What the DPDPA Is
The Digital Personal Data Protection Act, 2023 is India's first comprehensive data protection law. It applies to digital personal data, and to personal data collected offline and later digitised, processed in India. It also applies to processing outside India when it is connected to offering goods or services to people in India.
The Act uses its own vocabulary. The person the data is about is the data principal. The organisation that decides why and how data is processed is the data fiduciary. A processor handles data on a fiduciary's behalf. The government can designate some fiduciaries as significant data fiduciaries, based on factors such as the volume and sensitivity of data, and they carry extra duties such as appointing a data protection officer and running periodic audits.
This entry is a general explanation for growth and product teams, not legal advice.
The Timeline
Parliament passed the Act in August 2023. The Digital Personal Data Protection Rules, 2025 were notified in November 2025 and set a phased start. The provisions establishing the Data Protection Board of India took effect immediately. The framework for registered consent managers applies twelve months after notification. Most obligations on data fiduciaries, including notice, consent, security safeguards, breach reporting and data principal rights, apply eighteen months after notification, in May 2027.
That gives app teams a window to prepare, and most are using 2026 to map their data flows, update notices and add consent where they rely on it.
Consent and Notice
Consent sits at the centre of the DPDPA. It must be free, specific, informed, unconditional and unambiguous, given through a clear affirmative action, and limited to the data needed for the stated purpose. Before or at the time of asking, the fiduciary must give a notice that describes the data, the purpose, and how the person can withdraw consent, exercise their rights and complain to the Board. Notices must be available in English or any language listed in the Eighth Schedule of the Constitution.
Withdrawing consent must be as easy as giving it. The Act also introduces consent managers: registered entities that let people give, manage, review and withdraw consent across services through one interface.
The Act allows some processing without consent for certain legitimate uses, such as data the person voluntarily provides for a specified purpose. Whether a given measurement flow fits one of these uses is a legal judgement for each app.
Children's Data
The DPDPA defines a child as anyone under 18, a higher age than most other privacy laws. Fiduciaries must obtain verifiable consent from a parent or lawful guardian before processing a child's data, and must not undertake tracking, behavioral monitoring or targeted advertising directed at children. The Rules set out limited exemptions for specific classes of fiduciaries and purposes. Apps with a young audience, such as edtech and gaming, should treat this as a design constraint for measurement and ads.
Rights, Duties and Cross-Border Transfers
Data principals can access information about their data, correct and erase it, nominate someone to act for them, and seek grievance redress. Fiduciaries must protect data with reasonable security safeguards, notify the Board and affected people of breaches, and erase data once its purpose is served unless the law requires retention.
The Act permits transfers outside India except to countries the government restricts by notification, while sector rules, such as those from financial regulators, can impose stricter localisation.
How Linkrunner Supports DPDPA Programs
Linkrunner displays a DPDPA badge on its Trust Center and offers a data processing agreement at /legal/dpa. Data is hosted in India, in Google Cloud's asia-south1 region, and teams that need it in their own environment can use Bring Your Own Cloud. PII hashing is an opt-in SDK setting, and postbacks are mapped per network so you choose which events leave your stack.