Buyer Guides · 7 MIN
The DPDP Act and software projects in India: what builders and buyers must know
What India's DPDP Act 2023 and 2025 Rules mean for software projects: roles, processor contracts, security safeguards, breach reporting, penalties, and the foreign-client exemption.
India's Digital Personal Data Protection Act, 2023 (DPDP Act) governs digital personal data processed in India. If you commission software that handles personal data, you are normally the data fiduciary and your developer is a data processor. You need a written contract, reasonable security safeguards and a breach process. Most core duties start around May 2027.
- The DPDP Act applies to digital personal data processed in India, and to processing outside India that offers goods or services to people in India.
- The DPDP Rules were notified in November 2025, and the main obligations are phased in over 18 months, so around May 2027.
- A fiduciary may engage a processor only under a valid contract, and the fiduciary stays responsible.
- Rules 6 to 8 set minimum security safeguards, a breach report, and a one-year minimum retention for logs.
- An Indian company processing data of people outside India under a contract with a foreign party gets a partial exemption but must still keep reasonable security safeguards.
- Nactore is an AI-native technology and growth company in Mumbai that builds consent, security and audit trails into products from the first sprint.
What is the DPDP Act and who does it apply to?
The DPDP Act is India's first general data protection statute. You can read the text of the Act on the Ministry of Electronics and Information Technology (MeitY) website. It covers personal data collected in digital form, or collected offline and then digitized, when it is processed in India. It also reaches processing outside India if that processing is connected with offering goods or services to people in India.
The Act uses its own vocabulary. The data fiduciary decides the purpose and means of processing. The data processor handles data on behalf of a fiduciary. The data principal is the person the data is about.
If you hire a software company to build your app, you are the fiduciary, and the software company is a processor when it touches live data. If the company only builds software and never sees production data, it is mostly a supplier. Once it has access to production, it becomes a processor.
When do the rules actually start?
MeitY notified the DPDP Rules, 2025 on 13 November 2025. They use a phased start. The rules on the Data Protection Board (Rules 17 to 21) came into force on publication. The rule on consent managers follows one year after publication. The bulk of the duties, including notice, security safeguards, breach intimation, retention and rights handling, follow eighteen months after publication, which is around May 2027.
Confirm exact dates against the official notifications, because phased schedules are easy to misread. For a software project that will launch after mid-2026, plan to be compliant at launch rather than retrofit later.
What must a software project build in?
Translate the legal text into product requirements. These are the items that most often land on a development team.
| Requirement | What it means in the product |
|---|---|
| Notice and consent | A clear notice in plain language at the point of collection, with a way to give and withdraw consent as easily. |
| Purpose limitation | Collect only what you need for the stated purpose, and do not reuse it silently. |
| Data principal rights | Screens or workflows to access, correct, erase and nominate, and a grievance channel. |
| Children | Verifiable consent from a parent or guardian for anyone under 18, and no tracking or targeted ads aimed at children. |
| Security safeguards | Encryption or masking, access control, logs and monitoring to detect unauthorised access, backups, and security terms in vendor contracts. |
| Breach handling | A process to inform the Board and each affected person, and to file a detailed report within 72 hours. |
| Retention | Delete data when the purpose ends, but keep specified logs for at least one year. |
Rule 6 lists the minimum security measures. Rule 7 covers breach intimation, with an immediate notice to the Board and a fuller report within 72 hours unless the Board allows longer. Rule 8 sets the log retention floor. Read the primary text rather than a summary, since these rules will shape your architecture.
What should the contract with your developer say?
The Act requires a fiduciary to engage a processor only under a valid contract. In practice, put these items in writing.
- Scope of processing. What data, for what purpose, for how long.
- Security. The safeguards the vendor must meet, aligned with Rule 6.
- Breach duties. The vendor tells you without delay so you can meet the 72-hour report.
- Sub-processors. A list of cloud and model providers, with your right to object.
- Return or deletion. What happens to data at the end, and how it is certified.
- Audit. Your right to ask for evidence of controls.
Combine this with the IP and data terms for AI projects, because most AI builds send data to a third-party model provider.
How much can the penalties be?
The Schedule to the Act sets maximum penalties by type of breach. The highest figure, up to Rs 250 crore, applies to failure to take reasonable security safeguards to prevent a personal data breach. Failure to notify a breach and failure to meet obligations for children each carry a lower ceiling, up to Rs 200 crore. These are maximums, set by the Data Protection Board after an inquiry. Do not treat them as typical outcomes.
The point for a software buyer is the direction of risk. A security gap in a system you commissioned is your exposure, which is why vendor security evidence belongs in procurement.
Does the Act apply to Indian vendors serving foreign clients?
This is where Indian software exporters get relief, and where foreign buyers should read carefully. Section 17 of the Act exempts certain processing. One exemption covers an Indian-based person who processes the personal data of people outside India under a contract with a person outside India. That exemption removes most fiduciary obligations and data principal rights. It does not remove the duty to keep reasonable security safeguards.
So an Indian team building a US or EU product from foreign client data does not need to run Indian consent flows for those foreign users. Your own law still applies in full. A European client still needs a data processing agreement under GDPR, for example. See GDPR DPA checklist for hiring developers.
If your product serves both Indian and foreign users, do not rely on the foreign-client exemption for the whole system. It covers data of people outside India, so Indian users in the same database are fully in scope.
What about sending data outside India?
The Act allows transfers of personal data outside India except to countries the Central Government restricts by notification. That is more permissive than the model used in some other countries. But sector regulators can add rules. For example, the Reserve Bank of India requires payment system data to be stored in India. Check your sector before choosing a cloud region.
Frequently asked questions
Is the DPDP Act already in force?
The Act and Rules are being brought in by phases. The Board provisions are in force, and the main duties are scheduled for around May 2027. Check the official notification for the exact date relevant to you.
Is my developer liable if my app has a breach?
The fiduciary stays responsible to the regulator, whatever its contract says. A processor can still be liable to you under the contract. Write breach duties and indemnities clearly.
Do small startups have to comply?
The Act has no blanket exemption for small businesses. Section 17(3) lets the Central Government exempt certain classes of fiduciary, including startups, from some provisions by notification, but you should assume the basics apply and check with counsel.
Do I need a data protection officer?
Only a Significant Data Fiduciary has to appoint one and carry out audits and impact assessments. The government designates these based on data volume, sensitivity and risk.
Build the controls once
The cheapest time to build consent, deletion and logging is the first sprint. Retrofitting them after launch costs more and leaves gaps. This article is general information, not legal advice, so confirm your obligations with qualified counsel.
Want this built for your team? Book a free 30-minute call.
Want to apply this to your business?
Book a free 30-minute call. We will tell you what we would do first.