India's data law gets real in May 2027. Is your app ready?
Consent screens, data deletion, breach alerts. Your lawyer writes the policy. I build it into your product, so what the policy promises is what the app actually does.
- FREE
- 24 HOURS
- NO ACCESS NEEDED
- NOV 2025DPDP Rules notified. The Data Protection Board provisions take effect.
- NOV 2026Consent Manager provisions take effect, about 12 months after notification.
- MAY 2027Core obligations apply: notice, consent, security, breach reporting, retention and user rights.
A privacy policy isn't compliance
Most apps will meet May 2027 with a new privacy policy and the same product underneath: one checkbox for everything, no way to delete an account, and no idea a breach happened until a customer says so.
The DPDP Act asks the product to change, not only the paperwork. Consent has to be specific and as easy to withdraw as it was to give. Deletion has to actually delete. Breaches have to be reported to the Board within 72 hours. Those are engineering jobs.
What I build into your product
Notice & consent
A clear, standalone notice and a consent screen that asks for each purpose separately, logged so you can prove it later.
- Itemised notice in plain language
- Separate consent per purpose
- Consent records with timestamps
User rights
People can see, correct and delete their data, and withdraw consent as easily as they gave it.
- Access and correction requests
- Deletion that reaches backups and vendors
- One-click consent withdrawal
Breach readiness
Logging, alerting and a written runbook, so a breach is reported to users and the Board on time, not discovered weeks later.
- Access logs kept for a year
- Alerting on unusual access
- Breach notice templates
Retention & security
Data is kept only as long as its purpose needs, and protected while it is.
- Retention rules and scheduled erasure
- Encryption and access control
- Children’s data handled separately
From check to compliant product
- 01
Free readiness check
I go through your app and website as any user would: sign-up, consent, privacy notice, account deletion, cookies and trackers.
- 02
Gap report in 24 hours
A short video and a one-page report: what the product does today, what the law asks it to do, and what to build first.
- 03
Your lawyer signs off the policy
Your lawyer or compliance advisor decides what the policy says. If you don’t have one, I can introduce you.
- 04
I build it into the product
Fixed price, agreed upfront. Consent, rights, retention and breach flows, built into your web or mobile app.
Who this is for
- Indian startups and D2C brands with sign-ups, orders or customer accounts
- Clinics, schools and services that collect personal details online
- Apps built with Lovable, Bolt or Cursor that never had a privacy pass
- Foreign businesses selling to people in India
Fixed price, after the free check
The check shows what your product needs, so the quote covers exactly that and nothing else. You see progress every week and own everything at the end.
Start with the free checkQuestions
Something else? Email me.
When does the DPDP Act actually apply?
The DPDP Rules were notified in November 2025 and phase in over 18 months. Most obligations that change how an app works, including notice, consent, security safeguards, breach reporting and user rights, apply from around 13 May 2027. Consent Manager provisions apply from around November 2026.
Are you a lawyer?
No. For DPDP, I'm the implementation partner. I build what your lawyer or compliance advisor specifies, and I can introduce you to one.
Does the DPDP Act apply to my business?
It applies to digital personal data processed in India, and to processing outside India when it is connected to offering goods or services to people in India. Whether a specific exemption covers you is a question for your lawyer; the free check shows what your product would need to change if it does apply.
What are the penalties?
The Act sets penalties of up to ₹250 crore for failing to take reasonable security safeguards to prevent a personal data breach, with other breaches carrying their own caps. The Data Protection Board decides the amount in each case.
How fast do I have to report a data breach?
Under the Rules you must tell affected users and the Data Protection Board without delay, and send the Board a detailed report within 72 hours of becoming aware of the breach. That is only possible if logging and alerting are already in place.
We already follow GDPR. Are we covered?
Partly. Much of the engineering carries over, but DPDP has its own rules on consent notices, children’s data (under 18, with verifiable parental consent), breach timelines and erasure. The check shows exactly where the gaps are.
Do you need access to my systems?
Not for the free check. I only look at what any user of your app or website can see.
This page describes what the DPDP Act and Rules ask products to do. It isn't legal advice.
Find out what your app needs before May 2027.
The same audit checks reliability & security and search & AI visibility →