By Naraway
In this article
In 2021, Google, Facebook and Twitter rewrote their Indian websites within weeks to name officers based in India. The rule that forced them to applies, in a lighter form, to every app that lets Indian users post, message, match, buy or sell.
Since November 2025, a second law sits on top of it. The Digital Personal Data Protection Act is now being switched on in phases, and the last phase lands in May 2027.
Sources: IT Rules 2021; DPDP Act 2023 via BDO India.
Law One: The IT Rules 2021
In Indian law, an app that hosts or transmits what users create is an intermediary. A dating app, a marketplace, a messaging tool and a review site are all intermediaries, whatever they call themselves.
| Every intermediary | Above 50 lakh Indian users |
|---|---|
| Publish a grievance officer's name and contact, and how to complain | Chief compliance officer, resident in India |
| Acknowledge complaints in 24 hours, resolve in 15 days | Nodal contact person for law enforcement, resident in India |
| Publish rules and a privacy policy users must accept | Resident grievance officer, plus monthly compliance reports |
Source: Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021.
The protection that matters most, immunity from liability for what users post, depends on following these rules. An app that skips them is not only exposed to a fine. It can be held responsible for its users' content.
Law Two: The DPDP Act, Switching On in Phases
The Digital Personal Data Protection Rules were notified in November 2025, two years after the Act. The government chose an 18-month runway rather than a single start date:
| Phase | What applies |
|---|---|
| November 2025 | Data Protection Board set up and operational |
| Around November 2026 | Registration of consent managers, India-incorporated platforms with Rs 2 crore net worth |
| May 2027 | Full duties: notice and consent, security safeguards, breach reporting, children's data, cross-border rules |
Sources: PIB; YourStory; BDO India.
The Act applies to apps based outside India whenever they process personal data of people in India to offer them goods or services. Penalties are set by the Act, not the Rules, and reach Rs 250 crore per breach.
Where the Two Laws Meet
Both laws ask for a grievance channel, and both expect a reply on a clock. Both put duties on how user data is collected, kept and deleted. An app built for Europe's GDPR already does part of this, but not the India-specific parts: the officer, the timelines, the Indian consent formats and the rules for users under 18.
Why Apps Still Line Up for India
India has 1.11 billion internet subscribers and processed 24.07 billion UPI payments in September 2026. For Hinge, India is now the second-largest market by downloads and registrations, behind only the US. For most consumer apps, the question is not whether India is worth the compliance work. It is how early to build it in.
Which officers an app needs, what its privacy notice and consent flow must say in India, how complaints should be routed and logged, and what changes at 50 lakh users depend on the product and its user base. The requirements are short to list and long to build into a product that already exists.
Part of Naraway's research series India Market Entry in 2026.
In short
An app serving users in India is an intermediary under the IT Rules 2021. It must publish the name and contact of a grievance officer, acknowledge complaints within 24 hours and resolve them within 15 days; platforms with more than 50 lakh users also need a chief compliance officer, a nodal officer and a grievance officer resident in India. The Digital Personal Data Protection Act 2023, with rules notified in November 2025, adds consent, breach and children's-data duties in phases ending in May 2027, with penalties of up to Rs 250 crore per breach.
- Apps are intermediaries under the IT Rules 2021 and must name a grievance officer.
- Complaints: acknowledge within 24 hours, resolve within 15 days.
- Above 50 lakh Indian users, three officers resident in India are required.
- DPDP Rules were notified in November 2025; full compliance is due by May 2027.
- Penalties under the DPDP Act reach Rs 250 crore per breach.
Sources
- Govt notifies Digital Personal Data Protection Rules 2025; rollout stretched over 18 months, YourStory
- Digital Personal Data Protection Rules 2025: provisions, implementation plan, penalties, BDO India
- The role, obligations and liability of grievance officers under India's DPDP Act and DPDP Rules, 2025, Mondaq
- Information Technology Rules 2021, Journals of India
- PIB: Digital Personal Data Protection Rules, 2025, Press Information Bureau
Frequently Asked Questions
Does a foreign app need a grievance officer in India?
Yes. Under the IT Rules 2021, every intermediary serving Indian users must publish the name and contact details of a grievance officer and a complaint mechanism. Platforms with more than 50 lakh registered Indian users must also appoint a chief compliance officer, a nodal contact person and a resident grievance officer, all based in India.
How fast must an app respond to user complaints in India?
Acknowledge within 24 hours and dispose of the complaint within 15 days under the IT Rules 2021.
When does the DPDP Act fully apply?
The DPDP Rules were notified in November 2025 with phased compliance over 18 months. The Data Protection Board is already operational; most duties apply from May 2027.
What is the penalty under the DPDP Act?
Up to Rs 250 crore per breach, imposed by the Data Protection Board depending on the nature of the breach.
Does the DPDP Act apply to apps based outside India?
Yes, when they process personal data of people in India in connection with offering goods or services to them.
