Where should our app's data live, and what does DPDP mean for US?
Choosing where data is hosted, what you collect, how people consent and delete are design decisions you make before launch. What India's DPDP rules reportedly require and when, what the App Store already requires, and what we built in. Not legal advice.
- Collect the least personal data you can. What you never collect, you never have to protect or delete.
- Hosting location is a decision to make and write down, not a default to accept.
- In-app account deletion is already an App Store requirement, not a future one.
- India's DPDP Rules 2025 were notified on 13 November 2025 and phase in over about 12 to 18 months (13 November 2026 and 13 May 2027, as reported).
- Be wary of any vendor that says 'DPDP compliant'. Compliance belongs to your organisation, with legal advice.
Quick answer
Decide three things before launch: what personal data you collect (collect less), where it is hosted, and how a person can consent and delete their account inside the app. Apple already requires in-app account deletion for apps with sign-up. India's DPDP Rules 2025 phase in over roughly 12 to 18 months: consent managers from 13 November 2026, core obligations from 13 May 2027, as reported. Ask a lawyer what applies to you. A vendor should never call a build 'compliant' on its own say-so.
This page is not legal advice. We are a software firm, not a law firm.
The short answer
Privacy and compliance work is cheapest when it is a design decision, not a retrofit. Three decisions do most of it: what you collect, where it lives, and how a person takes control of it.
Why buyers ask this
You are about to hold other people’s personal data, and the rules are new and moving. The CEO’s worry is penalty and reputation. The engineer’s worry is what to build and where to put it. Both want the same thing: a short list of decisions to make now.
What good looks like: the decision list
- Collect less. List every personal data field you plan to hold and the reason for each. Remove the ones with no reason. Data you never collect needs no protection, no deletion and no explanation.
- Choose the hosting location on purpose. Write down where it is, who the provider is, and why. Whether you are legally required to keep data in a given country depends on your sector and contracts. Ask counsel.
- Capture consent per purpose. Don’t bundle everything into one “I agree”. Store what each person agreed to, and when.
- Build account deletion into the app. A support email is not a deletion flow.
- Enforce access in the database, so a user can only reach their own records, whichever client they use. See the architecture pattern.
- Name who answers privacy questions in your organisation, and put a contact in the app.
- Write the policy after the design, not before, so it describes what the system does.
What the App Store already requires
Apple’s App Review Guideline 5.1.1(v) says apps that support account creation must let people initiate deletion of their account within the app. Offering only temporary deactivation is not sufficient. This applies to iOS submissions today. See Apple’s guideline.
What DPDP reportedly requires, and when
India’s DPDP Rules 2025 were notified on 13 November 2025. Law-firm summaries describe a phased start over roughly 12 to 18 months: consent-manager provisions from 13 November 2026 (12 months), and the core obligations (notice, consent, security safeguards, children’s data) from 13 May 2027 (18 months). See S.S. Rana & Co.’s summary. These are reports of the rules. Check the official notification and ask counsel for the exact dates and what applies to you.
What we built in
A clinic-queue platform, built and tested on a demo clinic ahead of launch. It has not been through a legal review and is not certified by anyone. We do not call it compliant.
On the clinic-queue platform we built, consent capture and in-app account deletion are part of the design. The stack is hosted in Mumbai and designed around India’s DPDP Act. Every table has row-level security, so each role can only touch its own rows. The first release was scoped so that it collects only what the booking and queue need, and it leaves out the payments and messaging channels that would have brought more data with them.
What this does not show. It shows decisions made early. It does not show that the platform satisfies the DPDP Act, and nobody has audited it for that. Compliance also covers policies, training and processes that software can’t supply.
Where this doesn’t apply
If your app holds no personal data, most of this list shrinks to a privacy line in the footer. If you operate in regulated sectors, such as health, finance or children’s services, you may have extra rules on top, and this page does not cover them. And if you sell to customers outside India, other laws apply. Take legal advice for your case.
Questions to ask any vendor, including us
- Which personal data fields does the first release collect, and why each one?
- Where is the data hosted, with which provider, and why there?
- How does a person delete their account inside the app, and what happens to their records?
- How is consent captured and stored, and for which purposes?
- Do you ever describe your work as “compliant”? On what basis? (If the answer is “our own say-so”, be careful.)
Next: what should go in version 1 and one backend for the app and the web. Part of the guide Buying custom software and hiring a tech vendor.
Apple’s guideline text was opened on 9 October 2026. The DPDP dates come from a law-firm summary of Gazette notification G.S.R. 846(E) (S.S. Rana & Co.), cross-checked against a second summary (BDO India, 17 November 2025). We have not read the Gazette text ourselves, so we say “as reported”. Our own build facts come from our clinic-platform brief and are tracked in our claim ledger. The decision list is our method. We hold no audit or certification for any build.
More by GarunaCDX
Let's talk about your build.
Tell us what you are building. A founding engineer replies within one working day with how we would approach it.
