If your product has users in India, the Digital Personal Data Protection Act, 2023 (DPDP Act) applies to how you handle their personal data — including whatever your analytics tool collects about them. Most analytics stacks were designed years before the DPDP Act existed, so compliance tends to be bolted on rather than built in.
This is a plain-language summary, not legal advice — talk to your legal team about how the DPDP Act applies to your specific product and data flows.
What the DPDP Act asks for
At a high level, the Act is built around a few ideas that should sound familiar if you’ve dealt with GDPR: data should be collected for a clear purpose, retained no longer than necessary, and processed with the data principal’s (the user’s) awareness. It also gives users concrete rights — including the right to have their data erased or exported on request.
Where analytics tools usually fall short
A typical analytics setup identifies users via cookies or persistent device identifiers, stores raw identifiers (email addresses, user IDs) directly, and has no built-in mechanism for a single user to request their data be deleted — that usually means an engineering ticket, if it’s possible at all.
How Mitr is built differently
A few things that come out of the box rather than as a custom project:
- Identifiers are hashed client-side. Any user ID you pass to
identify()is hashed with SHA-256 before it leaves the browser or device — we never see or store the raw value. - Anonymous visitors need no storage at all. No cookies, no device fingerprint written anywhere — see why we built analytics without cookies for the mechanics.
- Per-visitor erasure and export are API endpoints, not tickets. A site owner can request deletion or a JSON/CSV export of a single visitor’s data directly.
- Custom event properties are scanned for PII at ingest and hashed in place before they’re ever written to storage, catching accidental leaks (someone logging a raw email in a custom event property, for instance).
- Every erasure and export is logged to an append-only audit trail.
None of this makes Mitr “DPDP-certified” — there’s no such certification, and you should confirm with your own legal team how the Act applies to your specific setup. What it does mean is that the architecture starts from data minimization instead of retrofitting it after a compliance review.
See the full technical detail — sub-processors, retention windows, and a side-by-side comparison with cookie-based analytics — on our Trust & Compliance page, or see pricing built for Indian teams.