What do India's DPDP Rules mean for the customer details my ordering website collects?
By the Menuthere editorial team · Last updated
The DPDP Rules were notified on 14 November 2025 with an 18-month phased timeline. They ask for a plain consent notice, prompt breach alerts, and answers to access or erasure requests within 90 days.
- The DPDP Act was enacted on 11 August 2023. The Rules add the detail and were notified on 14 November 2025.
- Consent must come in a standalone, plain notice that states the specific purpose.
- After a breach, you must tell affected people promptly, in plain language.
- Show the contact details of a designated officer or data protection officer.
- Requests to access, correct or erase data must be answered within 90 days. Ask an adviser how this applies to your restaurant.
Customer details in one place
On Menuthere, the customers who order are kept in your dashboard, so you know where their details are and who on your team can see them.
Next questions
Sources (1)
- PIB (Ministry of Electronics & IT): The DPDP Act was enacted on 11, PIB (Ministry of Electronics & IT), 14 Nov 2025