Privacy by design and India's DPDP Act

In a food-delivery app, one customer’s name, phone number and orders end up in six places: the orders database, analytics, request logs, invoices, a search index and backups. An erasure request that misses one of them leaves the data behind, and nobody notices until the customer does.

Privacy by design builds the protection of personal data into that architecture, field by field and copy by copy, instead of adding it to a policy after launch. India’s DPDP Act, the Digital Personal Data Protection Act, 2023, turns that work into duties for any business that decides why and how digital personal data is processed: reasonable security safeguards, telling the Data Protection Board and every affected person about a breach, and erasing data once consent is withdrawn or the purpose is served, unless a law requires it to be kept. This lesson is education about system design, not legal advice.

Every copy of personal data needs a purpose, a lifetime and a way out

India’s DPDP Act calls the business a Data Fiduciary and the person a Data Principal. It applies to digital personal data processed in India, and to processing outside India that is connected with offering goods or services to people in India (section 3). Privacy by design starts from a map like this one: in a food-delivery app, one customer’s details live in six places, and every one of them needs a purpose, a lifetime and a way to be erased.

Field	Purpose	Lifetime
Phone	Delivery, sign-in, support	180 days after the last order
Live location	Delivery tracking	30 days
Name and address on invoices	Tax law	As long as the law requires
Date of birth	None	Do not collect it

A field with several purposes lives as long as its longest purpose needs it, and no longer: the phone stays for the 180 days support needs, while the live location goes after the 30 days of delivery tracking.

The moves that make the map hold, each in one sentence:

• Data minimisation: a field is collected only when a named purpose needs it.
• Purpose and retention tags: every field records why it is held and when it must go.
• Consent records: what each person agreed to, when and through which notice, so that a withdrawal can be honoured.
• Pseudonymisationpseudonymisation: Processing personal data so that it can no longer be attributed to a person without additional information, such as a key, which is kept separately and protected.: analytics and logs carry a stand-in id instead of the person’s identity.
• An erasure pipeline: one request fans out to every store that holds the person’s data, then checks the result.
• A breach runbook: who tells the Board, the affected people and CERT-InThe Indian Computer Emergency Response Team, the national agency that receives reports of cyber incidents in India and issues directions on how to handle them., by when, with which data ready.

The DPDP Rules, 2025 bring the duties into force in stages: the rules that set up the Data Protection Board applied on publication, the rule on consent managers one year later, and most obligations, safeguards, breach intimation and erasure among them, eighteen months after publication (rule 1).

1. On publication

   The Data Protection Board is set up stage 1

   The rules that set up the Data Protection Board, its members, its meetings and its staff applied on the day the Rules were published, together with their title and definitions.

2. After one year

   Consent managers stage 2

   The rule on consent managers, the registered services through which a person can give, manage and withdraw consent, applies one year after publication.

3. After eighteen months

   Most duties of a business stage 3

   Most obligations of a business apply eighteen months after publication, reasonable security safeguards, breach intimation and erasure among them. Those are the duties a system has to be designed for.

The timeline has 3 events, from On publication to After eighteen months.

Each DPDP obligation becomes a requirement on a component Pro: opens with a Pro, Premium or Ultimate pass

In this part:

• A personal-data inventory, kept as data, finds the design’s mistakes
• Erasure is finished only when a scan finds nothing left
• A breach starts deadlines of hours, so its path is built before it
• Children, significant data fiduciaries and transfers abroad add duties of their own
• Designing for the stricter side of the DPDP Act and the GDPR serves both
• Practise: a data plan from a list of fields
  • Tag data fields with purpose, retention and consent
• Interview questions
  • A user closes their account. Their data lives in a primary database, a search index, a data warehouse, three vendors' systems and 35 days of backups. Design an erasure you can prove reached every copy.
  • Your team finds that a storage bucket holding 2.4 million customers' names, phone numbers and addresses was public for a week. Plan the first 24 hours for a service operating in India.
  • Product wants every screen view logged with the user's phone number to study funnels. Redesign the analytics so that it answers the same questions with far less personal data.
• Key takeaways

3 diagrams · 3 runnable examples (Python) · 1 exercise with sample tests · 3 interview answers · about 43 minutes

Opening this part with your pass…

This part opens with any MySmartCoPilot pass.

• Pro pass · 1 week · ₹79 · $2.99
• 30 days · ₹179 · $5.99
• 1 year · ₹1,699 · $45

One payment; a pass never renews. The price shown is the total you pay: no fees or charges are added at checkout.

Choose a passI have a licence key

It also opens every other in-depth part in Learn and every Pro tool. Sales are final, except where the law gives you a right to withdraw, for example in the EU and the UK (refund policy).

Read a complete sample first: Design a unique ID generator