied disclosures
The generator's question flow naturally produces the itemized data-and-purpose structure the DPDP notice requires — not the vague "we may collect certain information" boilerplate that fails it.
Rights and grievance sections built in
Generated policies explain access, correction, erasure, and grievance redressal with concrete contact instructions — the DPDP's core user-facing requirements.
Made in India, priced for India
PrivacyPage is built by an Indian indie developer. Pricing is geo-adjusted to INR with UPI, netbanking, and cards via Razorpay — no $180/year dollar subscriptions.
One document, three frameworks
Your generated policy covers DPDP-relevant disclosures alongside GDPR and CCPA sections — one document for a global user base including India.
Generate a DPDP Act-ready privacy policy
Answer ~10 questions about your app. Preview the full document free — pay $9.99 once only to unlock it.
Generate Now →FAQ
My company is outside India but has Indian users. Does the DPDP Act apply?
Yes — the Act expressly covers processing outside India if it is connected to offering goods or services to people in India. A publicly available app with Indian sign-ups is the textbook case.
When do I actually need to comply?
The Act passed in 2023 and the DPDP Rules were notified in November 2025 with phased timelines: some provisions took effect immediately, while core obligations like notice requirements phase in over roughly 18 months from notification. Building the notice now is cheap; retrofitting consent flows later is not.
How is the DPDP Act different from GDPR?
DPDP is more consent-centric — there is no broad "legitimate interests" basis like GDPR's. It sets the child threshold at under 18 (GDPR: 13–16), requires notices available in Indian languages, and its penalties are caps per violation (up to ₹250 crore) rather than revenue percentages. If you're GDPR-ready you have a head start, but the notice requirements are not identical.
What is a Significant Data Fiduciary?
A designation the government can apply based on factors like data volume and sensitivity, triggering extra duties — a Data Protection Officer based in India, independent audits, and periodic impact assessments. Typical indie apps are unlikely to be designated, but high-volume consumer apps should watch this.