India has moved from a light-touch digital rulebook to a dense one in under five years. A startup serving Indian users now deals with a comprehensive data protection law phasing in through May 2027, intermediary rules that reach AI-generated content, six-hour cyber incident reporting, consumer rules on dark patterns and, depending on the business, sector regulators such as the RBI, SEBI and IRDAI.
Most of these laws apply to foreign companies too. The DPDP Act reaches processing outside India connected with offering goods or services to people in India, and the IT Rules apply to any intermediary serving Indian users. This guide maps who needs what, under which law, and gives a staged checklist.
- Core data law
- Digital Personal Data Protection Act 2023 & Rules 2025
- Data regulator
- Data Protection Board of India
- Internet law
- IT Act 2000, IT Rules 2021 (amended 2026)
- Cyber reporting
- CERT-In: 6 hours
- AI law
- No standalone law; MeitY AI Governance Guidelines (Nov 2025)
- Biggest deadline
- Core DPDP duties from 13 May 2027
Who needs to comply
Every startup collecting personal data from Indians
The DPDP Act applies to digital personal data, including data collected offline and digitised, and to foreign companies offering goods or services in India.
Platforms, marketplaces, social and content apps
As intermediaries under the IT Act, they must meet IT Rules due diligence, grievance redressal and takedown timelines, and label AI-generated content.
Generative AI and media tools
The 2026 IT Rules amendments require labels and provenance metadata on synthetically generated information.
Fintech, lending, payments and insurtech
RBI, SEBI or IRDAI rules apply on top of DPDP, including payment data localisation and digital lending directions.
Crypto and Web3 businesses
VDA service providers must register with FIU-IND under the PMLA, and VDA transfers carry 30% tax and 1% TDS.
Edtech, gaming and consumer apps used by children
The DPDP Act requires verifiable parental consent for under-18s and bans tracking, behavioural monitoring and targeted ads aimed at children.
E-commerce and D2C brands
Consumer Protection (E-Commerce) Rules 2020 and the 2023 dark patterns guidelines govern disclosures, pricing and design.
Cloud, SaaS, VPN and data centre providers
CERT-In Directions add six-hour incident reporting, 180-day log retention in India and, for some, customer record-keeping.
The laws, in detail
01Digital Personal Data Protection Act 2023 & DPDP Rules 2025
India’s comprehensive data protection law: consent, notice, security, breach intimation, rights, children’s data and Significant Data Fiduciaries.
When it applies
Processing digital personal data in India, or outside India in connection with offering goods or services to people in India.
What you must do
- Itemised, plain-language notice in English or any Eighth Schedule language
- Free, specific, informed, unambiguous consent, as easy to withdraw as to give
- Reasonable security safeguards, including encryption, access control and logs
- Breach intimation to the Board and affected people
- Verifiable parental consent for under-18s; no tracking or targeted ads at children
- Rights to access, correction, erasure, grievance redressal and nomination
- Erasure when the purpose is served; SDFs: DPO in India, DPIA and annual audit
Regulator
Data Protection Board of India (MeitY)
Penalties
Up to ₹250 crore for security safeguard failures; up to ₹200 crore for breach-notice and children’s data failures; up to ₹150 crore for SDF failures.
02Information Technology Act 2000 & IT (Intermediary Guidelines) Rules 2021
Intermediary due diligence, safe harbour, grievance redressal and content takedown, with 2026 amendments on synthetic content.
When it applies
Any service that stores, transmits or hosts third-party content for users in India; extra duties for significant social media intermediaries (5 million+ users).
What you must do
- Publish rules, privacy policy and user agreement; inform users of prohibited content
- Appoint a Grievance Officer; acknowledge complaints in 24 hours, resolve within 15 days
- Remove unlawful content on court or government orders within tight timelines
- Label synthetic content and embed provenance metadata where feasible
- SSMIs: India-resident Chief Compliance Officer, nodal contact and monthly compliance reports
Regulator
MeitY
Penalties
Loss of safe-harbour protection, plus liability under the IT Act and other laws.
03CERT-In Directions (April 2022)
Cyber incident reporting, log retention and record-keeping.
When it applies
Service providers, intermediaries, data centres, body corporates and government; specific duties for VPN, cloud, VPS and VDA providers.
What you must do
- Report specified incidents (including data breaches) to CERT-In within 6 hours
- Maintain ICT system logs for 180 days within India
- Synchronise clocks to Indian NTP servers
- Designate a point of contact for CERT-In
Regulator
CERT-In
Penalties
Penalties under section 70B of the IT Act, including imprisonment for non-compliance.
04Consumer Protection Act 2019, E-Commerce Rules 2020 & Dark Patterns Guidelines 2023
Consumer rights for online sales, seller and pricing disclosures, grievance handling and 13 specified dark patterns.
When it applies
E-commerce entities and platforms selling goods or services to Indian consumers.
What you must do
- Disclose seller details, total price, return and refund policies
- Appoint a grievance officer and resolve complaints within set timelines
- Avoid dark patterns such as false urgency, basket sneaking, confirm-shaming and drip pricing
- No manipulation of search rankings or fake reviews
Regulator
Central Consumer Protection Authority (CCPA)
Penalties
Penalties and corrective orders under the Consumer Protection Act.
05Sector regulators: RBI, SEBI, IRDAI
Financial-sector data, outsourcing, cybersecurity and conduct rules that sit on top of the DPDP Act.
When it applies
Payments, lending, wealth, broking and insurance businesses, and their technology vendors.
What you must do
- Store payment system data only in India (RBI, 2018)
- Follow RBI Digital Lending Directions on disclosures, data and LSP arrangements
- IT outsourcing and cybersecurity frameworks for regulated entities and vendors
- SEBI and IRDAI cybersecurity and data rules for their regulated entities
Regulator
RBI, SEBI, IRDAI
Penalties
Licence action, monetary penalties and business restrictions.
06Prevention of Money-laundering Act (VDA service providers) & VDA tax rules
AML registration and reporting for crypto businesses, plus crypto taxation.
When it applies
Exchange, transfer, safekeeping or administration of VDAs, or financial services for token offers, for Indian users (including offshore providers).
What you must do
- Register with FIU-IND as a reporting entity
- KYC, record-keeping and suspicious transaction reporting
- Withhold 1% TDS on VDA transfers where applicable
Regulator
FIU-IND; Income Tax Department
Penalties
PMLA penalties and blocking of non-compliant offshore platforms.
07Telecommunications Act 2023
Authorisation of telecom services and user identification obligations.
When it applies
Businesses providing telecommunication services; relevant to some messaging, VoIP and connectivity startups.
What you must do
- Check whether your service needs authorisation
- Biometric or verifiable user identification where required
- Comply with interception and security directions
Regulator
Department of Telecommunications
Penalties
Penalties and suspension under the Act.
08India AI Governance Guidelines (non-binding)
Principles and institutional framework for AI governance, relying on existing laws.
When it applies
Any organisation developing or deploying AI in India (voluntary).
What you must do
- Align AI use with principles such as accountability, fairness and safety
- Use existing law: IT Act, DPDP Act, consumer and criminal law
- Prepare for targeted amendments, for example to the intermediary definition
Regulator
MeitY / IndiaAI Mission
Penalties
None directly; underlying laws apply.
Compliance checklist
01 · Before you launch
- Map every point where you collect personal data from Indian users
- Write itemised DPDP notices and a consent flow with easy withdrawal
- Decide whether children use the product; design verifiable parental consent if so
- Publish terms, privacy policy and grievance officer details (IT Rules)
- Check sector licensing: RBI, SEBI, IRDAI, FIU-IND or DoT
- Set up a CERT-In incident playbook that can report within 6 hours
02 · At launch
- Store required ICT logs in India for 180 days
- Run a dark-patterns review of checkout, subscriptions and consent screens
- Label any AI-generated media your platform creates or hosts
- Sign processor agreements with every vendor that touches personal data
- Train support staff on grievance and data principal requests
03 · As you scale
- Prepare for SDF designation: DPO in India, independent auditor, DPIAs
- Integrate with registered consent managers where useful
- Review cross-border transfers against any government-notified restrictions
- Watch the 5 million user threshold for significant social media intermediaries
- Annual review of retention and erasure
Key dates
- Jun 2022CERT-In Directions in force
- Aug 2023DPDP Act enacted
- Nov 2025DPDP Rules notified; AI Governance Guidelines released
- 20 Feb 2026IT Rules synthetic content amendments in force
- 13 Nov 2026Consent manager framework operational
- 13 May 2027Core DPDP obligations enforceable
Common mistakes
- Copying a GDPR privacy policy: DPDP notices must be itemised and available in Indian languages.
- Bundling consent into terms of service, or making withdrawal harder than giving consent.
- Treating 18 as ‘adult’ only in the T&Cs, without a real parental consent flow.
- Missing the six-hour CERT-In clock because the incident plan was written for 72 hours.
- Assuming offshore crypto platforms are outside PMLA registration.
FAQs
Does the DPDP Act apply to a foreign startup?
Yes, if it processes digital personal data outside India in connection with offering goods or services to people in India.
Is there a data localisation requirement?
Not generally under the DPDP Act, which allows transfers unless the government restricts a country. Sector rules such as RBI’s payment data rule still require storage in India.
Who is a child under Indian law?
Anyone under 18. You need verifiable parental consent and must not track, behaviourally monitor or target ads at children.
Does India have an AI law?
No standalone law. AI is governed through existing laws, the IT Rules on synthetic content and non-binding guidelines.
In the law library
Sources
Reviewed 12 October 2026. General information, simplified for planning; not legal advice. Check current law before relying on any requirement, and get advice for your facts. For markets outside India, advice is coordinated with locally qualified counsel.