India's DPDP Rules for Developers: What to Build Before 13 May 2027

If your app or API has users in India, the Digital Personal Data Protection (DPDP) Act applies to you, even if your servers and company are elsewhere (Section 3). The Act passed in 2023, the Rules were published on 13 November 2025, and the obligations that matter to engineers switch on in phases.

I'm not a lawyer, and this isn't legal advice. This is the engineering view of the text. The plain-language version for non-developers is on Must Read Digest.

**The dates
**Date What starts
13 Nov 2025 Rules 1, 2 and 17-21 (setting up the Data Protection Board)
13 Nov 2026 Rule 4: Consent Manager registration
13 May 2027 Notices, security, breach alerts, erasure, user rights, appeals (Rules 3, 5-16, 22, 23)
Almost everything you will build lands on 13 May 2027. As of late October 2026, the Board had no appointed members, so there is no live complaints route yet. Treat that as a build window, not a reprieve.

Vocabulary
Data Principal: the user. For a child, this includes the parent or guardian.
Data Fiduciary: you. Anyone deciding the purpose and means of processing.
Processor: your vendors (analytics, email, cloud). You stay responsible for them.
1. Consent is a record, not a checkbox
Section 6(1) requires consent that is free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the data needed for the stated purpose. You also carry the burden of proving that notice was given and consent was obtained.

In practice that means storing an event for every consent, not a boolean on the user row. An illustrative shape (my example, not a prescribed schema):

{
"user_id": "u_123",
"purpose": "order_delivery",
"data_items": ["name", "phone", "address"],
"notice_version": "2027-05-v1",
"notice_language": "hi",
"action": "granted",
"timestamp": "2027-05-14T09:12:44Z"
}
Things worth building:

Versioned notices, so you can show exactly what each user saw.
One consent per purpose. Bundling analytics into "accept to continue" is exactly what "specific" and "unconditional" rule out.
Withdrawal as easy as granting (Section 6(4)). If consent took one tap, withdrawal can't take a support ticket.
Notices in English or any Eighth Schedule language (Section 5). Plan i18n for the consent screen itself.
A re-consent flow for existing users. Section 5(2) says to send a fresh notice "as soon as reasonably practicable".

2. Know where personal data lives
You can't erase or give access to data you can't find. Before May 2027, build a data inventory: which tables, buckets, logs, caches, search indexes, analytics tools and backups hold personal data, and for which purpose.

This is the unglamorous part, and it decides whether the rights below take an afternoon or a quarter.

3. User rights become API endpoints
From 13 May 2027, users can request:

Right Section Engineering implication
Access a summary of their data, the processing and the recipients 11 Export job that spans services and vendors
Correct, complete, update 12 Write path with propagation to copies
Erase 12(3) Erasure pipeline (below)
Grievance redressal 13 Ticket flow with a published response time, capped at 90 days
Nominate someone to act for them 14 A nominee field and a verification step
Rule 14(1) also expects you to publish how requests are made and which identifier is needed to make one.

Erasure needs a pipeline
When consent is withdrawn or the purpose ends, you must erase the data and ask your processors to do the same, unless a law requires retention (Sections 6(6), 8(7), 12(3)).

Fan out the delete to every system in your inventory, including vendors.
Keep a deletion receipt per request. It's your proof.
Decide the backup policy in writing: expiry window, or restore-and-reapply.
Handle the exceptions explicitly. Data needed by another law (a bank keeping ID records after account closure) can be retained. Tag those fields with a legal basis.

4. Retention rules with hard numbers
Logs and related data must be kept for at least one year (Rule 8(3)). This conflicts with an aggressive "delete logs after 7 days" setting, so check yours.
Large platforms must erase inactive users' data after three years, with 48 hours' notice first (Rule 8, Third Schedule). The thresholds are e-commerce and social media platforms with 2 crore (20 million) or more users in India, and gaming platforms with 50 lakh (5 million) or more.
If you're near those thresholds, an "inactive account" job with a notification step is a real piece of work, not a cron one-liner.

5. Security and breach alerts
Failing to keep reasonable security safeguards is the most expensive breach in the Act. Rules 3 and 5-16 cover notices, security measures and breach alerts from 13 May 2027. I haven't covered the exact alert timelines here, so read the Rules directly before writing your incident-response runbook.

What to prepare now: access logging, encryption at rest and in transit, and an incident process that can tell you which users' data was affected, which brings you back to the inventory.

6. Children's data
Section 9 requires verifiable parental or guardian consent for children. It also bars tracking, behavioural monitoring and targeted advertising directed at children, with narrow exceptions. If your product could be used by under-18s, check where your analytics SDKs and ad tags load.

7. Consent Managers
From 13 November 2026, entities can register as Consent Managers. They must be incorporated in India with a net worth of at least ₹2 crore, and they act as a fiduciary for the user. They let users give, review and withdraw consent from one place, and they cannot read the data they manage. Expect your consent flows to eventually need to accept consent artefacts that arrive via a Consent Manager, not just your own UI.

8. What it costs to get wrong
Breach Maximum penalty
Weak security safeguards ₹250 crore
Failure to report a breach, or children's-data duties ₹200 crore
Significant Data Fiduciary duties ₹150 crore
Other breaches ₹50 crore
Penalties go to the Consolidated Fund of India, and the Act itself provides no compensation to individuals. Appeals go to the TDSAT within 60 days.

A starter checklist

• Data inventory covering databases, logs, backups, vendors
• Consent events stored per purpose, with notice version and language
• Withdrawal flow as easy as granting
• Notices in English and the languages your users read
• Access, correction and erasure endpoints, with deletion receipts
• Published grievance process and response time (max 90 days)
• Log retention of at least one year
• Inactive-user erasure job with 48-hour notice, if you're over the thresholds
• Children's-data review of SDKs, ad tags and age gates
• Incident runbook after reading the breach-alert Rules

Sources
Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025 (MeitY)
PIB explainer on the Rules, 17 November 2025
AZB Partners' summary of the Act's commencement dates
Full plain-language walkthrough, including users' rights and a deletion-request template: What Is the DPDP Act? Your New Data Rights in India, Explained Simply.