Vibe Coding India: DPDP Act Data Security for Founders

The Digital Personal Data Protection Act, 2023 is India's general data protection statute. It applies to digital personal data processed inside India, and also to processing outside India when it is connected to offering goods or services to people in India (section 3). A founder in Bengaluru running a Supabase project and a founder abroad selling to Indian users are both in scope.

Two exclusions matter to small builders. The Act does not apply to personal data an individual processes for purely personal or domestic purposes, and it does not apply to data that the person themselves made public. A side project that stores your own contacts is out. A product that stores other people's data is in.

The Act is short and readable. The government published it in the Gazette on 11 August 2023, and you can read the full text on the MeitY site. Reading sections 4 to 9 once is worth more than any summary, including this one.

A data fiduciary is any person who, alone or with others, decides the purpose and means of processing personal data. If you decided that your app collects a phone number to send order updates, you decided the purpose and the means. That makes you the fiduciary, whether you are a company, a firm or a sole founder.

A data processor is a person who processes personal data on behalf of a fiduciary. Your database host, your email sender, your analytics tool and your AI provider are typically processors for the data you send them. The Act says you may engage a processor only under a valid contract, and that you stay responsible for compliance even for processing done on your behalf (section 8).

The practical consequence: you cannot point at Supabase, Firebase or an AI API and say the vendor is responsible. The vendor's security is an input to your compliance, not a substitute for it.

The Act defines personal data as any data about an individual who is identifiable by or in relation to that data. That is deliberately wide. An email address, a phone number, a device identifier tied to a user account, a delivery address, a chat transcript and an uploaded prescription photo all qualify.

The Act does not create a separate, stricter tier for health or financial data the way some other laws do. That does not make sensitive data casual. The security duty is scaled by reasonableness, and a hospital customer or a regulator will judge what is reasonable for a prescription scan differently from a newsletter email. Also watch what you paste into prompts, logs and error trackers: personal data copied into an AI chat or a log line is still personal data you are processing.

Personal data can be processed for a lawful purpose with the person's consent, or for certain legitimate uses listed in the Act (section 4). For consent, a request must be accompanied or preceded by a notice that tells the person what data is being collected and why, how to exercise their rights, and how to complain to the Data Protection Board (section 5).

The Rules add detail. The notice must be understandable on its own, in clear and plain language, with an itemized description of the personal data and the specific purposes, and it must tell people how to withdraw consent and contact you (Rule 3). A vague line such as "we collect data to improve your experience" does not fit that description.

Build this into the product, not just the privacy page. Each form that collects data should say what it collects and for what, consent should not be bundled with things the user did not agree to, and withdrawing consent should be as easy as giving it. When consent is withdrawn, or once the purpose is served, the Act expects you to erase the data and to make your processors erase it too, unless a law requires you to retain it (section 8(7)).

Section 8(5) requires a fiduciary to protect personal data in its possession or under its control, including data handled by its processors, by taking reasonable security safeguards to prevent a personal data breach. Rule 6 lists what those safeguards include at a minimum: measures such as encryption, masking or tokenization; controls on access to the computer resources involved; logs and monitoring that let you detect and investigate unauthorized access; backups or similar measures so processing can continue after a compromise; retention of those logs and personal data for one year unless another law says otherwise; security terms in your contracts with processors; and appropriate technical and organizational measures overall.

For a vibe-coded app, this list is uncomfortably concrete. Row Level Security is your access control on Supabase. Firebase Security Rules play the same role. If those are missing, the AI-generated app can work perfectly in the browser while any visitor can read the table. In 2025, CVE-2025-48757 recorded a class of exactly this problem, missing Row Level Security in Lovable-generated Supabase projects, and a researcher's public scan reportedly flagged 170 of 1,645 showcased projects. That is a reported finding via secondary coverage, but the class of mistake is real and it is your access-control duty that fails when it happens.

The Act's schedule ties the highest penalty to this duty: a failure to take reasonable security safeguards may attract a penalty that can extend to two hundred and fifty crore rupees. That is a ceiling, not a prediction, and any actual penalty is decided by the Board after an inquiry. It does show which duty the legislature weighs most heavily.

A personal data breach, under the Act, is any unauthorized processing or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access that compromises the confidentiality, integrity or availability of personal data. Note that it includes availability. Losing the only copy of user data is a breach even if nobody stole it.

Section 8(6) requires you to inform the Data Protection Board and each affected person. Rule 7 sets the shape: tell affected people without delay, in plain language, what happened, the likely consequences, what you are doing and what they can do, with a contact person. Tell the Board without delay with a description, then give more detail within seventy-two hours of becoming aware, or a longer period if the Board allows it on written request.

You cannot do this on the day if you have never planned it. Decide now who declares an incident, where your logs live, how you would list affected users from your database, and how you would contact them. A separate regime, the CERT-In directions under the IT Act, also has its own reporting clock, which the companion post on security questionnaires covers.

Under the Act, a child is anyone under eighteen. Before processing a child's personal data you must obtain verifiable consent of a parent or lawful guardian (section 9). You must not process data in ways likely to harm a child's well-being, and you must not track or behaviorally monitor children or target advertising at them, subject to exemptions the government may prescribe.

Rule 10 requires technical and organizational measures to obtain that verifiable parental consent, including due diligence that the person claiming to be the parent is an adult, checked against reliable identity and age details. This hits vibe-coded apps hardest in education, games, social and health tools. If under-18s might sign up, either design for parental consent from day one or take a deliberate, documented decision to restrict the audience, and do not rely on a date-of-birth field nobody checks.

MeitY notified the Digital Personal Data Protection Rules, 2025 as G.S.R. 846(E) dated 13 November 2025. Per the Rules' own commencement clause, Rules 1, 2 and 17 to 21 took effect on publication, Rule 4 (Consent Managers) comes into force one year after publication, and Rules 3, 5 to 16, 22 and 23 come into force eighteen months after publication. Rules 3, 6, 7 and 10 discussed above are in that last group.

Reports say MeitY has discussed shortening the eighteen-month period, but I could not confirm any amendment from an official notification, so treat the eighteen-month structure as what the published Rules say and check the current Gazette notification and the MeitY site before you rely on a date. The Act's own sections were brought into force through separate notification, so check that as well.

Use this table as a working checklist. Each row is a question a customer, an investor or the Board could ask, with the place in your app where the answer lives.