The DPDP Act 2023: what it means for your citizen app
If your department runs an app or portal that collects citizen data, the DPDP Act now sets real rules for how you must handle it.
· 2 min read · For government departments running citizen-facing apps
The Digital Personal Data Protection Act, 2023 is now backed by rules notified in late 2025, which means it is no longer a future compliance item — it applies to any app or portal your department runs that collects a citizen's name, phone number, address, Aadhaar or other personal data. Most departments already collect this. The question is whether the app was built with these rules in mind.
What the Act actually asks of you
- Collect only the personal data you genuinely need for the service, not everything a form could ask.
- Tell the citizen clearly, in plain language, what you are collecting it for.
- Get real consent for anything beyond providing the service itself — not a buried checkbox.
- Keep the data secure, and be able to say who accessed it and when.
- Delete or stop holding data once it is no longer needed for the purpose it was collected for.
Where citizen apps usually fall short
The common gaps are not exotic: forms that collect more fields than the service needs, no clear notice on what data is used for, no record of who inside the department has accessed a citizen's file, and no process for deleting old records. None of these need new technology to fix — they need the app and its data flow reviewed against the Act, and fixed where it falls short.
What it costs you
A proper review of one citizen-facing app — its forms, its data storage, its access logs — usually takes a few weeks, not months. Fixing gaps found in the review is often a smaller job than the review itself, especially if it is done before a complaint or audit forces the pace.
Questions to ask any vendor
- Can you show, field by field, why each piece of data collected is necessary?
- Is there a clear, readable notice shown to the citizen before they submit data?
- Is there a log of who accessed a citizen's record, and when?
- What is the process for deleting data once it is no longer needed?
How we can help
We review citizen-facing apps against the DPDP Act and fix the gaps, and where a department needs to search or manage citizen files securely, we set that up with Kaappu, built to keep department data in the department's own control. See Kaappu, or talk to us to get a review of your app.
