The Digital Personal Data Protection Act (DPDP) is now in force. If you handle data from Indian users — from any country — you need to comply. Here's the practical checklist our developers use on every new project.
What DPDP requires (in plain English)
- Consent — explicit, informed, and revocable. No pre-ticked boxes.
- Purpose limitation — you can only use data for what you said you'd use it for.
- Data minimization — collect only what's necessary. This is the one teams most often fail.
- Storage limitation — delete data when its purpose is fulfilled, not "whenever we get around to it".
- Security safeguards — reasonable technical and organizational measures (encryption, access control, breach detection).
- Breach notification — notify the Data Protection Board and affected users within a defined window.
- Grievance redressal — a published process for users to complain and get responses.
The developer checklist
- ☐ Every data collection point has an explicit consent mechanism (with opt-out).
- ☐ PII columns are documented in a data map (who owns, what it's used for, retention).
- ☐ Database backups respect the same encryption standards as production.
- ☐ Analytics tools are configured with IP anonymization and PII redaction.
- ☐ Third-party SDKs reviewed for data-sharing practices — every SDK is a data sub-processor.
- ☐ Access to production PII is logged and rotated.
- ☐ Users can export and delete their data (DSAR flow).
- ☐ Privacy policy matches what the code actually does — audit annually.
The common trap
The biggest compliance failure we see: analytics scripts and error trackers silently collecting PII — full URLs, email addresses in stack traces, session recording tools capturing form inputs. Audit your instrumentation before the regulator does.
