India's DPDP Rules: what app and SaaS teams should build before May 2027

India's Digital Personal Data Protection Act now has its operating rules. The DPDP Rules were notified in November 2025 and phase in over 18 months: the Data Protection Board was set up immediately, consent managers have roughly a year to register, and most obligations on businesses — consent, user rights, breach notification — apply from around May 2027.

Eighteen months sounds long. For an app or SaaS product it is about the time it takes to design, build and test the changes properly. This is not legal advice — work with counsel on your obligations — but these are the product pieces we see teams needing.

What to build

• Clear, specific consent. Plain-language notices that say what data is collected and why, with consent that can be withdrawn as easily as it was given.
• A data map. Where every piece of personal data lives — database, analytics, CRM, backups, vendors.
• User rights flows. Self-service or tracked requests to access, correct and erase data, and a grievance contact.
• Retention and deletion. Delete data you no longer need for the stated purpose — including in third-party tools.
• Breach readiness. Logging, alerting and a written plan to notify the Board and affected users quickly.
• Children's data. If minors can use your product, verifiable parental consent and limits on tracking.

Where to start this quarter

1. Do the data map — everything else depends on it.
2. Remove data you collect "just in case".
3. Rewrite consent screens and notices in plain language.
4. Add deletion and export to the admin panel before users ask for it.

If you also serve the EU or UK, much of this overlaps with GDPR work — build it once, configure per market.

Sources

• IANS — Centre notifies DPDP Act rules (14 Nov 2025)