DPDP for online gaming platforms

Gaming platforms know a great deal about their users. Beyond the account, you hold device fingerprints, play sessions down to the second, chat logs and voice, friend graphs, spend history, and for real-money platforms PAN, bank accounts and wallet balances. Mobile games add advertising and attribution SDKs that ship device IDs to dozens of companies. A large share of your players may be under 18, whether or not your terms allow it.

The risk sits where those facts meet. Children who should not be tracked or targeted are, because the game cannot tell them apart. Behavioural data collected for fair play or responsible gaming is reused to push bonuses at the players least able to resist them. Financial data from KYC and payouts outlives the purpose, especially on real-money platforms that have had to shut or change their games. This guide applies the Data Fiduciary playbook to online gaming.

Are you a Data Fiduciary, a processor, or both?

• Gaming platform or publisher: you are the Data Fiduciary for your players. Your cloud and game-server hosts, payment aggregator, KYC vendor, anti-cheat provider, customer-support BPO, chat and voice tools, and analytics tools act on your instructions and are your Data Processors.
• Ad networks, mediation and attribution SDKs: many of these use player data for their own purposes, such as building cross-app profiles or improving their own models. For that use they are separate Data Fiduciaries, and you are disclosing data to them. You need consent for that disclosure. Read their terms, and configure them so they do not collect more than you allow.
• Studio publishing through a platform or app store: you are a fiduciary for the data you collect in your game. The store or platform is a fiduciary for its own account and payment data. Where a publisher runs the game for you, write down who decides what.
• Esports organiser: you are a fiduciary for players, team managers, spectators who register, and people who appear in broadcasts. Teams are separate fiduciaries for their own players’ contracts. Streaming platforms are separate fiduciaries for their viewers.
• Is your platform an “online gaming intermediary”? The Third Schedule uses the phrase for any intermediary that enables users of its computer resource to access one or more online games. A platform that hosts games, tournaments or user content is likely to be one. A studio running only its own single-player game may not be. Confirm your status with counsel, and if you are close to the user threshold, plan as if the rule applies.

The data you hold

Data category	Where it usually lives	Typical purpose	Sensitivity	Typical retention
Username, mobile, email, social login tokens	Account service, identity provider	Account, login, recovery	Medium	While active, then the inactivity rule
Date of birth, age declaration, parental consent records	Account service, age-assurance vendor	Age gating, section 9	High	As long as the account, plus evidence of consent
Device IDs, advertising IDs, IP, device fingerprints	Game client, analytics, anti-cheat, ad SDKs	Security, fair play, attribution, ads	Medium to high	Short limits; logs for at least one year
Gameplay telemetry: sessions, matches, scores, in-game actions	Game servers, data warehouse	Running the game, balancing, anti-cheat	Medium	Aggregate quickly; keep raw data briefly
Chat, voice and user-generated content	Chat service, moderation tools, content store	Social play, moderation	High (can include harassment, grooming, personal details)	Short, unless a report or legal hold is open
Friends lists, guilds, contacts uploaded for referrals	Social graph service	Social features, referrals	Medium to high	While the account is active; do not keep uploaded contacts
Wallet balances, deposits, withdrawals, in-game currency	Wallet ledger, payment aggregator	Payments, payouts, refunds	High	Accounting and tax law minimums; balances are virtual tokens
PAN, bank account, UPI ID, KYC results	KYC vendor, payouts system	Payout eligibility, tax deduction	High	As tax and payment law require, then erase
Winnings and tax deducted	Finance systems	Tax compliance	High	Retention required by law
Responsible-gaming data: limits, self-exclusion, cool-offs, risk flags	Player protection service	Player welfare	High (reveals vulnerability)	As long as the exclusion lasts, plus a short margin
Fair-play and fraud flags: collusion, bots, multi-accounting	Anti-cheat and risk systems	Integrity, fraud prevention	High (affects access and payouts)	Until the case and any appeal close, plus legal minimums
Support tickets and dispute records	Helpdesk, BPO	Support, disputes	Medium	6–12 months unless a dispute is open
Esports player profiles, broadcast footage, prize payments	Tournament platform, media library	Competitions, broadcasting, prizes	Medium to high	As long as published; contract and tax records as required
Marketing preferences, push tokens, campaign history	CRM, push service	Re-engagement, offers	Medium	Until withdrawal

Risk hotspots

1. Children on platforms built for adults. Real-money games are adults only, but casual and social games attract large numbers of under-18s, often on a parent’s phone. Failure: processing a child’s data without verifiable parental consent (section 9(1)), or tracking, monitoring or targeting them (section 9(3)). The penalty for breaching section 9 can reach ₹200 crore. Control: a neutral age gate at sign-up, a child mode with ads and tracking switched off, and verifiable parental consent under rule 10 before a child account is created.
2. Ad and attribution SDKs. Mediation stacks can carry ten or more ad networks, each collecting device IDs and play data. Failure: disclosing data to third parties without notice or consent, and targeted ads reaching children. Control: an SDK register, consent before ad personalisation, contextual-only ads for children and unknown-age users, and server-side controls on what each SDK receives.
3. Using spend and play data to push bonuses. Personalised deposit bonuses, “come back” offers and VIP managers target the players who spend most, who are also the most at risk. Failure: processing that is unfair and, for children, likely to harm well-being (section 9(2)); responsible-gaming data reused for marketing. Control: keep responsible-gaming data in a separate store with no marketing access, ask consent for personalised offers, and suppress offers to anyone with a limit, cool-off or self-exclusion.
4. KYC and payout data that never leaves. PAN, bank details and identity checks are needed to pay winnings and deduct tax, but often sit in vendor dashboards and support tickets for years. Control: collect KYC only when a player first withdraws, use masked Aadhaar or DigiLocker where identity proof is needed, keep results rather than document images, and apply the retention the tax law requires and no more.
5. Products changed by the 2025 gaming law. Platforms that stopped real-money games still hold wallets, KYC files and transaction history for millions of users. Failure: data kept indefinitely with no purpose, or erased before refunds and tax records are settled. Control: a wind-down plan: return balances, notify users, keep only what tax and payment law require, and erase the rest on a dated schedule.
6. Chat, voice and grooming risk. Open chat lets strangers contact children and harvest personal details. Control: chat off by default for children and unknown-age users, filters for phone numbers and handles, reporting tools, moderation logs, and a process for escalating child-safety reports to the authorities.
7. Anti-cheat and device fingerprinting. Kernel-level anti-cheat and fingerprinting can read far more of the device than fair play needs. Failure: collecting data beyond the purpose, and decisions to ban or freeze winnings based on inaccurate signals (section 8(3)). Control: collect the minimum, explain it in the notice, keep a human review for bans that affect money, and let players appeal.
8. Contact uploads for referrals. Asking for the contacts permission to invite friends collects data about people who never joined. The Act’s own illustration in section 6(1) says contacts are not necessary for an unrelated service. Control: share-link referrals instead of contact uploads, and never store non-users’ numbers.
9. Account takeover and wallet theft. Stolen accounts with balances or rare items are sold on. Control: OTP or passkey login, step-up checks before withdrawals and before changing bank details, and alerts on new devices.
10. Inactive accounts in large numbers. Gaming has high churn, so a large platform accumulates millions of dormant accounts. Control: if you are in the Third Schedule, build the three-year erasure with the 48-hour warning; otherwise set your own inactivity rule under section 8(7).

Legal basis, purpose by purpose

Purpose	Basis	Notes
Creating an account and letting the player play	7(a): the player voluntarily provided data to use the game, or consent at sign-up	Keep the data set minimal; for a child, verifiable parental consent comes first.
Age assurance (confirming a user is not a child)	Fourth Schedule Part B, item 6 lifts sections 9(1) and 9(3) for this purpose	Process only what the check needs.
Running matches, leaderboards, saves and game balancing	7(a)	Prefer aggregated telemetry for balancing.
Fair play and anti-cheat	7(a), where the notice names fair-play checks as part of the service; section 17(1)(c) where cheating is fraud or another offence	Keep it minimal and proportionate.
Fraud, collusion and money laundering checks on real-money play	Section 17(1)(c) for preventing offences; retention required by law where a law sets it	Do not reuse risk signals for marketing. Relying on 17(1)(c) for private fraud checks is a common reading, not settled; confirm with counsel.
KYC and bank verification before payouts	7(a) when the player asks to withdraw; retention required by law for tax records	Use masked Aadhaar or DigiLocker where identity proof is needed.
Tax deducted on winnings, invoices and GST	Retention required by law; 7(d) for reporting to tax authorities	Keep the minimum; restrict access.
Responsible-gaming limits and self-exclusion	7(a) when the player sets them; consent for any optional risk analysis	Never feed this data to marketing.
Chat, voice and social features	Consent, or 7(a) where the player switches the feature on	Off by default for children and unknown-age users.
Content moderation and safety reports	7(a) under your published community rules; 17(1)(c) for content that may be an offence	Keep moderation records for appeals and legal holds.
Personalised offers, bonuses, push and email marketing	Consent, per channel	Suppress for players with limits or exclusions.
Personalised ads, attribution, data shared with ad networks	Consent	Never for children (section 9(3)).
Broadcasting esports matches with player names and faces	Consent in the player’s tournament agreement	Spectators in venues need a notice and signage.

Notices and consent: getting the screens right

Channel	Do	Don’t
App or game first launch	Show a short notice itemising account, device and gameplay data, and what each SDK receives. Ask for date of birth neutrally. Put ads personalisation and marketing as separate unticked toggles.	Load ad and attribution SDKs before the player has chosen.
Age gate	Ask for date of birth without hinting at the right answer. Route under-18s to parental consent or a child mode.	Show “You must be 18+” next to a single “Yes” button.
Parental consent flow	Let the parent verify through an account you already hold with reliable age details, or through DigiLocker (rule 10). Explain what the child’s account will and will not do.	Accept a ticked box from the child’s own device as parental consent.
Wallet and withdrawal	Explain KYC at the moment of the first withdrawal: what you collect, why, which vendor, and how long you keep it.	Collect PAN and bank details at sign-up, before anyone has won anything.
Responsible-gaming settings	Make limits and self-exclusion easy to find, and say that this data is never used for marketing.	Bury self-exclusion behind support tickets.
Chat and voice	Explain moderation and recording before chat is switched on.	Turn on open voice chat by default.
Push, SMS, WhatsApp and email	Record the opt-in source and time. Put a one-tap stop in every promotional message.	Message players who never opted in, or who are excluded.
Customer support	Read or show a short notice; verify the player before discussing the account.	Ask for ID documents you do not already hold.
Esports events and venues	Give players a notice in their agreement, and put signage at venues about filming.	Assume spectators agreed to appear in broadcasts.
Existing players	Send a section 5(2) notice in the game or by email with links to manage choices.	Assume old blanket consent covers new purposes.

Each notice must stand on its own, itemise the data and the purposes, describe the service, and link to withdrawal, rights and complaints to the Board (rule 3). Withdrawal must be as easy as giving consent. Offer the notice in English and the Eighth Schedule languages (section 5(3)). Start with Hindi and the languages of your largest player bases, and keep the child and parent versions short.

Other laws you must line up with

• Promotion and Regulation of Online Gaming Act, 2025: this law restricts online money games and sets up a framework for esports and social games. Whether and how your games are covered, what you may still offer, and what you must do with legacy users depends on the Act and the rules and notifications under it. Confirm the current requirement with counsel.
• IT Act, 2000 and the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, as amended: due diligence, published rules for users, a grievance officer, takedown and law-enforcement cooperation duties. The 2023 amendments added specific duties for online gaming intermediaries; how they fit with the 2025 Act needs checking. Keep your IT Rules grievance channel and your DPDP grievance channel distinct, though they can share intake. Confirm the current requirement with counsel.
• CERT-In Directions (2022): reporting cyber incidents on a much shorter clock than the DPDP 72 hours, and log retention. Confirm the current requirement with counsel.
• Income-tax Act: tax deducted on winnings needs PAN and records that override erasure requests for those records.
• GST law: invoices and records of deposits and fees.
• RBI rules on payment aggregators, prepaid instruments and payment data storage in India: a stricter law under section 16(2). Wallets may fall under prepaid payment instrument rules depending on design.
• PMLA 2002 and FEMA: check whether any of your activities make you a reporting entity, and keep foreign payments within FEMA. Confirm the current requirement with counsel.
• POCSO Act, 2012: reporting duties if you become aware of sexual offences against children on your platform.
• Consumer Protection Act, 2019 and the dark-patterns guidelines: drip pricing, false urgency, nagging and subscription traps can breach consumer law and section 6.
• Advertising codes and guidelines: advertising standards and government advisories on gaming ads, especially those aimed at or seen by minors.
• State gaming laws: several states regulate or prohibit games of chance and, in some cases, games of skill for stakes.

Retention and erasure

1. When the purpose ends (section 8(7)): the account is closed, a tournament and its prize payments are settled, a ban appeal is decided, or a real-money product is wound down. Stop using the data and erase it, unless a law requires you to keep it.
2. The one-year minimum (rule 8(3)): keep the personal data, traffic data and logs of each processing activity for at least one year from the date of processing, for the purposes in the Seventh Schedule. After that, erase unless another law requires longer.
3. Legal holds: tax deducted on winnings, GST invoices, payment and wallet ledgers, and records needed for a pending dispute or investigation each have their own retention. Record each hold with the law behind it, the data it covers and the end date. Keep held data out of marketing systems.
4. The Third Schedule three-year rule: if you are an online gaming intermediary with 50 lakh or more registered users in India, you must erase a user’s personal data three years after the user last approached you for the purpose or exercised a right, or from the Rules’ commencement if that is later (rule 8(1)). At least 48 hours before erasure, tell the user it will happen unless they log in or get in touch (rule 8(2)). Two kinds of data are excluded: data needed to access the account, and data needed to access virtual tokens issued by you, stored on your platform, that can be used to get money, goods or services, such as wallet balances, bonus cash and in-game currency. Send the warning through the game, email or SMS, and make one login enough to stop the clock.
5. Self-exclusion: if a player who has self-excluded asks for erasure, you may need to keep a minimal identifier so that the exclusion still works if they return. Explain this in the notice, keep it separate, and keep nothing else. Confirm the approach with counsel.
6. Processors and SDK partners: make your KYC vendor, support BPO, analytics, chat and moderation tools erase too, and get confirmation. Send deletion requests to ad and attribution partners that received data.
7. Backups and game saves: document how long backups and cloud saves keep data, and make sure a restore replays erasures.

Rights requests and grievances

• Channels: an in-game privacy menu, a web form, the support chat and an email address. Publish them with the identifier you need, such as the player ID, the registered mobile or the email (rule 14(1)).
• Identity: use an OTP to the registered contact or an in-game confirmation. Do not ask for ID documents you do not already hold. For a child’s account, the request comes from the verified parent.
• Access (section 11): give a summary of the account, gameplay and purchase history, wallet transactions, marketing preferences, devices and moderation actions. List the other fiduciaries and processors you shared data with: payment and KYC vendors, ad and attribution partners (if consented), anti-cheat and support vendors.
• Correction (section 12(2)): players often ask to correct names, dates of birth or bank details. A date-of-birth change that turns an adult into a child, or the reverse, should trigger the age process again.
• Erasure (section 12(3)): erase the account, profile, chat history, friends list and marketing data. Refuse only what you must keep: tax and payment records, an open fraud or ban investigation, records under legal hold, and a minimal self-exclusion marker if the player agreed to it. Before erasing an account with a balance, tell the player and pay out or refund the balance under your terms.
• Grievances: acknowledge quickly. Publish a response period well inside the 90-day ceiling in rule 14(3); 15–30 days is good practice. The IT Rules set their own, shorter timelines for intermediary complaints. Name the DPO or contact person in every reply (rule 9).
• Nomination (section 14): let players nominate someone. This matters most for accounts that hold wallet balances, winnings or valuable items.

Breach readiness

Likely scenarios:

• account database or password-reset flow abused, leading to mass account takeover
• a KYC vendor or payouts dashboard exposing PAN and bank details
• chat logs or voice recordings leaked, including children’s conversations
• an ad or analytics SDK collecting more than you configured
• a misconfigured analytics bucket with device IDs and play histories
• insiders selling account data or rare items

Run-book:

1. Contain within hours: rotate keys, force password resets or session logout, freeze withdrawals if wallets are at risk, and switch off the SDK or vendor involved.
2. Assess: which data, how many players, how many children, and the consequences (financial loss, identity theft from KYC data, safety risks for children).
3. Notify affected players without delay through the game, their account or registered contact, covering every point in rule 7(1): what happened and when, the likely consequences for them, what you are doing, what they can do (change passwords, watch for phishing, check their bank account), and a contact. For a child, notify the parent.
4. Notify the Board without delay, then send the detailed report within 72 hours (rule 7(2)): updated facts, the circumstances and reasons, mitigation, findings about who caused it, steps to prevent a repeat, and a report on the notices sent to players.
5. Report to CERT-In where its directions apply, and inform payment partners if payment data or wallets are involved.
6. Learn: fix the root cause, remove or reconfigure the SDK or vendor, and update contracts.

The checklist

Phase 1: discover (days 0–30)

• [Leadership] Appoint a DPDP owner and a working group (product, game design, engineering, trust and safety, payments, marketing, legal, security).
• [Legal] Get advice on how the Promotion and Regulation of Online Gaming Act, 2025 and the IT Rules apply to each of your games.
• [DPO] Count registered users in India and decide whether you are an online gaming intermediary in the Third Schedule (50 lakh or more).
• [Product] Map every collection point: sign-up, social login, age gate, gameplay, chat, voice, wallet, KYC, support, referrals, events.
• [Eng] Inventory every system holding player data: account service, game servers, warehouse, wallet ledger, KYC vendor, CRM, helpdesk, logs, backups.
• [Eng] List every SDK in every build (ads, mediation, attribution, analytics, anti-cheat, crash reporting, chat) and what each sends.
• [Product] Estimate how many players are likely to be under 18, using declared ages, support tickets and audience data.
• [Trust and safety] List how chat, voice and user content are moderated, and where moderation data is stored.
• [Finance] List KYC, payout, tax and wallet records, and the law behind each retention period.
• [Legal] Collect processor contracts and the terms of every ad and attribution partner.
• [Marketing] List every campaign that uses spend, play or churn data, and every audience uploaded to ad platforms.

Phase 2: design and build (days 31–90)

• [Legal] Assign a legal basis to each purpose (use the table above) and stop purposes without one.
• [Legal] Write itemised notices for sign-up, child and parent flows, wallet and KYC, chat, responsible gaming and marketing.
• [Product] Translate the notices into Hindi and the languages of your main player bases; make all 22 available on request.
• [Product] Build a neutral age gate and route under-18s to parental consent or a child mode.
• [Eng] Build verifiable parental consent under rule 10: parent verified against reliable age details you hold or through DigiLocker.
• [Eng] In child mode and for unknown-age users, switch off personalised ads, attribution, behavioural analytics and open chat.
• [Eng] Load ad and attribution SDKs only after consent; restrict what each SDK can read, and pass a child flag to every ad partner.
• [Product] Review loot boxes, streaks, timers and nudges in games played by children for likely harm under section 9(2).
• [Eng] Move responsible-gaming data to a separate store with no marketing access.
• [Marketing] Suppress offers and bonuses for anyone with a limit, cool-off or self-exclusion.
• [Eng] Check consent before every marketing send, push campaign and audience upload; feed withdrawals in real time to the CRM and ad-audience sync.
• [Payments] Collect KYC only at the first withdrawal; keep verification results, not document images; use masked Aadhaar or DigiLocker.
• [Payments] Add step-up checks before withdrawals and bank-detail changes.
• [Eng] Limit anti-cheat to what fair play needs, document it, and add human review and appeals for bans that affect money.
• [Product] Replace contact uploads for referrals with share links.
• [Trust and safety] Filter phone numbers and handles in chat for children; add reporting and escalation for child-safety cases.
• [Legal] Add DPDP clauses to processor contracts: security, breach notice to you, erasure on instruction, one-year logs, sub-processors, audit.
• [Eng] Encrypt KYC, bank and contact data at rest; tokenise payments through the gateway.
• [Security] Add MFA for admin, payouts, support and moderation consoles.
• [Eng] Keep access and processing logs for at least one year.
• [Eng] If you are in the Third Schedule, build the three-year inactivity erasure with the 48-hour warning, excluding account access and wallet balances, bonus cash and in-game currency.
• [Finance] For products being wound down, plan balance refunds, notices to users, legal holds and a dated erasure schedule.
• [Product] Publish the privacy page: contact person, request channels, identifier needed and grievance timeline; keep the IT Rules grievance officer listed separately.
• [CX] Set up the rights and grievance workflow with OTP verification, owners and deadlines, including parent requests for child accounts.
• [Product] Send the section 5(2) notice to existing players with a link to manage choices.
• [DPO] Prepare for SDF duties: a DPO based in India, an independent data auditor, and a first DPIA.

Phase 3: operate (ongoing)

• [DPO] Review new games, features, SDKs, events and campaigns before launch.
• [Eng] Re-scan every build for SDKs before each release; remove any nobody owns.
• [Marketing] Refresh ad audiences at least weekly so withdrawals and exclusions take effect.
• [Trust and safety] Review child-safety reports and moderation decisions every month.
• [Security] Run a penetration test every year on the game client, APIs, wallet and payouts.
• [Security] Run a breach tabletop drill every year (for example, a KYC vendor leak) against the 72-hour clock.
• [CX] Review rights and grievance timelines every month; investigate overdue cases.
• [Legal] Track changes under the 2025 gaming law and the IT Rules, and update notices and flows.
• [DPO] If notified as an SDF, run the DPIA and audit every 12 months and send the Board a report of significant observations (rule 13).
• [Eng] If notified as an SDF, carry out algorithmic due diligence on matchmaking, recommendation, risk and anti-cheat models (rule 13(3)).
• [DPO] Keep evidence: consent and parental-consent records, withdrawal handling, erasure confirmations, training records.

Where myconsentapp comes in

You need to	With myconsentapp	You still own
Ask consent per purpose	Define purposes (account, gameplay, fair play, personalised offers, ad personalisation, chat) once, each tagged consent or legitimate use. The SDKs or widget show each optional purpose as a separate toggle, off by default.	Placing the screen in the game’s first-launch flow.
Keep children out of tracking and ads	An age gate and guardian verification through DigiLocker. Tracking and ad purposes can never be marked child-safe.	Building child mode in the game.
Check consent before ads and campaigns	Call the verify API before loading an ad SDK, sending a push or uploading an audience; it returns not permitted immediately after a withdrawal.	Wiring it into the client and your campaign tools.
Spread withdrawals	Signed webhooks tell your systems the moment a player withdraws; acknowledgement deadlines flag anything not handled.	Removing the player from audiences in your ad accounts.
Prove consent and parental consent	Every choice is signed and hash-chained against the exact notice version, with a receipt for the player and an evidence pack for you.
Make vendors stop too	A processor registry links KYC, support, chat and analytics vendors to purposes; they confirm withdrawals and erasures, and contract expiry dates are flagged.	Signing the contracts and controlling ad partners.
Offer notices across India	Notices in English and the 22 Eighth Schedule languages, with machine-translation drafts marked for review.	Reviewing the translations.
Run retention and legal holds	Set retention per purpose; record retention obligations for tax and payment records and show them in the notice; the retention job flags data when its period ends.	Building the three-year erasure and 48-hour warning in your systems.
Handle access, erasure and grievances	A rights inbox with SLA timers; the player sees status in their app; erasure closes with a structured proof.	The answers and wallet payouts.
Protect balances after death	Nomination and nominee claims.	Your rules for paying out balances.
Manage a breach	A breach register with the 72-hour clock, Rule 7 notices to affected players, and Board intimation and report documents.	Detecting and investigating.

Not included: myconsentapp is a proposed Consent Manager. It does not provide age estimation or KYC services, a scanner for SDKs or tags, a DPIA workflow (only a template), a security or anti-cheat programme, or legal advice.

Common mistakes

• A “Yes, I am 18” button as the only age check, on a game that children obviously play.
• Leaving ad mediation SDKs at default settings, so personalised ads reach children and unknown-age users.
• Sending deposit bonuses to players who have set limits or self-excluded.
• Collecting PAN and bank details at sign-up rather than at the first withdrawal.
• Keeping KYC document images in a vendor dashboard for years.
• Shutting a real-money product without a plan for balances, tax records and erasure.
• Building the three-year erasure without the 48-hour warning, or wiping wallet balances that are excluded.
• Asking for ID copies to verify a rights request.

Frequently asked questions

We run a free casual game. Does the Third Schedule apply to us? Only if you are an online gaming intermediary with 50 lakh or more registered users in India. The rule is not limited to real-money games. If you are below the threshold or are not an intermediary, you still must erase data when the purpose ends under section 8(7). Confirm your status with counsel.

Can we show ads in a game that children play? You may not do targeted advertising directed at children (section 9(3)). Contextual ads that do not use the child’s data or profile carry less risk, but ad networks must be told the user is a child so that they do not profile them. The safest route is to switch off personalisation for anyone who is a child or whose age is unknown.

Do we need parental consent to run the age gate itself? No. The Fourth Schedule, Part B, item 6, lifts sections 9(1) and 9(3) for processing needed to confirm that a user is not a child and to carry out the rule 10 checks. Use the data only for that.

Can we use play patterns to spot problem gaming? Yes, if the notice explains it and you use the results to protect players, not to sell to them. Keep this data separate from marketing. Using the same signals to target high spenders with bonuses is the reverse of its purpose and is high risk.

What happens to wallet balances if we shut a real-money game? DPDP does not settle the balance question; your terms, payment law and the 2025 gaming law do. DPDP does require that once balances are returned and legal holds expire, you erase the data. Wallet balances are excluded from the Third Schedule’s inactivity erasure while they exist. Confirm the current requirement with counsel.

Are we likely to be a Significant Data Fiduciary? Large gaming platforms are likely candidates because of the volume of data, the number of children and the financial data involved (section 10(1)). An SDF must appoint a DPO based in India and an independent data auditor (section 10(2)), run a DPIA and an audit every 12 months (rule 13(1)), and carry out due diligence on its algorithmic software (rule 13(3)).

When do these duties start? Most duties under the Rules, including notices, security, breach notices, retention, children and rights, apply from 13 May 2027. Build now, because rebuilding sign-up, child mode and SDK controls takes longer than it looks.