Privacy and compliance: GDPR, India's DPDP Act

The interviewer asks: "A user asks you to delete their data. What happens? What if the database leaks?"

A weak answer is "we encrypt everything". A strong answer says what you keep, why, and for how long. It says how a deletion reaches every copy, and who you tell about a leak. This is not legal advice.

A fair tailor keeps only the measurements the clothes need. The tailor destroys the notes when the job ends and tells you if they are lost. Privacy laws ask software to act like this tailor.

Personal data is any fact about a person who can be identified from it, such as a name, a phone number or a location. Two laws come up:

• GDPR is the European Union's General Data Protection Regulation. It also covers a company outside the European Union that offers goods or services to people in it.
• The DPDP Act is India's Digital Personal Data Protection Act, 2023, for digital personal data. Most of its duties start 18 months after the DPDP Rules 2025 were published in November 2025, which is about May 2027.

The company that decides why and how data is used is a controller (GDPR) or Data Fiduciary (DPDP). A company that works for it, such as an SMS provider, is a processor (GDPR) or Data Processor. The person is the data subject or Data Principal.

Both laws ask for much the same:

1. A clear purpose, and usually consent. Consent is a free, specific, informed and clear yes. Withdrawing it is as easy as giving it.
2. Only the data you need.
3. Delete when done. Delete when the purpose ends or consent is withdrawn, unless a law says to keep the data. Users can also ask to see, correct or delete their data.
4. Safe storage. Use logins, permissions and encryption (lessons 99, 101 and 102).
5. Tell people about a leak. A personal data breach is loss of personal data or access to it by the wrong people. GDPR: tell the data protection authority (the government office that enforces the law) within 72 hours, unless the breach is unlikely to harm people. DPDP: tell the Data Protection Board of India (the Board) and each affected person, with details to the Board within 72 hours.

Engineers build a list of where personal data lives and a retention time for each field. They build a delete flow that reaches every copy, and a breach plan. A backup cannot be edited, so a copy stays until the backup expires. This is a design practice, not a legal rule.

Assumption: a nightly job updates search and analytics.

Delete flow. A phone number sits in 5 places. Main database: deleted at once. Search and analytics: gone within 24 hours. SMS provider: one delete call. Backups: one made just before the deletion still holds it, so the last copy goes after 35 days. This answers the predict box.

Breach clock. A leak is found on Monday at 10:00. 72 hours = 3 days, so details are due Thursday at 10:00.

Fine ceilings. GDPR has two tiers. Security and breach reports: up to EUR 10 million or 2% of worldwide yearly turnover. Basic principles and user rights: up to EUR 20 million or 4%. The higher amount of each pair applies. Turnover is the money a company earns in a year. Assumption: turnover is EUR 1,000 million. Upper tier: 4% x 1,000 = EUR 40 million, more than 20, so the ceiling is EUR 40 million. DPDP: up to Rs 250 crore for weak security. 1 crore = 10 million, so that is Rs 2,500 million.

Privacy rules solve misuse of data. They cost work and less analytics data. I would change a rule only after a lawyer agrees.

"We are an Indian company, so GDPR does not apply." It applies when you offer goods or services to people in the European Union.

"We encrypt the data, so we comply." Encryption is one safeguard. The laws also ask for a purpose, consent, deletion and leak reports.

1. In GDPR, who is the controller? Who is the data subject? What are they called in the DPDP Act?
2. A leak is found on Friday at 18:00. When are the 72 hours over? A company has a turnover of EUR 600 million. What is its GDPR ceiling in the upper tier (4%)?
3. A team keeps every customer's location history forever, "in case it is useful". What do you change?