7StartUp TeamShort answer: if your website or app collects personal data — names, phone numbers, emails, addresses, payment or ID details — India's Digital Personal Data Protection (DPDP) Act, 2023 and DPDP Rules, 2025 apply to you. The main duties start on 13 May 2027. You will need a clear privacy notice, specific consent for each purpose, an easy way to withdraw consent, reasonable security, a breach response plan and a grievance contact. Penalties go up to ₹250 crore.
Last updated: 27 October 2026. This is general information, not legal advice — consult a lawyer for your specific situation.
DPDP timeline: key dates
- 11 August 2023 — DPDP Act becomes law
- 13 November 2025 — DPDP Rules, 2025 notified; Data Protection Board provisions take effect
- 13 November 2026 — Consent Manager provisions take effect
- 13 May 2027 — main business obligations apply: notice, consent, security, breach reporting, data erasure and user rights
That leaves about six months. Website and form changes take time, so start now.
Who does the DPDP Act apply to?
Any business that processes digital personal data of people in India — including small businesses, e-commerce stores, clinics, coaching institutes, real estate agents and service providers that collect leads online. Under the Act you are a Data Fiduciary; your customers are Data Principals.
Website DPDP compliance checklist
1. Map the personal data you collect
List every place you collect data: contact forms, enquiry popups, checkout, sign-up, WhatsApp chats, newsletter forms, job applications, Google Analytics and ad pixels. Note what you collect, why, where it is stored and who can access it.
2. Collect only what you need
If an enquiry form only needs a name and phone number, don't ask for date of birth or address. Less data means less risk.
3. Write a clear privacy notice
Your notice should be in plain language and explain:
- What personal data you collect
- The specific purpose for each item
- How people can withdraw consent
- How they can exercise their rights and raise a complaint, including with the Data Protection Board
Offer it in English and the regional languages your customers use where possible.
4. Get specific, unticked consent
- Use a separate, unticked checkbox for each purpose — for example, "Contact me about my enquiry" and "Send me offers on WhatsApp".
- Don't bundle consent into "I agree to the terms".
- Link to your privacy notice right next to the form.
- Record when and how each person gave consent.
5. Make withdrawing consent as easy as giving it
Add unsubscribe links in emails, a "STOP" option on WhatsApp and SMS, and a simple way to ask for data deletion.
6. Review cookies, analytics and ad pixels
Tracking tools collect personal data too. Explain them in your notice and give users a real choice where consent is required.
7. Protect the data
- HTTPS on every page
- Strong passwords and two-factor login for your admin panel, hosting and email
- Up-to-date CMS, plugins and server software — see our PHP2Shell update guide
- Limit who can see customer data
- Regular backups and access logs (the Rules expect logs to be kept for at least a year)
8. Prepare a breach response plan
If customer data is leaked or hacked, the Rules require you to inform affected users and the Data Protection Board without delay, with a detailed report to the Board within 72 hours. Write down who does what before it happens.
9. Delete data you no longer need
Don't keep old leads and customer records forever. Set a retention period for each type of data and delete it after the purpose is over, unless a law requires you to keep it.
10. Children's data needs parental consent
If your website or app is used by children (under 18), you need verifiable parental consent before processing their data, and you must not track them or target ads at them. This matters for schools, coaching, gaming and kids' products.
11. Add a grievance contact
Publish an email or form where people can ask about their data, correct it, ask for deletion or complain — and respond on time.
12. Check your vendors
Hosting providers, CRMs, WhatsApp API providers and marketing agencies that handle your customer data are Data Processors. Use written agreements and make sure they protect data properly.
DPDP Act penalties
- Up to ₹250 crore for failing to take reasonable security safeguards to prevent a data breach
- Up to ₹200 crore for failing to notify a breach
- Up to ₹200 crore for breaking the rules on children's data
- Up to ₹50 crore for other violations
The Data Protection Board decides penalties based on how serious the breach is, so small businesses are unlikely to face the maximum — but the reputational damage of a leak can be just as costly.
Quick wins you can do this month
- Remove unnecessary fields from your forms.
- Add unticked consent checkboxes with a privacy notice link.
- Update your privacy policy in plain language.
- Turn on HTTPS, two-factor login and automatic backups.
- Update your CMS, plugins and PHP version.
Frequently asked questions
When does the DPDP Act apply to my business?
The DPDP Rules were notified on 13 November 2025. Most business duties — notice, consent, security, breach reporting and erasure — apply from 13 May 2027.
Does the DPDP Act apply to small businesses?
Yes. It applies to any business processing digital personal data of people in India, whatever its size. Large "Significant Data Fiduciaries" have extra duties.
Do I need a new privacy policy?
Most websites will need to update it. The DPDP Act requires a clear, plain-language notice listing the data collected, its purpose, and how to withdraw consent and complain.
Is a pre-ticked checkbox valid consent?
No. Consent must be free, specific, informed and given by a clear action — an unticked checkbox the user ticks is the safe approach.
What is the penalty under the DPDP Act?
Penalties go up to ₹250 crore for failing to protect data, and up to ₹200 crore for failing to report a breach or violating children's data rules.
Can you make my website DPDP-ready?
Yes. We update forms, consent checkboxes, privacy pages, security and hosting as part of our website maintenance and website redesign services, and build privacy into custom websites. Contact us for a website review.
