What does the DPDP Act mean for your software?
Quick answer
The DPDP Act sets rules for any software that handles personal data of people in India: collect it for a stated purpose with consent, keep it only as long as needed, protect it, and let people see, correct and delete it. Your software needs consent records, data deletion, access controls and breach reporting built in, not bolted on.
Vastavik Bajpai , Founder
· 2 min read
The Digital Personal Data Protection Act, 2023 is India's data protection law. If your software stores names, phone numbers, addresses or anything else about a person, it applies to you. This is a plain summary of what that means for the software itself. It is not legal advice; ask a lawyer about your own obligations.
The ideas behind the law
- Purpose and consent. Personal data is collected for a stated purpose, with clear consent that can be withdrawn.
- Only what is needed, only as long as needed. Data is deleted when the purpose is over.
- People's rights. A person can ask what you hold, have it corrected, and have it erased.
- Protection. Reasonable security, and reporting if there is a breach.
- Accountability. The business that decides why and how data is used is responsible for it, including when a supplier processes it.
What your software needs
- A consent record: what was agreed, when, and for what purpose, with a way to withdraw.
- Deletion that actually deletes, including backups after their retention period.
- Access controls, so staff see only the data their job needs, with a log of who looked at what.
- Export and correction tools, so a request from a customer does not become a manual scramble.
- Encryption in transit and at rest, and a written plan for reporting a breach.
- Clear terms with any AI or cloud provider about what data they receive and where it is stored.
Where AI makes this harder
An AI assistant that reads customer records is processing personal data. Limit what it can see, keep records of what it was asked, and make sure the provider does not train on your data. These are design decisions made at the start, not settings changed later.
We build these controls into custom software and AI tools as standard. See how we approach AI, or ask us to review what you have.
Questions people ask
Does the DPDP Act apply to a small business?
Yes, if it processes digital personal data. Some duties are lighter for smaller organisations, but the basic rules on consent, security and deletion apply.
What about customers outside India?
Their own laws may also apply, such as the GDPR in the UK and EU. Software built with consent records, deletion and access controls covers most of what these laws share.
Can old software be made compliant?
Usually, with a review of what data it holds, where it goes, and adding the missing controls. Sometimes it is cheaper to rebuild the part that handles personal data.
Related pages
Pages people read alongside this one.