Guide / DPDP Act for websites
The DPDP Act checklist for websites:
fifteen checks before 13 May 2027.
India’s Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 cover any business that collects personal data through a website, whatever its size. The duties that touch a website apply from 13 May 2027. This list ties each one to the section or rule it comes from, and to what changes on the site.
Web Vogue Technologies, Hyderabad · Last updated 22 October 2026
We build these features into websites. We are not lawyers, and this is not legal advice. Each item names the section of the Act or the rule in the Rules it comes from, so you can read the text yourself. Where a line is our reading rather than the text, it says so.
The dates
When the DPDP Rules
come into force.
The Rules were published on 13 November 2025. Rule 1 sets three start dates: on publication, one year later and eighteen months later.
13 November 2025
The Rules are notified. Rules 1, 2 and 17 to 21, which set up the Data Protection Board of India, apply at once.
13 November 2026
Rule 4 applies: the registration and duties of Consent Managers.
13 May 2027
Rules 3, 5 to 16, 22 and 23 apply: the notice, security safeguards, breach reporting, retention, the privacy contact, children and rights. For most websites this is the date that matters.
Who it covers
If your website has a form,
it almost certainly applies.
Section 3 applies the Act to digital personal data processed in India, and to processing outside India connected with offering goods or services to people in India. A contact form, a booking form, a newsletter sign-up and an analytics tag all collect personal data in digital form.
It does not apply to data processed for personal or domestic purposes, or to data the person made public themselves. The Act sets no size threshold for these duties. Section 17(3) lets the government exempt some businesses, including startups, from a few of them by notification.
The Act calls the business that decides why and how data is processed the Data Fiduciary, the person the data is about the Data Principal, and a service that processes it on the business’s behalf a Data Processor.
The checklist
Fifteen things your website
should do by 13 May 2027.
- 01
Serve every page over HTTPS
Rule 6(1)(a)
Reasonable security safeguards include encryption. A form on a plain HTTP page sends what the visitor types in the clear. Redirect HTTP to HTTPS on every URL.
- 02
Publish a notice that stands on its own
Section 5, Rule 3(a)
The notice must be understandable without reading anything else, so not a paragraph inside your terms of service. Link it from every form and from the footer.
- 03
Itemise the data and the purpose
Rule 3(b)
List each item you collect, such as name, phone, email, message and analytics identifiers, and say what each is for and what service it enables. A general line about collecting information does not meet it.
- 04
Link to withdraw, to exercise rights and to complain
Rule 3(c)
The notice must give the link or other means to withdraw consent, to exercise rights under the Act, and to complain to the Data Protection Board.
- 05
Offer the notice in English or an Indian language
Sections 5(3) and 6(3)
A person must have the option to read the notice and the consent request in English or in any language in the Eighth Schedule to the Constitution.
- 06
Ask for consent with an action, not a default
Section 6(1)
Consent must be free, specific, informed, unconditional and unambiguous, with a clear affirmative action. Use an unticked box, and ask only for what the purpose needs: the Act’s own example strikes out a telemedicine app’s request for the contact list.
- 07
Make withdrawing as easy as agreeing
Section 6(4)
If consent took one click on a banner, withdrawing should take about one click too. A Cookie settings link in the footer that reopens the banner does this.
- 08
Hold analytics and ad tags until the visitor agrees
Sections 4 and 6
Personal data may be processed only with consent or for a legitimate use. Analytics and advertising tags serve your purposes, not the visitor’s, so in our reading they need consent before they load. Load them only after Accept, and stop them after a withdrawal.
- 09
Use enquiry data for the enquiry
Section 7(a)
A visitor who sends a form to ask for a quote has voluntarily provided data for that purpose, and section 7(a) lets you use it to reply. Adding them to a newsletter or passing them to a partner is a new purpose and needs consent.
- 10
Name a person who answers privacy questions
Section 8(9), Rule 9
Publish prominently the business contact of your Data Protection Officer, if you have one, or of a person who can answer for the business. Repeat it in every reply to a rights request.
- 11
Say how to make a request, and how fast you answer
Rule 14(1) and (3)
Publish how a person asks to see, correct or erase their data, which identifier you need, such as the email address they used, and your response time for grievances. The Rules cap it at ninety days.
- 12
Erase what you no longer need, but keep the logs a year
Section 8(7), Rules 6(1)(e) and 8(3)
Erase personal data when consent is withdrawn or the purpose is served, and have your processors erase it too. Rule 8(3) also requires keeping the data and logs of each processing for at least one year from the date of processing, so the later of the two decides. State the period in the notice.
- 13
Put every processor under a contract
Section 8(2), Rule 6(1)(f)
Your host, form service, email provider and analytics tool process data on your behalf. Use them only under a valid contract that covers security safeguards. For most online tools that is their data processing agreement.
- 14
Have a breach plan with a 72-hour clock
Section 8(6), Rule 7
Tell each affected person without delay what happened, what it means for them and what they can do. Tell the Board without delay, and send the detailed report within 72 hours of becoming aware.
- 15
Keep children out, or get a parent’s consent
Section 9, Rule 10
A child is anyone under 18. Processing a child’s data needs verifiable consent from a parent, and tracking, behavioural monitoring and targeted advertising directed at children are not allowed. A business-to-business site can say it is not meant for under-18s.
Penalties
What a breach
can cost.
The Schedule to the Act sets the maximum penalty for each kind of breach. The Data Protection Board decides the amount in each case.
Failing to take reasonable security safeguards, section 8(5)
Up to ₹250 crore
Failing to notify the Board or affected people of a breach, section 8(6)
Up to ₹200 crore
Breaching the additional duties on children, section 9
Up to ₹200 crore
Breaching the duties of a Significant Data Fiduciary, section 10
Up to ₹150 crore
Any other breach of the Act or the Rules
Up to ₹50 crore
Large platforms only
The three-year
erasure rule.
The Third Schedule to the Rules adds a fixed deadline for three classes: e-commerce entities with at least two crore registered users in India, online gaming intermediaries with at least fifty lakh, and social media intermediaries with at least two crore. They must erase a user’s data three years after that user last approached them, and warn the user at least 48 hours before, under Rule 8(2).
Most business websites are in none of these classes. For them, section 8(7) and the one-year minimum in Rule 8(3) decide how long data is kept.
Check your own site
See which of these
your site already passes.
Our free DPDP compliance checker reads a website’s public pages and scores the items a visitor can see: HTTPS, the notice, the privacy contact, rights, the Board, retention, children, the consent banner, trackers and forms.
It cannot see contracts, real retention, security controls or a breach plan. Those need someone inside the business.
An example
A notice written
for the Act.
Our own privacy notice follows this list: an itemised table of what each form collects and why, the four processors named, a privacy and grievance contact, the rights and how to use them, a retention period, and a cookie banner that holds analytics until a visitor accepts.
Common questions
Questions about the DPDP Act and websites, answered.
Does the DPDP Act apply to a small business website?
Yes, if the site collects personal data of people in India in digital form, such as through a contact form, a booking form or analytics. The Act sets no size threshold for these duties, although section 17(3) lets the government exempt some businesses, including startups, from a few of them by notification.
When do the website obligations start?
On 13 May 2027, eighteen months after the DPDP Rules were published on 13 November 2025. That date covers the notice, security safeguards, breach reporting, retention, the privacy contact, children and rights.
Do I need a cookie banner under the DPDP Act?
The Act does not mention cookies. It allows processing only with consent or for a legitimate use. Analytics and advertising tags collect data about visitors for the business, so in our reading they need consent before they load. A site that loads no such tools needs no banner.
Is a GDPR privacy policy enough?
Not as it stands. A DPDP notice must itemise the data and its purpose, link to withdrawal, rights and a complaint to the Data Protection Board of India, and offer English or a language in the Eighth Schedule. A GDPR template names a European regulator and leaves out the right to nominate.
How long can I keep contact form enquiries?
Erase them once the purpose is served or consent is withdrawn, but Rule 8(3) also requires keeping the data and logs of each processing for at least one year from the date of processing. Enquiries that do not become work are therefore commonly erased about twelve months after the last contact.
What is the penalty for not complying?
Up to 250 crore rupees for failing to take reasonable security safeguards, up to 200 crore for failing to notify a breach or for breaching the duties on children, and up to 50 crore for any other breach of the Act or the Rules.
Sources
- Ministry of Electronics and IT, The Digital Personal Data Protection Act, 2023 (No. 22 of 2023) (Gazette of India, 11 August 2023)
- Ministry of Electronics and IT, Digital Personal Data Protection Rules, 2025, G.S.R. 846(E) (Gazette of India, 13 November 2025)
Checked against each source on 22 October 2026.
Need it built?
We add the notice, consent and requests to your site.
The privacy notice, the consent banner, consent records on every form and a rights request process, built into your site and handed over with the code.
More guides
Every guide is listed on the guides page.