Data, security and compliance: decisions to make before launch
What you collect, where it lives and how people consent and delete are design decisions. What the App Store already requires and what India's DPDP Rules reportedly require. Not legal advice.
- Collect less. Data you never hold needs no protection.
- Write down the hosting location and the reason.
- In-app account deletion is already an App Store requirement.
- DPDP Rules 2025: notified 13 November 2025, phased over about 18 months: consent managers from 13 November 2026, core obligations from 13 May 2027, as reported.
- Compliance belongs to your organisation, not to a vendor's deliverable.
Quick answer
Decide what personal data you collect, where it is hosted, and how people consent and delete their account in the app. Apple already requires in-app account deletion for apps with sign-up. India's DPDP Rules 2025 phase in over about 12 to 18 months (13 November 2026 and 13 May 2027, as reported). Never accept 'compliant' as a vendor's own claim. Ask a lawyer.
Not legal advice. We are a software firm.
The decisions
- What you collect. List each field and the reason. Cut the rest.
- Where it is hosted. Name the place and provider. Whether you must keep data in a given country depends on your sector and contracts, so ask counsel.
- How people consent. One purpose, one checkbox. Store what they agreed to and when.
- How they delete. Inside the app, not by emailing support.
- Who can see what. Enforce it in the database.
What the rules say
Apple’s App Review Guideline 5.1.1(v) requires apps that support account creation to let people initiate deletion within the app. India’s DPDP Rules 2025 were notified on 13 November 2025 and, per a law-firm summary, phase in over roughly 12 to 18 months. These are reports of the rules. Check the official text.
What we built in
On our clinic-queue platform, consent capture and in-app account deletion are built in, the stack is hosted in Mumbai, and the design is built around India’s DPDP Act. Every table has row-level security. The platform has not had a legal review, and we don’t call it compliant. Full list: where should app data live, and what does DPDP mean.
Regulated sectors and customers outside India bring other rules. This chapter does not cover them. Take legal advice for your case.
Next chapter: Rollout, adoption and handover.
More by GarunaCDX
Keep going with the next handbook.
Chapter-by-chapter guides from the engineers who build these systems for clients.
