Your App Collects Data. Here’s what the DPDP Act Actually Wants You to do about it.

Imagine this. You’ve build a fitness app. Users sign up with their name, email and date of birth. You store it in a Google Sheet for now. Your Privacy Policy is a template you found online, copied and forgot about. Fifty thousand users later, the question arises, ‘Are you DPDP compliant ?’

You have no idea what to say. 

This is the situation most Indian startup founders are in right now, not because they don’t care about their user’s data, but because nobody explained the law in plain language. This post is that explanation. 

What is the DPDP Act?

The Digital Personal Data Protection Act, 2023 is India’s first standalone data protection law. It was passed in August 2023 and it governs how personal data of Indian users can be collected, stored, used and deleted. Before this Act, data protection in India was scattered across Section 43A of the IT Act and SPDI Rules of 2011, both outdated, both inadequate for the way digital businesses work today. The DPDP Act replaces that framework with something cleaner, more specific and significantly more enforceable. 

The rules that operationalise the Act, the DPDP Rules 2025, are currently in draft form. But the Act itself is in force. Compliance obligations exist right now. 

Does it apply to your startup?

Almost certainly yes. Here’s the test: 

The Act applies to the processing of digital personal data within India. It also applies if you collect data outside India but use it to offer products or services to people in India. 

There is no minimum size threshold. A two- person startup with fifty users is covered. A solo founder running a waitlist is covered. If your product collects even one email address from one Indian user, you are a ‘data fiduciary’ under this law, and you have obligations. The only real exemptions are personal or domestic use and certain research and journalistic purposes. Running a commercial app is not exempt. 

What does ‘Personal Data’ actually mean?

Under Section 2(t) of the Act, personal data means any data by which a person can be identified. 

This is broader than most founders expect. It Includes: 

• Names and email address
• Phone numbers
• Device IDs and IP addresses
• Location data
• Behavioural data: what users click, when they log in, how long they stay 
• Any combination of data points that together identify a person. 

Sensitive data such as health records, financial information, biometrics, carries additional obligations under existing SPDI Rules 2011 which still apply alongside the DPDP Act. If you collect it, it counts. 

What does the Act actually require you to do? 

This is the part where most people get it complicated. Here’s the simplest version:

1. Give notice before you collect : Under Section 5, before you collect any personal data, you must give the user a notice that tells them what data you’re collecting, why you’re collecting it, and how they can exercise their rights. This notice must be in clear, plain language. A separate, specific notice. 
2. Get proper consent: Under Section 6, consent must be free, specific, informed, unconditional and unambiguous. A pre-ticked box does not count. A vague “by using this app you agree to our terms” does not count. The user must take a clear affirmative action, ticking a box themselves, clicking a specific button after reading the notice. 
3. Process data only for the purpose stated: If you told the user you’re collecting their email to send them a weekly newsletter, you cannot use that email for targeted advertising. Purpose limitation is a hard rule under Section 8. 
4. Delete data when the purpose is done: You cannot store personal data indefinitely. Once the purpose for which consent was given is fulfilled or if the user withdraws consent, you must delete the data. No more “we’ll keep everything forever just incase.”
5. Give users control: Under Section 11 to 13, every ‘data principal (your user)’ has the right to access what data you hold about them, correct inaccurate data and request erasure. Your product must have a mechanism, however simple to handle these requests. 
6. Appoint a grievance officer: Under Section 8(8), every data fiduciary must have a grievance officer that users can contact with complaints. For most early- stage startups, this is the founder. Their name and contact details must be published on your website. 

What happens if you don’t comply? 

The Act establishes a Data Protection Board of India with the power to investigate complaints and impose financial penalties. 

The numbers are significant: 

• Failure to implement adequate security safeguards : up to ₹250 Crore
• Failure to notify a data breach : up to ₹200 Crore
• Non-compliance with obligations related to children’s data : up to ₹200 Crore
• General non-compliance : up to ₹50 Crore

There is no criminal liability under the Act. Penalties are financial only, imposed by the Board after inquiry. But ₹50 Crore for a seed-stage startup is existential. The penalties are not theoretical. 

Why does it matter right now and not later?

Three reasons founders give for not dealing with this: “ We’re too early.” “Nobody is enforcing it yet.” “We’ll fix it before we raise.”

Here’s why each of those is a problem. 

“We’re too early” – The Act does not have a size threshold. Early does not mean exempt. 

“Nobody is enforcing it yet” – The Data Protection Board is being constituted. Enforcement will begin. Building complaint habits now costs almost nothing. Rebuilding your data architecture after a complaint costs a lot. 

“We’ll fix it before we raise” – Investors doing due diligence increasingly ask about data compliance. If your data practices are non-compliant at Series A, you either fix it under time pressure or disclose it as a risk. Neither is a good position. 

The founders who deal with this in month one spend two days on it. The founders who deal with it in month eighteen spend two months on it. 

Three things you can do this week: 

1. Audit what you’re actually collecting. Open your database, your analytics tool, your CRM. List every data point you store. For each one, ask: do I actually need this to deliver my product? If the answer is no, stop collecting it. The Act says collect only what is necessary for the stated purpose. This is called data minimisation and also a legal obligation. 
2. Write a consent notice. One paragraph. What data you collect, why, who you share it with. Put it before the signup button, not after. Ask me to help you draft one if you’re not sure where to start. 
3. Appoint a grievance officer. If you’re a solo founder, it’s you. Put your name and an email address on your website under a heading that says “Grievance Officer.” That is all you need to do right now. 

The DPDP Act is not a compliance burden designed to slow startups down. It is a framework that, done right, makes your users trust you more. That trust is a product feature. 

The author is a law student specialising in tech law and data privacy. This post is for informational purposes only and does not constitute legal advice.