The Digital Personal Data Protection Act, 2023 (DPDP) is now the law of the land for processing personal data in India. Most engineering teams I know have read the headlines but not the obligations. Here are the four that materially change how a cold-chain app is built.
Consent must be granular
A blanket "I agree to terms" is not enough. Cold Konnect now asks separately for permission to use phone number for OTP, for marketing, and for partner data sharing.
Erasure rights have teeth
Users can ask for their data to be deleted, and the timeline is 30 days. We engineered this from day one — every personal record has a lineage table, deletion cascades.
