DPDP Act Compliance for Business Websites: A Practical Checklist for Indian Businesses

What is the DPDP Act, and does it apply to your website?

The Digital Personal Data Protection Act, 2023, usually called the DPDP Act, is India's first full law on personal data. Parliament enacted it on 11 August 2023. It governs how organisations collect, use, store and share personal data that is held in digital form, or collected offline and later digitised.

If your website has a contact form, a newsletter sign-up, a quote calculator, a chat widget, a login, a checkout or even an analytics tool that identifies visitors, you process personal data, and the Act applies to you. Size does not exempt you. A three-person clinic in Nashik collecting appointment requests online is covered just as a national retailer is, although the largest platforms carry extra duties.

The Act uses its own vocabulary. Your business is a Data Fiduciary, because it decides why and how the data is used. The visitor is a Data Principal. A company that handles data on your behalf, such as your hosting provider, CRM or email platform, is a Data Processor. You remain responsible for what your processors do with the data you give them.

When do the DPDP Rules take effect?

The Act needed rules to work in practice, and the government notified the Digital Personal Data Protection Rules, 2025 on 14 November 2025 after a consultation that, according to the Press Information Bureau, received 6,915 inputs. The rules come into force in three stages.

• Immediately on notification: the rules that set up the Data Protection Board of India and how it works.
• One year later, in November 2026: the rule on registration and obligations of Consent Managers.
• Eighteen months later, around May 2027: the rules most businesses care about, covering notices, security safeguards, breach intimation, data retention, contact details, children's data and the rights of individuals.

What personal data does a typical business website collect?

More than most owners realise, because much of it is collected by tools rather than by the site itself. The first practical step is a data inventory: a simple sheet listing every place personal data enters the business through the website, what is collected, why, where it goes and who can see it.

Take a Pune interior design studio as an illustration. The studio is invented for this example, but the list is typical. Its website has an enquiry form asking for name, phone, email, budget and a description of the home. A WhatsApp chat button opens a conversation on the studio's business number. A cost calculator asks for the size of the flat and an email address to send the estimate. Google Analytics and the Meta pixel run on every page. Enquiries flow into a CRM, and a weekly newsletter goes out through an email platform. That is at least six systems holding personal data, each needing a purpose and a safeguard.

• Forms: contact, quote, booking, careers and newsletter forms.
• Chat: website chat widgets, chatbots and WhatsApp click-to-chat.
• Accounts and orders: logins, checkout, addresses and order history.
• Tracking: analytics, advertising pixels and session recording tools.
• Back office: CRM, email marketing, spreadsheets, shared inboxes and backups.

When do you need consent, and when is it not required?

The Act allows processing on two broad grounds: consent, or what it calls certain legitimate uses. One legitimate use is especially relevant to websites. If a person voluntarily gives you their data for a specified purpose and has not said they object, you may use it for that purpose. The Act's own illustration is a pharmacy customer who gives her mobile number to receive a payment receipt. The pharmacy may send the receipt.

Applied to a website, someone who fills in your enquiry form to get a quote can be contacted about that quote. What you cannot assume is permission for anything else. Adding that person to a promotional newsletter, sending marketing WhatsApp messages, sharing their details with a partner or using them for targeted advertising needs separate consent.

Where consent is the basis, the Act sets a high bar. Consent must be free, specific, informed, unconditional and unambiguous, signified by a clear affirmative action, and limited to the data needed for the purpose. The Act gives a telemedicine example: an app that also asks for access to the user's contact list gets no valid consent for the contacts, because they are not needed for the service.

• Use an unticked checkbox for marketing consent. Pre-ticked boxes and consent hidden in terms and conditions do not meet the standard.
• Ask for marketing consent separately from the enquiry itself, so a person can get a quote without joining a mailing list.
• Collect only the fields you need. If you do not use a date of birth, do not ask for it.

What must your privacy notice say?

Before or at the time you ask for consent, the Act requires a notice. The Rules say it must stand on its own, be understandable without reading other documents and be written in clear and plain language. At a minimum it must give an itemised description of the personal data, the specific purposes and the goods, services or uses the processing enables.

It must also tell people how to withdraw consent, how to exercise their rights and how to complain to the Data Protection Board, with the link to the relevant page on your website or app. The Act requires you to offer the notice in English or in any of the 22 languages in the Eighth Schedule to the Constitution, which matters for businesses serving customers in Hindi, Marathi, Tamil and other languages.

For a website, this usually means a short notice next to each form, with a link to a fuller privacy page, rather than a single legal document nobody reads.

• What you collect, item by item, such as name, mobile number, email and project details.
• Why you collect it, purpose by purpose.
• How to withdraw consent, with a link or button.
• How to access, correct or erase data, and how to raise a grievance.
• How to complain to the Data Protection Board.
• Contact details of the person who answers privacy questions.

How should withdrawal of consent and data requests work?

The Rules require that withdrawing consent be as easy as giving it. If consent was given with one tick on a form, it cannot be withdrawn only by sending a registered letter. Practical options are an unsubscribe link in every marketing email, STOP handling on WhatsApp and SMS, and a settings page for logged-in users.

Individuals can also ask to access a summary of their data, have it corrected or updated, have it erased in certain situations and nominate someone to act for them. The Rules require you to publish how these requests can be made and to respond to grievances within a period not exceeding 90 days.

Every Data Fiduciary must also publish, prominently on its website or app, the business contact details of a person who can answer questions about how personal data is processed, or of its Data Protection Officer where one is required. For a small business this can be a named role and a dedicated email address.

What security safeguards do the Rules expect?

The Rules list minimum safeguards rather than a single technical standard. They include protecting data through measures such as encryption, masking or tokenisation; controlling access to the systems that hold it; keeping logs and monitoring so that unauthorised access can be detected and investigated; backups and measures to keep working after an incident; and contracts with your processors that require reasonable safeguards.

Logs and the related personal data used for detecting and investigating unauthorised access must be kept for one year, unless another law requires otherwise. The Rules also require Data Fiduciaries to retain personal data, traffic data and processing logs for at least one year for purposes listed in the Rules.

For a website, the practical list is familiar: HTTPS everywhere, an up-to-date CMS and plugins, strong passwords and two-factor authentication for admins, form submissions stored in a protected system rather than a shared inbox, limited staff access, regular backups and a hosting provider that keeps access logs. Our website maintenance work covers much of this routine.

What happens if there is a data breach?

A personal data breach includes any unauthorised access, disclosure, alteration, loss or destruction of personal data, from a hacked database to a spreadsheet of enquiries emailed to the wrong person.

On becoming aware of a breach, you must inform each affected person without delay, in plain language, through their account or a contact method they registered with you. The message must describe the breach, its likely consequences for them, what you are doing about it, what they can do to protect themselves, and who to contact.

You must also inform the Data Protection Board without delay, and within 72 hours of becoming aware of the breach send a detailed report covering the facts, the cause, the steps taken, the person responsible if known and the notices sent to affected people. The Board can allow longer on a written request. Failing to report a breach can attract a penalty of up to ₹200 crore, so write a one-page breach plan now, while nothing is wrong.

What about children's data?

Under the Act a child is anyone under 18, not 13 as in many other countries. Before processing a child's personal data, you need verifiable consent from a parent or lawful guardian, and the Rules describe how to check that the person giving consent is an identifiable adult. The Act also prohibits tracking, behavioural monitoring and targeted advertising directed at children.

This matters most for schools, coaching institutes, edtech platforms, gaming, youth sports and children's products. If students under 18 can register on your site, the sign-up flow needs a parental consent step, and advertising pixels should not track those users. Some classes of processing, such as certain educational and healthcare uses, have exemptions set out in the Rules. Violations of obligations relating to children can attract penalties of up to ₹200 crore.

How does DPDP affect WhatsApp, email and SMS marketing?

Marketing is where most Indian businesses will need to change habits. Buying lists, adding every enquiry to a promotional broadcast and messaging people who never asked are hard to justify under a law that requires specific consent for each purpose.

The good news is that permission-based marketing also performs better. WhatsApp itself requires businesses to have the user's opt-in before sending messages through the WhatsApp Business Platform. Recording when, where and for what each person opted in, and honouring opt-outs immediately, satisfies both WhatsApp's policies and the spirit of the Act.

Our WhatsApp and email marketing services build consent capture, opt-out handling and records into every campaign, so growth and compliance do not pull in opposite directions.

What did we change on our own website?

We applied these principles to quaventotechnologies.com, and you can check each one. Our cookie banner asks before turning on Google Analytics, and the same choice controls whether conversations with Buddy, our website assistant, are saved. If a visitor declines, chats are not stored. When a visitor sends their details through Buddy, a short note explains how they will be used, with a link to the privacy policy, and Buddy asks only for what we need to reply.

Submissions go into a database that the website can write to but cannot read back. Reading them requires a signed-in team member, which limits who can see personal data. The way the assistant and its back end were built is described in our Buddy chatbot case study.

We are not claiming this makes our site, or anyone's, fully compliant. It is a practical start that took days, not months, and every business website can do something similar now.

What is a practical DPDP checklist for your website?

Work through this list over the next few months, with your developer and, for the legal wording, your lawyer.

• Inventory: list every form, widget, tool and back-office system that touches personal data.
• Minimise: remove form fields and tracking you do not genuinely use.
• Notices: add a plain-language notice beside each form and a full privacy page, with other languages if your customers need them.
• Consent: use unticked, separate checkboxes for marketing and keep a record of each consent.
• Cookie and tracking controls: let visitors decline analytics and advertising tags, and make sure declining actually stops them.
• Withdrawal and rights: add unsubscribe and opt-out paths, and a simple way to request access, correction or erasure.
• Contact: publish the contact details of the person who answers privacy questions.
• Security: HTTPS, updates, two-factor admin logins, limited access, backups and log retention.
• Processors: review contracts with your hosting, CRM, email and WhatsApp providers.
• Breach plan: a one-page plan naming who does what in the first 72 hours.
• Children: add parental consent if anyone under 18 can sign up.

Where should you start?

Start with the inventory, because every other step depends on knowing what you hold. Many businesses find that the quickest wins are removing data they never use and moving enquiries out of shared inboxes into a protected system.

If your site is old or built on many plugins, it may be simpler to rebuild with privacy designed in. Our website development company in India page explains how we plan such projects, and our guide to website development cost in India covers what drives the budget. For applications that hold customer accounts or health, finance or student data, see our software development company in India page. Accurate, consent-aware analytics is covered by our GA4 setup service, and businesses in Pune can speak to us directly through our website development company in Pune page.