India's Digital Personal Data Protection Act, 2023 (DPDP Act), together with its Rules, sets out how businesses must handle personal data of people in India. If your website has a contact form, or your app has logins, bookings or payments, it applies to you. This is a plain-language overview of the key ideas. It is not legal advice; for your specific situation, speak to a qualified lawyer.

The key ideas

• Consent and notice. Collect personal data for a clear, lawful purpose, tell people what you collect and why, and get consent that is free, specific and easy to withdraw.
• Collect only what you need. Data should be limited to the purpose you stated, and deleted when it is no longer needed.
• Keep it safe. Use reasonable security safeguards, and be ready to report personal data breaches as the law requires.
• People have rights. Individuals can ask to access, correct and erase their data, and to have their complaints handled.
• Children need extra care. For users under 18, verifiable consent from a parent or guardian is required, and tracking, behavioural monitoring and targeted advertising directed at children are not allowed.

Penalties for serious failures can be very large, so it is worth building privacy in from the start rather than adding it later.

What this means for your product

1. Map your data. List every piece of personal data you collect, where it is stored and who can see it.
2. Remove what you do not need. The safest data is data you never collect.
3. Update your forms and privacy policy. Clear notices, clear consent, and an easy way to contact you about data.
4. Check your third-party tools. Analytics, ads, chat widgets and SDKs often collect more than you expect.
5. Plan for deletion requests. Make it possible to find and delete one person's data.

How we build with privacy in mind

Our children's app Ankur collects no personal data at all: everything stays on the device, there are no ads or analytics, and parents can delete a child's data in one step. Not every product can go that far, but every product can collect less, explain more and protect what it keeps.

Need a privacy review of your website or app, or a new product built privacy-first? Get in touch and we will walk through it with you.