DPDP Checklist for Websites and Apps: 20 Changes to Ship by May 2027

As of 3 October 2026. The DPDP Rules 2025 were notified on 13 November 2025, and the main obligations for websites and apps, including notice, consent, security, breach intimation and data rights, apply from 13 May 2027.

Key fact	Detail
Law	Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025
Main deadline	13 May 2027 for data fiduciary obligations
Earlier phase	13 November 2026: Consent Manager registration framework
Who it applies to	Anyone processing digital personal data in India, and processing outside India linked to offering goods or services to people in India
Official source	MeitY (meity.gov.in)

This checklist is for developers, tech leads and product owners building websites, web apps and mobile apps for Indian users, including foreign companies that serve customers in India. After reading it you will have a concrete list of 20 changes, know which ones are quick and which need design work, and be able to plan a sprint schedule that finishes well before May 2027.

Who must comply with the DPDP Act

Any business that processes digital personal data of people in India must comply, whether it is an Indian company or a foreign one offering goods or services to Indians. Developers build most of the controls, so the obligations land in the codebase.

The Act calls the business deciding why and how data is processed a "data fiduciary", and the individual a "data principal". Vendors processing data for you, such as your cloud host or SMS provider, are "data processors". As the developer or agency, you are usually a processor for your client, which means your client carries the legal duty but relies on what you build.

Foreign businesses often ask whether GDPR work covers them. Much of it helps, but the Indian law has its own notice format, consent rules and breach process. Our guide on GDPR when outsourcing to India covers the other direction.

DPDP compliance checklist: 20 changes to ship before May 2027

The 20 changes cover data mapping, notice and consent, user rights, retention, security, breach response, vendors and children's data. Ship mapping and consent first, rights and retention next, and run a breach drill last.

No.	Change to ship	What developers build	DPDP area
1	Data inventory	List every field of personal data, where it is stored, who reads it, and why	Data mapping
2	Purpose register	One purpose per use: billing, delivery, marketing, analytics	Purpose limitation
3	Plain-language notice	Itemised notice of data and purposes, in clear English and other Indian languages where relevant	Notice
4	Separate consent per purpose	Unticked checkboxes, no bundling of marketing with service consent	Consent
5	Consent records	Store who, what, which notice version, when, and channel	Proof of consent
6	Easy withdrawal	Withdraw in as few steps as giving consent, in the account or app settings	Withdrawal
7	Consent Manager readiness	Consent logic behind an internal API so external instructions can be honoured	Consent Managers
8	Access requests	Let users see a summary of their data and processing	Right to access
9	Correction and update	Self-service edit or a tracked request flow	Right to correction
10	Erasure	Delete or anonymise on request and when the purpose ends, including backups on their cycle	Right to erasure
11	Grievance contact	Published contact and in-app route for data complaints with tracked response	Grievance redressal
12	Nominee	Allow a user to nominate someone to exercise rights on death or incapacity	Nomination
13	Retention rules	Retention period per data type with automated deletion jobs	Storage limitation
14	Encryption	TLS in transit; encryption at rest for databases, files and backups	Security safeguards
15	Access control	Role-based access, least privilege, no shared admin accounts	Security safeguards
16	Logging and monitoring	Access logs for personal data, retained per the Rules, with alerting	Security safeguards
17	Breach runbook	Who decides, who informs users and the Board, templates ready	Breach intimation
18	Processor contracts	DPDP clauses with every vendor: hosting, SMS, email, analytics, support	Processor obligations
19	Children's data	Age gate and verifiable parental consent; no tracking or targeted ads to children	Children's data
20	Release checklist	Privacy review step in every sprint for new fields, vendors and SDKs	Privacy by design

Rows 1 to 7 are mostly product and data work. Rows 8 to 13 are user-facing features. Rows 14 to 17 are engineering and operations. Rows 18 to 20 are process.

How to build consent that holds up

Consent under the DPDP Act must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and as easy to withdraw as to give. In code, that means per-purpose consent records, not one checkbox.

Three implementation rules prevent most problems. Never pre-tick a box. Never make the service conditional on consent for an unrelated purpose such as marketing. And store each consent as a row with a notice version, so you can prove what the person saw when they agreed.

<label><input type="checkbox" name="consent_marketing_whatsapp" value="yes">Send me offers on WhatsApp. I can stop this any time in Settings.</label><a href="#privacy-notice">What we collect and why</a>

The server should record the purpose code, notice version and timestamp when this box is submitted, and withdrawal in settings should write a new row rather than deleting the old one.

How to handle data rights requests in your app

Users can ask to access a summary of their data, correct it, erase it, nominate someone, and raise a grievance. Your app needs a request flow with identity verification, a tracked status, and a response within the period the Rules set.

• Access: a page or export that summarises personal data held and processing done.
• Correction: self-service edit for profile data, a ticket for anything else.
• Erasure: delete or anonymise across the database, file storage, search index, analytics and CRM, then backups on their normal cycle.
• Grievance: a published contact and a tracked queue. The Rules set an outer limit for responding; summaries of the Rules put it at 90 days, so design for much faster.

Erasure is where most systems fail. Personal data copies itself into logs, exports, email tools and spreadsheets. Your data inventory from row 1 is the list of places the erasure job must reach.

Security, logging and breach notification under DPDP

The Act requires reasonable security safeguards, and the Rules list measures such as encryption, access control, logging and monitoring, and backups. Failing to prevent a breach through inadequate safeguards attracts the highest penalty band, up to Rs 250 crore.

For breaches, the Rules require intimation to affected users and to the Data Protection Board, followed by a detailed report to the Board. Summaries of the Rules describe that detailed report as due within 72 hours, extendable by the Board. Check the exact timelines and contents in the MeitY notification and build your runbook around them.

1. Detect: alerts on unusual access to personal data tables or buckets.
2. Contain: rotate keys, revoke sessions, close the hole.
3. Assess: what data, how many people, what risk.
4. Inform: users in plain language with steps they can take; the Board in the prescribed format.
5. Report and fix: detailed report, root cause, remediation.

The Rules also expect logs of access to personal data to be kept for a minimum period, which summaries put at one year. Make sure your log retention is not set to 14 or 30 days by default.

Children's data rules developers often miss

Under the DPDP Act a child is anyone under 18. Processing a child's data needs verifiable consent from a parent or lawful guardian, and tracking, behavioural monitoring and targeted advertising directed at children are not allowed, subject to exemptions the Rules notify.

For school apps, coaching platforms, gaming and e-commerce, this is a design question. You need an age declaration at sign-up, a parental verification path, and analytics and ad SDKs switched off or reconfigured for minors. Ed-tech teams should review every third-party SDK in the app, since an analytics library can count as tracking.

What we see when auditing Indian websites and apps

When we review web apps and mobile apps for clients in Rajkot, Ahmedabad and overseas, the gaps are consistent: consent bundled into terms of service, no record of what notice a user saw, log retention set to platform defaults, and erasure that only deletes the user row.

A coaching institute's student app had four analytics and attribution SDKs, two of which the owner did not know about. A real estate portal stored enquiry data in the CRM, a marketing tool and a spreadsheet exported weekly. A hospital appointment app logged full patient names in application error logs. Each fix was small; finding them was the work. That is why the checklist starts with a data inventory.

How to plan the DPDP work across sprints

Plan the work in three blocks: mapping and consent first, user rights and retention second, security hardening and a breach drill last. Leave the final month before May 2027 for testing and fixing, not building.

Project type	Typical effort	Indicative budget with us
Brochure website with forms	2 to 5 days	From Rs 25,000
E-commerce store or customer portal	2 to 4 weeks	Rs 1 lakh to Rs 3 lakh
Hospital, school, fintech or HR app	1 to 3 months	Rs 2 lakh to Rs 6 lakh

For businesses also tracking the November 2026 milestone, see our explainer on DPDP Consent Manager rules.

Related reading and next step

See how we build compliant web applications and mobile apps, our DPDP Consent Manager guide, GDPR when outsourcing to India, and our work for international clients. For a fixed quote on a DPDP audit and fix for your website or app, contact us through the contact page or WhatsApp +91 7265004040.