DPDP Act Compliance for Online Gaming
Dormancy erasure, parental consent, and child-safe telemetry for gaming platforms
The DPDP Rules single out online gaming intermediaries: dormant-account data must be erased three years after last activity with 48 hours' notice, and large under-18 player bases trigger Section 9's consent and advertising bans. TruePrivacy automates the full player-data lifecycle.
What DPDP Act requires of online gaming
Three-year dormancy erasure
Personal data of players inactive for three years must be erased — with at least 48 hours' advance notice so the player can return.
Verifiable parental consent
Under-18 players need a verified adult's consent before processing begins — across every title and platform you operate.
No tracking or ads targeting children
Behavioural monitoring and targeted advertising at child players are prohibited outright — engagement analytics must be re-examined.
Real-money gaming retention
KYC and transaction records for RMG carry statutory retention that overrides dormancy erasure for the records it covers.
Player rights at scale
Access, correction, and erasure requests from millions of players need verified identity and tracked fulfilment.
Notify-everything breach regime
Every breach of player data triggers intimations to players and the Board, plus the 72-hour detailed report and CERT-In's 6-hour clock.
How TruePrivacy helps
Dormancy clock automation
Per-account inactivity tracking driven by your activity events, with clock resets on return and the three-year threshold monitored continuously.
48-hour notice orchestration
Pre-erasure notices delivered through registered channels with delivery evidence — and erasure halted the moment a player re-engages.
Evidenced erasure execution
Deletion orchestrated across game databases, analytics stores, and processors, with completion evidence per account.
Parental consent and child mode
Token-based adult verification at onboarding, with advertising identifiers and behavioural profiling technically disabled for child accounts.
RMG retention carve-outs
KYC and transaction records held under documented statutory bases while the rest of the dormant account is erased on schedule.
“Forty million accounts, each with its own inactivity clock and a 48-hour notice obligation — no ops team can run that manually. TruePrivacy tracks, notifies, erases, and evidences the entire pipeline. We review a dashboard instead of running a fire drill.”
Frequently asked questions
When does the three-year dormancy clock start and reset?
It runs from the player's last approach to the platform for the specified purpose or last exercise of their rights, and resets on genuine return. TruePrivacy consumes your activity events to maintain per-account clocks, so login, gameplay, or a rights request each restart the countdown automatically.
Does dormancy erasure delete real-money gaming KYC records?
No — retention required by law overrides the dormancy rule for the records it covers. TruePrivacy holds RMG KYC and transaction records under their statutory bases, erases the rest of the account, and schedules the held records for deletion when their own periods expire.
Is skill-based matchmaking 'behavioural monitoring' of children?
Gameplay-functional personalisation is distinguishable from profiling aimed at engagement or advertising — but the line must be documented. TruePrivacy classifies each telemetry use, disables the prohibited categories for child accounts, and records the reasoning for what stays on.
How do we handle parental consent without wrecking onboarding?
Token-based adult verification completes in under a minute, and the funnel resumes the moment the parent verifies. TruePrivacy records the consent, method, and reference identifier — no identity documents stored, minimal drop-off.
Get DPDP Act-ready
Book a 30-minute demo and see how TruePrivacy handles DPDP Act compliance for online gaming.
Free 14-day trial · No credit card required · Setup in minutes