India’s DPDP Act: what changes on 14 May 2027

From 14 May 2027, the substantive duties of India’s Digital Personal Data Protection (DPDP) Act 2023 and its Rules 2025 apply. If you collect personal data from people in India, you will need a plain-language notice, consent that is as easy to withdraw as to give, a grievance contact and a breach process. Registration of consent managers opens earlier, in Nov 2026.

• An itemised notice in plain language. Tell people what data you collect, why, and how to use their rights.
• Withdrawal as easy as consent. If someone gave consent with one click, they should be able to withdraw it just as easily.
• A grievance officer. Publish a contact that people can use to raise a complaint about how you handle their data.
• Breach notices. If personal data is breached, notify the Data Protection Board and the people affected.

1. List the apps and forms that collect personal data from people in India.
2. Check each one for a notice, a consent record and a way to withdraw consent.
3. Name a grievance officer and publish the contact details.
4. Write down your breach process: who decides, who notifies and how.

If you also serve people in the EU or the UK, GDPR applies too. Much of the same work, such as notices, consent records and data requests, helps with both.