# India DPDP Act compliance rollout

> Live situation record from CLSTR: https://clstr.news/situations/india-dpdp-act-compliance-rollout
> Updated: 2026-08-17T22:15:14.000Z. Sources: 13. Developments: 3.

Following the enforcement of the Digital Personal Data Protection (DPDP) Act and its 2025 rules, Indian businesses across sectors are adapting their practices to meet new fiduciary obligations.

The hospitality industry is revising contracts after an 18‑month compliance window, treating hotels as “Data Fiduciaries” and, for larger operators, as “Significant Data Fiduciaries.” This requires robust privacy clauses, stricter handling of guest and employee data, and ensuring that franchise partners, travel agencies, payment gateways and IT providers comply with the law. This shift mirrors the EU GDPR, requiring management of personal data for multiple stakeholders and addressing cross‑border data transfers and legacy records digitisation.

Simultaneously, digital finance platforms offering instant personal loans are implementing DPDP‑driven safeguards. Apps must limit data collection to essential identity‑verification information, prohibit access to contacts or photo galleries, provide granular consent options, and use end‑to‑end encryption. The Reserve Bank of India oversees compliance for licensed lenders, differentiating them from unregulated shadow lenders.

In the social media sector, the regulatory framework is prompting new technical trials. Meta is currently testing privacy-protective age-confirmation methods on WhatsApp to help the platform distinguish between adults and children. While the law does not explicitly mandate collecting dates of birth, draft implementation rules suggest that social media platforms may eventually need to utilize India’s Aadhaar-linked biometric identity infrastructure for more reliable age assurance. Non-compliance with the DPDP Act carries significant penalties, which can reach ₹250 crore.

## Timeline

### 2026-08-17: India’s DPDP Act prompts Meta to test WhatsApp age verification

India’s DPDP Act is establishing a new data protection framework, prompting Meta to test age-verification methods on WhatsApp to comply with upcoming digital privacy and identity regulations.

2 sources. https://clstr.news/cluster/indias-dpdp-act-prompts-meta-to-test-whatsapp-age-verification

### 2026-07-29: India's Personal Loan Apps Adopt DPDP Act‑Driven Data Privacy Measures

India's instant personal loan apps now embed DPDP Act privacy rules, limiting data collection, banning contact access, and using encryption, while offering quick digital credit via mobile platforms.

8 sources. https://clstr.news/cluster/indias-personal-loan-apps-adopt-dpdp-actdriven-data-privacy-measures

### 2026-07-28: India's Data Protection Law Pushes Hotels to Revise Contracts

India's DPDP Act forces hotels to update contracts with new data‑privacy clauses, treating them as Data Fiduciaries and imposing GDPR‑like obligations within an 18‑month window.

3 sources. https://clstr.news/cluster/indias-data-protection-law-pushes-hotels-to-revise-contracts

---
Cite as: India DPDP Act compliance rollout. CLSTR, https://clstr.news/situations/india-dpdp-act-compliance-rollout