If your startup collects names, phone numbers, addresses or payment details from customers in India or the UAE, two laws matter: India’s Digital Personal Data Protection Act 2023, usually called the DPDP Act, and the UAE’s federal Personal Data Protection Law, or PDPL. Both are in force on paper, and both are still being filled in with detailed rules and regulators. This guide sets out what each covers, what is already in effect, what is still being phased in as of October 2026, and the practical steps worth taking now.
India’s DPDP Act at a glance
Who it covers
The DPDP Act applies to digital personal data processed in India, and to processing outside India where it is connected to offering goods or services to people in India. The business that decides why and how data is processed is the data fiduciary. A vendor processing data on its behalf is a data processor, and the fiduciary stays responsible for what the processor does.
Core duties for a data fiduciary
- Give a clear notice and get consent for a specified purpose, unless one of the Act’s other lawful uses applies.
- Let people withdraw consent as easily as they gave it.
- Keep data accurate where it is used to make decisions about people.
- Protect data with reasonable security safeguards.
- Report personal data breaches to the Data Protection Board and to affected people.
- Erase data once the purpose is served, unless another law requires you to keep it.
- Get verifiable parental consent before processing data of children, meaning anyone under 18.
- Publish contact details for privacy questions and run a grievance process.
The DPDP Rules and the phased timeline
The government notified the Digital Personal Data Protection Rules in November 2025. According to the government’s explainer on the Rules, they come into force in stages over about 18 months:
- From November 2025: provisions setting up the Data Protection Board and its procedures.
- From November 2026: registration and obligations of consent managers.
- From May 2027: most business obligations, including notice and consent, security safeguards, breach reporting, data retention, children’s data, data principal rights and cross-border transfers.
In November 2025 the IT minister said the government was discussing a shorter compliance window with industry. As of October 2026 we have not found a notified change to the dates above, but check the current position before planning around them.
Details from the Rules worth knowing
- Breaches: inform the Board without delay and send a fuller report within 72 hours, and tell affected individuals in plain language.
- Rights requests: respond to requests to access, correct or erase data within 90 days.
- Retention: large e-commerce, social media and online gaming platforms must erase personal data three years after a user’s last interaction, with advance notice. All fiduciaries must keep certain processing logs for at least a year.
- Penalties: up to ₹250 crore for failing to take reasonable security safeguards, up to ₹200 crore for failures on breach notification or children’s data, and up to ₹50 crore for other breaches of the law.
The UAE PDPL at a glance
The UAE’s federal law is Federal Decree-Law No. 45 of 2021, which came into force on 2 January 2022. It covers processing of personal data of people in the UAE, by businesses inside the country and by some businesses outside it.
Main principles
- Processing generally needs the person’s consent, with exceptions such as performing a contract or meeting a legal obligation.
- People can access, correct, restrict and object to processing of their data.
- Controllers must keep data secure and report breaches that affect privacy or security to the regulator.
- Some controllers must appoint a data protection officer, for example where processing is high-risk or involves large volumes of sensitive data.
- Transfers outside the UAE are restricted to countries with adequate protection or to specific permitted cases.
What does not fall under it
Businesses in the DIFC and ADGM free zones follow their own data protection laws, and health and banking data are covered by sector-specific rules. If you operate from a free zone, check which regime applies to you first.
What is still pending
The executive regulations that set out details such as breach timelines, transfer mechanisms and penalties had not been issued as of mid-2026, according to a June 2026 Morgan Lewis update. The same update reports that the UAE announced a Federal Authority for Artificial Intelligence and Data in June 2026, bringing together several bodies including the data office, and that it is not yet clear how quickly the PDPL will be enforced. Under the law, businesses are due six months to comply once the regulations are issued. Treat the law as binding now and watch for the regulations.
What startups should do now
Most of the work is the same for both laws, so do it once.
- Map your data. List what personal data you collect, why, where it is stored, which vendors touch it and how long you keep it.
- Cut what you do not need. Every field you stop collecting is one less thing to protect and explain.
- Rewrite your privacy notice in plain language, organised by purpose.
- Build consent into your product: clear choices at sign-up, a way to withdraw, and records of what each person agreed to.
- Sign data processing agreements with vendors that handle personal data for you.
- Set up the basics of security: access control, two-factor login, encryption, logging, backups.
- Write a breach response plan with named people and the timelines that apply to you.
- Build a simple process for access, correction and deletion requests, and test it.
- If your users may include children, decide how you will verify age and parental consent, or whether to keep under-18s out.
Say a Gurugram edtech startup with students in India and Dubai does this mapping and finds it stores parents’ phone numbers in three tools and a shared spreadsheet. Consolidating to one system with access controls makes it far easier to honour a deletion request under either law.
Much of this is product and engineering work as much as legal work. Our SaaS and app builds include consent records, data export and deletion flows from the first version. Talk to us if you want to plan the product side, alongside advice from a privacy lawyer.
This is general information, not legal advice. Both laws are still being phased in, so confirm the current rules with a qualified lawyer.
Frequently asked questions
Does the DPDP Act apply to a small startup?
Yes. The Act does not exempt businesses by size, although the government can exempt certain classes of data fiduciaries, including startups, from some provisions by notification. Most obligations under the Rules apply from May 2027. Starting now with data mapping, consent and security is far easier than retrofitting them into a product later.
Does the UAE PDPL apply if my company is based in India?
It can. The PDPL reaches some controllers and processors outside the UAE when they process personal data of people in the UAE. If you sell to UAE customers, plan to meet its principles, and check whether your customers’ free zone or sector has its own rules. A lawyer familiar with UAE law can confirm your position.
Is consent always required to process personal data?
No. Both laws treat consent as the main basis but allow other grounds. The DPDP Act lists certain legitimate uses, such as data a person voluntarily provides for a specified purpose, and the UAE PDPL allows processing needed for a contract or legal obligation. Where you rely on consent, it must be clear, specific and easy to withdraw.