If your software collects personal data of people in India, the Digital Personal Data Protection Act 2023 (DPDP Act) applies. In Australia, the Privacy Act 1988 and its Australian Privacy Principles apply to most mid-size and larger businesses and some smaller ones. Both expect the software to support consent or notice, access requests, security, retention limits and breach response.
This article explains both laws in practical, software-shaped terms. It is general information, not legal advice: get a lawyer to confirm how the rules apply to your business before you rely on them.
Why does privacy law matter when you're building software?
Privacy obligations are much cheaper to build in than to retrofit. If the database was never designed to record consent, or to find and delete one person's records across every table, adding that later can mean reworking large parts of the system.
Custom software also gives you an advantage here. Off-the-shelf tools force you into their data model; a custom build can be designed around exactly what the law and your customers expect. Treat privacy as a discovery-stage topic alongside the other planning decisions in our 2026 guide to building custom software.
What does India's DPDP Act require?
The DPDP Act governs digital personal data, meaning data collected online or digitised later. It applies to processing in India and to processing outside India when it relates to offering goods or services to people in India. Unlike Australia's law, it has no general small-business exemption based on turnover.
The key ideas, in plain terms:
- Data Principal: the person the data is about.
- Data Fiduciary: the business that decides why and how data is processed, which is usually you, the software owner.
- Data Processor: anyone processing data on your behalf, such as your hosting provider, CRM vendor or development agency.
- Consent: must be free, specific, informed and given by a clear affirmative action, with a notice explaining what you collect and why. Withdrawing consent should be as easy as giving it. The Act also allows certain "legitimate uses" without consent.
- Rights: people can ask for information about their data, request correction and erasure, use a grievance process, and nominate someone to act for them.
- Children: processing data of anyone under 18 generally needs verifiable parental consent, and tracking or targeted advertising aimed at children is restricted.
- Breaches: personal data breaches must be reported to the Data Protection Board of India and to affected people.
- Retention: data should be erased once its purpose is served or consent is withdrawn, unless another law requires you to keep it.
Some businesses may be designated Significant Data Fiduciaries and face extra duties such as appointing a data protection officer and running audits. The Act's rules are being brought into operation in stages, so confirm current deadlines with your adviser. Penalties for serious failures can be substantial.
What does Australia's Privacy Act require?
The Privacy Act 1988 sets out 13 Australian Privacy Principles (APPs) covering how personal information is collected, used, disclosed, secured, accessed and corrected. It is overseen by the Office of the Australian Information Commissioner (OAIC).
It applies to Australian Government agencies and to organisations with annual turnover above A$3 million. Some smaller businesses are covered regardless of turnover, including health service providers and businesses that trade in personal information. If you run a clinic, allied-health practice or similar service in Australia, assume the Act applies to you.
For software, the most relevant expectations are:
- Open and transparent handling: a clear, current privacy policy and collection notices.
- Collect only what you need, by fair means, and tell people why.
- Use and disclose information only for the purpose it was collected, or a related purpose people would reasonably expect.
- Take reasonable steps to secure it, and destroy or de-identify it when no longer needed.
- Give people access to their information and let them correct it.
- Take care with overseas disclosure: if you send personal information offshore, you generally need reasonable steps to ensure the recipient handles it consistently with the APPs, and you can remain accountable for their mistakes.
- Notifiable Data Breaches scheme: eligible breaches likely to cause serious harm must be reported to the OAIC and affected individuals.
Amendments passed in late 2024 added a statutory tort for serious invasions of privacy and new transparency requirements for automated decisions that use personal information, and further reform has been proposed. Keep an eye on OAIC guidance.
How do the two laws compare?
| Topic | India: DPDP Act 2023 | Australia: Privacy Act 1988 |
|---|---|---|
| Who it covers | Anyone processing digital personal data in India, or offshore when serving people in India | Government agencies, organisations over A$3m turnover, plus some smaller ones (e.g. health providers) |
| Main legal basis | Consent with notice, or specified legitimate uses | Collection must be reasonably necessary; use limited to the primary or expected purposes |
| Individual rights | Information, correction, erasure, grievance, nomination | Access and correction |
| Breach reporting | To the Data Protection Board and affected people | Eligible breaches to the OAIC and affected individuals |
| Overseas data | Allowed except to countries the government restricts | Allowed with reasonable steps; sender can stay accountable |
| Children | Verifiable parental consent under 18 | General principles apply; further child-specific rules in development |
| Regulator | Data Protection Board of India | OAIC |
What features should privacy-ready software include?
Translate the law into a feature list, and put that list in the requirements document. For a system handling customer or patient data in either country, the essentials are:
- Consent and notice records. Store what each person agreed to, when, and which version of the notice they saw. Make withdrawal a button, not an email chain.
- Purpose tags on data. Know why each category of data was collected so it is not quietly reused for something else.
- Data minimisation in forms. Every field should earn its place. Date of birth, ID numbers and addresses are liabilities if you do not need them.
- A searchable "person view". One place to find everything held about an individual, so access, correction and erasure requests take minutes rather than days.
- Retention rules. Automatic deletion or anonymisation after a set period, with exceptions for records you must legally keep, such as tax documents.
- Role-based access and audit logs. Staff see only what they need, and every export or bulk view is logged.
- Breach detection and response. Alerts on unusual access, plus a written plan for investigating and notifying.
- A processor register. A list of every third party that touches personal data: hosting, email, SMS, analytics, AI services. Each needs an appropriate contract.
Security underpins all of this; our software security basics checklist lists what to ask your developer.
What about AI features and offshore development teams?
Two situations deserve special care.
AI features. If your software sends personal data to an AI model provider, that provider becomes a processor and possibly an overseas recipient. Check where data is processed, whether it is retained or used for training, and whether you can switch that off. Our checklist on AI automation and data privacy questions to ask covers this in detail.
Offshore development and support. An Australian business working with a development team in India, or an Indian business using overseas cloud services, is disclosing or transferring data across borders whenever developers can see production data. Practical safeguards include giving developers anonymised or synthetic test data instead of real records, restricting production access to named people, logging that access, and writing data-handling clauses into the contract.
What should you do with existing data when you rebuild?
Treat a migration as a privacy clean-up opportunity. Before moving records into a new system, decide what you no longer need and delete it, confirm you still have a valid basis for what remains, and map where each field will live. Our guide to data migration without losing customer data explains the mechanics.
Frequently asked questions
Does the DPDP Act apply to an Australian business with Indian customers?
It can. The Act reaches processing outside India where it relates to offering goods or services to people in India. If you actively serve Indian customers, get advice on whether and how it applies to you.
My Australian business turns over less than A$3 million. Am I exempt?
Possibly, but not automatically. Health service providers, businesses that trade in personal information and some others are covered regardless of turnover, and contracts with larger clients often require APP-level handling anyway. Many small businesses choose to follow the APPs simply because customers expect it.
Can my developers in another country work on a live system?
Yes, with safeguards. Limit production access to named people, log it, use anonymised data for development and testing, and put data-handling obligations in the contract. Under Australian law you may remain accountable for how an overseas recipient handles the data.
Do I need a data protection officer?
Under the DPDP Act, this is an obligation for businesses designated as Significant Data Fiduciaries. Others are not required to appoint one but must still provide a contact for privacy questions and grievances. In Australia, naming a privacy officer is widely recommended good practice.
Is a privacy policy on the website enough?
No. The policy describes what you do; the software has to actually do it. Consent records, access requests, retention and breach response all need working features behind them.
Build privacy in from the first sprint
Designing for both laws at the outset costs far less than retrofitting after a complaint or a breach. Need a fixed-price scope that includes consent, retention and access-request features? Get in touch. You can also browse systems we've delivered on our work page.