Application of the DPDP Act to an Indian iPhone User
With the proliferation of smartphones, personal information has become a central aspect of people’s daily lives. Personal information may be stored on an iPhone in the form of photos, contacts, location data, health information, text messages and account details. Some of that personal information may stay on the iPhone itself, while other personal information may be used via cloud services, apps and the web. But who has legal obligations if personal information is collected, shared or leaked?
The Act laid out guidelines for processing digital personal data in India, with the Central Government subsequently issuing Digital Personal Data Protection Rules, 2025 on 14th November 2025. These rules listed the obligations of data fiduciaries to process data responsibly while safeguarding the data. The legislation can bind companies processing digital personal data in India, or those outside India that process data for offering goods or services to people in India.
For iPhone users, whether the law applies to Apple and other companies will depend on which of them makes the decision about the purpose of the processing and the means of processing any specific personal data. Just because a person has an iPhone, doesn’t mean that Apple is responsible for all the data processed by every single app. (Ministry of Electronics and Information Technology)
Is Apple Responsible for Protecting Personal Information?
A Data Fiduciary is an entity who determines the purpose and means of processing personal data. A Data Processor is an entity who processes personal data on behalf of a Data Fiduciary. These distinctions will be relevant to determine the identity of a particular data-handling activity.
Apple could be a Data Fiduciary where it processes your personal data through its own services (for example, through an Apple Account or some Apple apps). The scope of Apple’s processing obligations will vary depending on the activity and legal obligations at play. Apple’s privacy notice states what information it collects about you, how it uses your personal data, and when that personal data could be shared with service providers and other entities.
Apple additionally states that it employs technical, organisational and physical safeguards in order to guard personal data. But the company’s stated commitments and protections do not automatically mean that the company has complied with all of India’s legal requirements. Furthermore, compliance must be evaluated against the relevant legal obligations and the processing of data in practice. (Apple Privacy Policy)
Who Is Responsible When a Third-Party App Collects iPhone Data?
A user of an iPhone has the option to download apps for banking, shopping, games, social media, entertainment, travel or health services. The apps may be able to collect location information, contact details, identifiers for the device or usage data, depending on what the app is capable of and has been given permission to do. Often, the app publisher or service provider decides how the information will be used.
That company would be the Data Fiduciary of that processing under the DPDP Act. As the operator of the App Store or as the operator of the operating system, Apple would not automatically be the Data Fiduciary for every decision an independent developer takes in relation to the handling of data. Responsibilities will vary depending on activity and the legal roles of the parties.
Apple shows privacy information on App Store product pages to inform users about the categories of information that an app developer declares it collects, and whether that information is linked to the user or used to track them. These disclosures are designed to inform consumers, but Apple obtained them from developers and they should not be taken as assurance that each app will process the data correctly. (Apple Support)
What Duties Does the DPDP Act Place on Companies?
Within the DPDP framework, the Act sets out requirements for notice, consent, specific purposes, security safeguards and collection, retention and destruction of personal data. If consent is the legal basis for processing, it must be informed and can be withdrawn (although the law lays out exceptions). There are also specific instances where the Act does not require consent.
7.1 The law holds Data Fiduciaries responsible for any processing that they do themselves, or cause to be done, including in accordance with the requirements on them to processes under the law and within the limits set by it. They are required to adopt appropriate security practices to prevent data breaches, and adhere to the specific requirements on breach notifications. Rights to access, rectify, erase, and raise complaints are also available to data principals subject to the circumstances.
These obligations are relevant in the case of disclosure of information by a computer system due to a cyberattack, the processing of information without a proper legal basis or processing that is contrary to the conditions of this processing. But not all security incidents necessarily lead to a breach of law. Instead, the context, the role of the company, the protection measures and the specific regulations must be analyzed before legal statements can be made. (DPDP Act and Rules)
What should iPhone Users do to safeguard their Data?
There are practical things that users can do to limit the collection of data that they find unnecessary. For example, users can check app permissions, restrict location access, see and limit microphone and camera access, and revoke access to these features that are not necessary for the app to perform its intended function. And, users can check Apple Account security and privacy info before installing or using third-party apps.
If a user feels that a company has mishandled personal data, the first step should be to determine the organisation which has collected or is in possession of the data and follow its complaint/ privacy process. The user should retain emails, screenshots and other evidence. If the legal obligations are not met, the user may complain through the DPDP framework.
Apple has also released a transparency report of requests for user information from authorities in India. Apple’s report for the period of July – December 2025 categorizes requests, stating the number of requests that resulted in customer data being produced. This reporting makes clear that access to customer data is facilitated by legal requests, but in and of themselves do not prove Apple or the requesting authorities did anything wrong. (Apple Government Information Requests)
The Responsibility Is Shared, Yet theLegal Obligations Are Not
There are multiple, distinct actors who hold the personal information of iPhone users. Apple undertakes the processing of personal information for which it is the relevant Data Fiduciary. (Third-party apps may have their own processing obligations in respect of information they collect and use). Service providers may also have contractual and legal obligations where they are processing data on behalf of another organisation. Users are able to use privacy controls where they are made available.
Thus, the DPDP Act does not posit that any one company bears liability for all privacy risks of a smartphone. The legal analysis instead hinges on whether one company controls the purpose and means of processing, what data is processing, what legal basis to process the data has been relied on, and whether the duties imposed have been complied with. As India’s data protection regime takes shape, the key question will be how these functions play out in respect of personal information traveling across devices, apps, the cloud, and other companies.
