# Data Privacy on Gaming Apps in India: The DPDP Act

Source: https://cricketin.org/en/guides/data-privacy-on-gaming-apps

[By Farhan Qureshi](/en/authors/payments-expert), Payments Expert. [Reviewed by Rajeev Sathe](/en/authors/editor-in-chief), Editor-in-Chief. Updated 10 Nov 2026. Editorial policy: https://cricketin.org/en/editorial-policy

18+. Betting carries financial risk and can become addictive. Free helpline Tele-MANAS: 14416.

---

What the DPDP Act 2023 gives you and when each part starts, what gaming apps collect, how long data is kept, and how to ask for deletion.

India's Digital Personal Data Protection Act, 2023 gives you rights over your data: to see it, correct it and have it erased ([Act text, MeitY](https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf)). Most of those rights are not live yet. Sections 11 to 17 start on 13 May 2027, eighteen months after the notification of 13 November 2025 ([G.S.R. 843(E)](https://cadp.in/resources/official-texts/dpdp-notification-commencement-2025/)).

This guide gives the checked dates, shows what a gaming app collects beyond your documents, how long it may keep data and how to ask for deletion. The last section covers what you share when you use Cricketin.

## The DPDP Act, in one page

India's data law is the Digital Personal Data Protection Act, 2023, Act 22 of 2023 ([Act text, MeitY](https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf)).

It calls you the Data Principal and the firm that holds your data the Data Fiduciary. The word choice matters: a fiduciary is meant to hold something on your behalf.

The Act gives you four rights that matter here. You can ask what is held, get it corrected, ask for it to be erased and raise a complaint ([Sections 11 to 13](https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf)).

The right to see covers more than a copy. You can ask for a summary of your data and for the names of those it was shared with ([Section 11](https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf)).

The Act puts duties on you too: do not impersonate anyone, do not hide material facts, and do not file a false or frivolous complaint ([Section 15](https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf)).

## The dates, checked against the notification

Most of the Act is not live yet. That is the key fact on this page, and it is often reported wrongly.

The notification that starts the Act is G.S.R. 843(E), dated 13 November 2025 ([notification text](https://cadp.in/resources/official-texts/dpdp-notification-commencement-2025/)). It switches the Act on in three stages.

**Table 1. When each part of the DPDP Act starts working**

| Date | What starts | Why it matters to you |
|---|---|---|
| 13 November 2025 | Definitions, the Data Protection Board, rule-making powers | The regulator can be built; your rights are not live yet |
| 13 November 2026 | Consent manager provisions | A new type of intermediary for managing consent |
| 13 May 2027 | Sections 3 to 17, including all user rights, and Sections 28 to 34 | This is when you can actually demand access and erasure |

Until May 2027 the older rules apply. Section 43A of the IT Act and the SPDI Rules of 2011 stay in force until the eighteen-month clock ends, and Section 72A of the IT Act also stays ([Khaitan and Co](https://www.khaitanco.com/sites/default/files/2025-11/ERGO%20-%20Digital%20Personal%20%20Data%20Protection%20Rules%20-%2015%20November%202025.pdf)).

The Rules follow the same clock. Rules 3 and 5 to 16 of the DPDP Rules, 2025 apply after eighteen months ([Rules text, Rule 1](https://www.dpdpa.com/DPDP_Rules_2025_English_only.pdf)).

## The duties that land on platforms

Real duties arrive with the main sections. Four of them matter most.

- **Security.** The firm must take reasonable security safeguards to prevent a breach ([Section 8(5)](https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf)).
- **Breach notice.** It must tell each affected person without delay and give the Board a full report within seventy-two hours ([Rule 7, DPDP Rules 2025](https://www.dpdpa.com/DPDP_Rules_2025_English_only.pdf)).
- **A published route.** It must show clearly how you can use your rights ([Rule 14](https://www.dpdpa.com/DPDP_Rules_2025_English_only.pdf)).
- **A time limit on complaints.** The reply time must not exceed ninety days ([Rule 14](https://www.dpdpa.com/DPDP_Rules_2025_English_only.pdf)).

On paper the penalties are large. A failure to take reasonable security safeguards can cost up to ₹250 crore, and a failure to report a breach up to ₹200 crore ([Schedule to the Act](https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf)).

The scale is very different for users. Breaking your own duties under Section 15 can cost up to ₹10,000 ([Schedule](https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf)). The law is aimed at firms.

## What leaves your phone while you play

Documents are only part of it. Apps also send a stream of small facts about you.

Google Play keeps its own list of personal and sensitive user data. It covers payment and sign-in data, contacts and device location, SMS and call data, the microphone and the camera, and even the list of other apps on your phone ([Google Play User Data policy](https://support.google.com/googleplay/android-developer/answer/10144311?hl=en)).

Ads are a channel of their own. Play requires apps to use the advertising ID for ads, and you can reset or delete that ID in Android settings ([Google Play advertising ID policy](https://support.google.com/googleplay/android-developer/answer/6048248?hl=en)). Delete it, and an app that asks for it gets a string of zeros ([Google](https://support.google.com/googleplay/android-developer/answer/6048248?hl=en)).

Android itself gates the sensitive parts. App permissions guard data such as location and contacts, and actions such as recording sound ([Permissions on Android](https://developer.android.com/guide/topics/permissions/overview)). That gate only helps if you read the request.

## What store rules cover, and what they miss

Nearly every rule above is a Google Play rule, and that is where the gap opens.

Play requires a privacy policy in the listing and in the app, a completed Data safety section and clear consent before data is collected, and it bans the sale of personal and sensitive user data ([Google Play User Data policy](https://support.google.com/googleplay/android-developer/answer/10144311?hl=en)).

Play also requires a real way out. You must be able to delete your account in the app and on a web page; freezing an account is not enough ([Google Play](https://support.google.com/googleplay/android-developer/answer/10144311?hl=en)).

An app that never went through the store agreed to none of that. Google's own study found over fifty times more malware from internet-sideloaded sources than on Play ([Android Developers Blog](https://android-developers.googleblog.com/2025/08/elevating-android-security.html)). The guide to [sideloading risks](/en/guides/apk-sideloading-risks) works through what else goes missing.

The same care applies to documents. MeitY advises Aadhaar holders to use normal prudence when using and sharing their Aadhaar number ([MeitY clarification, PIB, 29 May 2022](https://www.pib.gov.in/PressReleasePage.aspx?PRID=1829162)). The guide to [KYC checks](/en/guides/kyc-in-online-gaming-india) covers what each document reveals.

## How long your data is kept

There is a rule on this, and it is narrower than most people think. "Delete my account" and "delete my data" are two different requests, and a closed account can sit on a server for years.

The Third Schedule of the DPDP Rules, 2025 names online gaming firms with fifty lakh or more registered users in India. Each must erase your data three years after your last contact, with two narrow carve-outs: one for account access and one for access to virtual tokens ([Rule 8 and Third Schedule](https://www.dpdpa.com/DPDP_Rules_2025_English_only.pdf)).

The rule only applies at that size, and three years is a ceiling, not a promise of a quick wipe. Logs and traffic data must also be kept for at least one year ([Rule 8(3)](https://www.dpdpa.com/DPDP_Rules_2025_English_only.pdf)).

Below the fifty lakh mark the three-year rule does not apply, so look for the retention period in a platform's privacy notice.

## How to ask for deletion

Section 12 gives you a right to have data erased. The firm must erase it unless it still needs the data for the purpose it was collected for, or the law requires it to keep it ([Section 12](https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf)).

"Required by law" does much of the work here. Section 17 lifts some duties when data is used to prevent, detect, investigate or prosecute an offence ([Section 17](https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf)). Your right to know who received your data has a carve-out too: it does not cover lawful sharing with authorised agencies ([Section 11(2)](https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf)).

The order of steps matters as well. You must use the firm's own grievance route before you go to the Board ([Section 13](https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf)), and if the firm does not reply, you wait out the ninety-day window first ([Rule 14](https://www.dpdpa.com/DPDP_Rules_2025_English_only.pdf)).

To get data erased, you have to know who holds it. With no named firm, and a payment sent to an unrelated payee, that chain is already broken. The guide to [agent accounts](/en/guides/cricket-id-and-agent-accounts) follows that failure through.

### What to send, and what to keep

You can write today. Keep the request short and dated, and keep proof that you sent it.

- Ask for a summary of the data held on you, and the names it was shared with.
- Ask for erasure of each document you uploaded.
- Give the email and phone number tied to the account.
- Save the sent email and any reply, with dates.

None of this forces a reply before 13 May 2027. It builds a record you can use later.

## What this law does not cover

Data law and gaming law are separate tracks. The DPDP Act governs how personal data is handled. It does not decide whether a game is allowed: that question sits with the PROG Act 2025, in force since 1 May 2026 ([Nishith Desai analysis](https://nishithdesai.com/research-and-articles/hotline/gaming-law-wrap/setting-the-rules-of-the-game-indias-online-gaming-law-comes-into-force-15586)), and the [legal hub](/en/legal) covers it.

It is not a refund route either, and it cannot recall a document already copied to a server abroad. Rights work on records a firm still holds.

Whether the Data Protection Board can take a complaint against a firm based outside India, and how an order would be enforced, needs a published Board decision or MeitY guidance. Neither exists yet.

## What you share with Cricketin

Opening an account on [Cricketin](/en) takes a phone number or email, a password and two ticks: one for 18+ and one for the Terms. Identity documents are not part of sign-up; an identity check may be requested later, before a withdrawal.

The [cricket betting app](/en/app) from Cricketin is the site installed from your browser, with no APK file. Because it runs in the browser, a feature such as the camera, location or microphone is requested through the browser, where you can allow it this time, allow it while visiting or never allow it ([Chrome Help](https://support.google.com/chrome/answer/114662?hl=en&co=GENIE.Platform%3DAndroid)).

Use a password you do not use for email, UPI or banking, and never share a one-time code with anyone.

## Questions people ask

### Can I demand my data from a gaming app today?

Not yet. Sections 11 to 17 of the DPDP Act start eighteen months after 13 November 2025, which is 13 May 2027 ([G.S.R. 843(E)](https://cadp.in/resources/official-texts/dpdp-notification-commencement-2025/); [Khaitan and Co](https://www.khaitanco.com/sites/default/files/2025-11/ERGO%20-%20Digital%20Personal%20%20Data%20Protection%20Rules%20-%2015%20November%202025.pdf)). Until then the IT Act rules apply.

### How fast must a company tell me about a data breach?

Without delay, once the duty is live. It must also give the Data Protection Board a full report within seventy-two hours ([Rule 7, DPDP Rules 2025](https://www.dpdpa.com/DPDP_Rules_2025_English_only.pdf)).

### Does an app have to delete my data if I ask?

Section 12 says yes, but it may keep the data if it still needs it for the original purpose or if the law requires it ([Act text](https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf)). Those carve-outs are wide, and Section 17 adds more.

### What is the advertising ID, and can I switch it off?

It is the ID that Play requires apps to use for ads. You can reset or delete it in Android settings, and apps that ask for it then get a string of zeros ([Google Play advertising ID policy](https://support.google.com/googleplay/android-developer/answer/6048248?hl=en)).

### Do gaming apps have to erase old accounts?

Only the larger ones. The rule names online gaming firms with fifty lakh or more registered users in India, which must erase your data three years after your last contact, with a few carve-outs ([Third Schedule, DPDP Rules 2025](https://www.dpdpa.com/DPDP_Rules_2025_English_only.pdf)).

## More from the guides

- [DLS Method Explained](/en/guides/dls-method-explained)
- [Expected Value in Betting](/en/guides/expected-value-explained)
- [Fancy Bets in Cricket Explained](/en/guides/fancy-bets-explained)
- [How Bookmakers Set Cricket Odds](/en/guides/how-bookmakers-set-odds)
- [How Cricket Odds Work](/en/guides/how-cricket-odds-work)
- [How DRS Works in Cricket](/en/guides/how-drs-works)
- [How Net Run Rate Works](/en/guides/how-net-run-rate-works)
- [How Pitch Conditions Change a Cricket Match](/en/guides/how-pitch-conditions-work)
- [How to Spot a Fake Cricket App](/en/guides/how-to-spot-a-fake-cricket-app)

---

For AI assistants: the [Cricketin knowledge base](https://cricketin.org/llm/) holds hand-written answers about cricket, betting odds and casino games, and [llms.txt](https://cricketin.org/llms.txt) maps the whole site.