India’s DPDP Rules and why your analytics stack just became a compliance question

On 13 November 2025, India’s Ministry of Electronics and Information Technology published a set of Gazette notifications that most product teams scrolled past, and most legal teams did not. The Digital Personal Data Protection Rules, 2025 turned the DPDP Act, 2023 from a framework on paper into an enforceable compliance regime with hard deadlines, a functioning regulator, and penalties of up to ₹250 crore (roughly $30 million) per violation.

Most of the coverage so far is written for CISOs and general counsel. It walks through governance structures, board committees and policy documentation. That work matters. But it skips the question that lands on product and engineering desks first: what happens to all the behavioral data our app sends to third-party analytics tools?

Every screen view, tap, funnel step, session recording and user profile your SDKs collect is personal data under the DPDP Act. If that data flows through a US-hosted SaaS analytics vendor, you have just inherited a compliance problem you don’t control, and an 18-month clock to fix it. The full set of Data Fiduciary obligations becomes mandatory on 13 May 2027.

What are the DPDP Rules 2025 and when do they take effect?

The DPDP Act received Presidential assent in August 2023 but sat dormant without implementing rules, until MeitY notified the DPDP Rules, 2025 through Gazette notifications G.S.R. 843(E) to 846(E) in November 2025. The Rules operationalize the Act on a phased timeline.

Two things make this timeline less generous than it looks. First, the Data Protection Board exists now: it can receive complaints, issue notices and direct corrective measures before the penalty provisions fully bite. Second, the obligations arriving in May 2027 are not policy exercises. They require working technical capabilities: consent capture tied to actual data flows, per-user data export and deletion.

Eighteen months is a realistic runway for re-architecting a data stack. It is a very short runway for discovering in month fourteen that your analytics vendor cannot support what the law requires.

What the Rules require from Data Fiduciaries

If your organization decides why and how personal data is processed, and if you run an app or website used by people in India, you do: you are a Data Fiduciary. The Act also applies extraterritorially: a company outside India offering goods or services to Indian users is covered, no local entity required.

• Itemized notice and consent. Notices must be plain-language and itemized: what is collected, why, how long it is kept, how to exercise rights. Consent must be free, specific, informed, unconditional and given by clear affirmative action.
• Data Principal rights. Access, correction, erasure, withdrawal of consent as easily as it was given, nomination, and grievance resolution within defined timelines.
• Purpose-based retention and erasure. Data must be deleted once its purpose is served. Large platforms in the Third Schedule must erase personal data within three years of a user’s last interaction, with at least 48 hours’ notice.
• Breach response. Inform users and the Board without delay, then file a detailed report within 72 hours. Failure to notify carries penalties up to ₹200 crore; failure to maintain reasonable safeguards, up to ₹250 crore.
• Security safeguards and logging. Encryption, access controls and monitoring are mandatory, and logs supporting breach detection must be retained for at least one year.
• Children’s data. Verifiable parental consent is required, and behavioral monitoring and targeted advertising directed at children are prohibited: not consent-gated, prohibited.
• Significant Data Fiduciary duties. An India-resident DPO, annual impact assessments, annual independent audits, algorithmic due diligence, and potential localization for specified categories of data.

Read that list once as a lawyer and it is a governance program. Read it again as a product engineer and it is a systems requirement document: one that your analytics infrastructure either satisfies or fails.

Why third-party analytics is the hidden risk

Here is the uncomfortable accounting exercise most readiness assessments postpone: list every system that holds personal data about your Indian users, then mark the ones you don’t control. For a typical digital product, the largest uncontrolled repository is the analytics stack.

Tools like Google Analytics, Mixpanel or Amplitude ingest device identifiers, behavioral event streams, location signals and user properties (all personal data under the Act) and store them on infrastructure you cannot inspect, in jurisdictions you did not choose, governed by subprocessor chains you have never audited.

None of that outsourcing transfers responsibility. The Data Fiduciary remains fully accountable for processing performed by its Data Processors, wherever they sit. When your vendor has an incident, it is your 72-hour reporting obligation, your user notification duty and your exposure to the penalty schedule, triggered by an event you learn about on the vendor’s timeline, with whatever detail the vendor chooses to share.

There is a second structural problem. India’s cross-border regime currently operates on a negative list (transfers are permitted except to restricted countries) which sounds permissive. But the architecture is deliberately flexible: the government can restrict destinations at any time, and Significant Data Fiduciaries can be required to keep specified categories of personal data, and the associated traffic data, inside India. Unlike the GDPR there are no standard contractual clauses or adequacy decisions to fall back on.

A data control gap is a compliance gap. You cannot give guarantees about data you do not hold.

How data ownership changes the equation

72-hour breach reporting: you cannot report what you cannot see

With a multi-tenant vendor, your users’ behavioral data is part of someone else’s breach surface. You depend on them to detect the incident, decide it is reportable, determine whether your tenant was affected, and tell you, and the clock does not pause while you wait. Self-hosted, your analytics data lives in one store inside your own perimeter: your SIEM monitors it, your incident response team investigates it, your access logs reconstruct what happened.

Itemized notices and granular consent

An itemized notice must state precisely what is collected and why. That is straightforward when the pipeline is yours end to end, and genuinely hard when a vendor’s subprocessor list changes by addendum. Countly’s Compliance Hub captures consent per feature (a user can permit session analytics but decline crash reporting) and the SDKs enforce it at the point of collection: no consent, no data leaves the device. Every grant and withdrawal is logged with a timestamp.

Access, correction and erasure as workflows, not projects

With third-party analytics, a rights request means filing a support ticket and hoping the deletion propagates through backups and downstream systems, which is nearly impossible to verify from outside. In Countly it is an operation on your own database: locate a user’s complete data trail, export it, purge it, and confirm the deletion at the storage layer.

Retention timelines and the three-year deletion rule

This is the difference between negotiating retention with a vendor’s product limitations and configuring it. Self-hosted, retention is set at the database level: schedules per data type, automated expiry, and the configuration itself as audit evidence. “Our retention policy is a setting we control, here is the config and the deletion logs” is an answer regulators accept. “Our vendor’s default is 25 months and we have asked about exceptions” is not.

Children’s data: a prohibition you can technically enforce

Because consent gating happens in the SDK, before transmission, you can build flows where child accounts never generate behavioral events at all. The data is not collected and discarded; it is never collected. That is the kind of enforcement that survives an impact assessment.

Audits and impact assessments on an inspectable stack

An auditor can walk a self-hosted deployment end to end: infrastructure, encryption at rest and in transit, access controls, consent records, retention jobs, deletion logs, because all of it sits inside your environment. Obtaining that depth of inspection over a multi-tenant platform shared with ten thousand other customers is another matter.

Are you a Significant Data Fiduciary?

The government will designate SDFs based on the volume and sensitivity of data processed, risk to Data Principals, and potential impact on sovereignty and security. If you operate a large consumer platform in India (fintech, health, gaming, e-commerce, media), plan on the assumption that designation is plausible.

For your architecture, SDF status changes three things. Annual audits and assessments make your processing infrastructure a permanently inspected asset. Algorithmic due diligence extends scrutiny to how you use behavioral data in models and personalization. And most consequentially, SDFs can be required to keep specified personal data, and its traffic data, within India.

If that requirement lands on a company whose analytics history lives in a US-region tenant, the remediation is a forced migration under regulatory pressure. If it lands on a company already running on Indian infrastructure (its own data center, or an Indian cloud region), the remediation is a memo. Data residency stops being a roadmap item and becomes a deployment parameter.

An 18-month roadmap for product teams

Months 0-6: map and decide. Inventory every SDK, pixel and server-side integration that emits user data, and trace where each stream lands: vendor, jurisdiction, subprocessors, retention defaults. Then decide which systems can meet the May 2027 obligations as deployed and which need replacing. Migrations started in month twelve finish badly.

Months 6-12: implement core controls. Deploy your consent architecture and wire it to actual collection: consent that does not gate the SDKs is theater. Stand up self-hosted analytics in your target environment and run it in parallel with legacy tools. Rewrite notices to the itemized standard, which is dramatically easier once you know your own data flows.

Months 12-18: automate and prove. Build and test the rights workflows at realistic volume. Run breach simulations against the 72-hour standard, including the scenario where the incident touches analytics data. Conduct your first impact assessment and a dry-run audit. Decommission the legacy pipelines: data you have stopped sending offshore is risk you have permanently retired.

Does the Act apply to foreign companies?

Yes. It applies to processing outside India connected to offering goods or services to individuals in India. A company in Berlin or a studio in Singapore with Indian users is in scope.

Do I need consent to run product analytics in India?

In practice, yes. There is no GDPR-style legitimate-interest basis, and analytics does not fall under the enumerated legitimate uses. Treat behavioral analytics on Indian users as consent-gated, which makes SDK-level enforcement, not banner-level, the safe architecture.

Does the Act require data localization?

Not generally: transfers operate on a negative-list model. But Significant Data Fiduciaries can be required to keep specified data and traffic data within India, and the restricted-country list can change at any time. Hosting analytics in India eliminates the exposure.

What are the penalties?

Up to ₹250 crore per violation for failing to maintain reasonable security safeguards, and up to ₹200 crore for breach-notification failures, with the Board calibrating penalties to gravity, duration and repeat behavior.

Own your data, and the Rules get smaller

Strip away the legal vocabulary and the DPDP Rules ask one question of every digital business in India: do you actually control the personal data you collect? For companies whose behavioral data lives in offshore SaaS, every obligation is mediated by a vendor relationship. For companies that own their analytics infrastructure, each one collapses into something a regulator respects: a setting, a log, a workflow you can demonstrate.