DPDP Rules Website Compliance: India Checklist

In short: DPDP Rules website compliance in India is mostly about four things: a clear standalone privacy notice, consent that is opt-in and as easy to withdraw as to give, tighter security and breach handling, and deleting data you no longer need. The core duties start around 13 May 2027 (SCC Online), with some sources saying 14 May. You have roughly six months, and most of the work sits in your forms, banner, analytics, marketing lists and CRM.

This guide explains what the Digital Personal Data Protection (DPDP) Act, 2023 and the DPDP Rules, 2025 mean for an ordinary business website or app. It is a practical checklist, not legal advice. We are a digital agency, not a law firm.

What the DPDP Act and Rules are

The DPDP Act sets India's main rules for handling digital personal data. The Rules, notified by the Ministry of Electronics and IT (MeitY) in November 2025, fill in the practical detail: what a notice must say, how breaches are reported and how long data can be kept.

The law is not only for Indian companies. It applies to digital personal data linked to offering goods or services to people in India, wherever the business is based (Fisher Phillips). So an overseas brand selling to Indian customers through its website is likely in scope too.

In the law's language, your business is a Data Fiduciary (you decide why and how data is used). Your visitors and customers are Data Principals. Your hosting company, email tool and CRM provider are usually Data Processors acting for you.

The DPDP timeline: what starts when

The Rules come into force in three phases. Most Indian law firms give the dates as 13 November 2025, 13 November 2026 and 13 May 2027 (KS&K; SCC Online). Others, including India Briefing, list them as 14 November 2025, 14 November 2026 and 14 May 2027. The difference comes from which day is treated as the publication date. Plan for the earlier date to be safe.

Date	What comes into force	What it means for most businesses
13/14 Nov 2025	Definitions and the Data Protection Board of India framework (MediaNama)	No direct website changes yet
13/14 Nov 2026	Rule 4: registration and duties of Consent Managers (The Privacy Labs)	Nothing new to build. It is about the platforms, not about you
13/14 May 2027	Notice, consent, security, breach reporting, retention, children's data, user rights and penalties (The Privacy Labs)	Your website, forms, banner, marketing and CRM must comply

Will the deadline move earlier?

In early 2026, MeitY proposed cutting the 18-month runway to 12 months, which would have moved the deadline to 13 November 2026 (S.S. Rana & Co.). As of October 2026, no amendment had been published in the Gazette. Reports also differed on whether it would apply to everyone or only to large "Significant Data Fiduciaries" (The Privacy Labs). Check for updates before you finalise your plan.

A Consent Manager is a separately registered platform that lets a person manage their consents across many businesses. To register, a company must be incorporated in India with a net worth of at least ₹2 crore (KS&K). Ordinary businesses do not have to become one, or connect to one, on 13 November 2026. You may need to work with them later, once the core duties apply (The Privacy Labs).

What DPDP compliance means for your website and app

1. Your privacy notice

Notices must be clear and accessible and must explain what personal data you collect, the specific purposes, and how people can withdraw consent, use their rights or complain (SCC Online). They should stand alone and be kept separate from your general terms of service (Fisher Phillips). People can also ask for the notice in English or any of the 22 languages in the Eighth Schedule of the Constitution (Fisher Phillips).

Many website privacy policies are copied templates. Rewrite yours so each type of data is linked to one purpose. Our own privacy policy and cookie policy are examples of the plain-language style we aim for.

2. Contact and enquiry forms

The DPDP framework relies mainly on consent, plus a short list of "legitimate uses" (Fisher Phillips). Consent must be free, specific, informed, unconditional, unambiguous and given by a clear affirmative action (India Briefing). For forms, that usually means:

Ask only for the fields you need to answer the enquiry.
Show a short notice next to the submit button, linking to your privacy notice.
Keep marketing consent as a separate, unticked checkbox. Do not bundle it with "I agree to the terms".
Record when and how each person agreed, so you can prove it later.

The Act does not mention cookies by name. But its rules apply whenever cookies collect personal data such as user activity, IP addresses or device data (CyberPeace). For most sites, that means analytics, advertising pixels and session recording tools.

A sensible approach is a banner with "Accept" and "Reject" options of equal weight, cookies grouped into necessary, analytics and advertising, and no tracking tags firing before someone chooses. Withdrawing consent must be as easy as giving it (Fisher Phillips), so add a "Cookie settings" link in your footer. If your tags are set up through Google Tag Manager, our analytics and tracking work covers wiring them to consent properly.

4. Children's data

Under DPDP, anyone under 18 is a child, and processing their data generally needs verifiable parental consent (India Briefing). The Act also restricts tracking, behavioural monitoring and targeted advertising aimed at children. If you run an education, coaching, gaming or kids' product, this needs careful design and specific legal advice.

Marketing, WhatsApp, email and your CRM

Your marketing lists are where many businesses carry the most risk. A contact who filled in a form to ask one question has not automatically agreed to monthly newsletters or WhatsApp offers.

Email and WhatsApp: only send marketing to people who opted in, keep proof of that opt-in, and put a one-click unsubscribe in every message. Our email marketing and automation setups store consent with each contact.
CRM: tag every record with its source, purpose and consent status. When someone withdraws consent, it should stop all marketing tools at once, not just one. See our CRM management service.
Deletion: erase personal data once the purpose is complete or consent is withdrawn (Fisher Phillips). Old leads from years ago, spreadsheets and exported lists all count.
Vendors: processors must be contractually bound to keep proper safeguards (SCC Online). Review the terms of your email, CRM, form and chatbot providers.

Security, breaches and user rights

The Rules set minimum safeguards, including encryption, masking or tokenisation, access controls, logging and monitoring, and backups. They also require logs and data to be kept for one year (SCC Online). This is where ordinary website security and regular website maintenance become compliance tasks, not just good habits.

If there is a breach, you must inform affected people promptly and tell the Data Protection Board, with a detailed report within 72 hours of becoming aware of it (MediaNama). You need a written plan before an incident, not during one.

People can ask to access, correct or erase their data, and grievances must be answered within 90 days (SCC Online). You must also publish the contact details of your Data Protection Officer or another person who can answer data questions on your website or app (SCC Online).

Penalties

The penalties are fixed caps rather than a share of turnover (India Briefing). They go up to ₹250 crore for failing to keep reasonable security safeguards, up to ₹200 crore for failing to report a breach or breaking the rules on children's data, and up to ₹50 crore for other violations (Fisher Phillips).

DPDP Rules website compliance checklist

Use this list with your developer and, for anything unclear, your lawyer.

Map your data. List every place personal data enters: forms, checkout, chat, bookings, newsletter, analytics, ads pixels, CRM and spreadsheets.
Rewrite your privacy notice as a standalone page that links each type of data to a purpose and explains how to withdraw consent, use rights and complain.
Fix your forms: fewer fields, a short notice by the submit button, separate unticked marketing checkboxes, and logged consent.
Replace your cookie banner with an equal Accept / Reject choice, categories, no tags before consent, and a footer link to change settings.
Clean your marketing lists. Keep only contacts with provable opt-in. Re-ask the rest, or delete them.
Connect consent to your CRM so a withdrawal reaches every tool.
Set retention rules for leads, customers and logs, and automate deletion where you can.
Harden security: encryption, access controls, updates, backups and one-year logs.
Write a breach plan that covers who to tell, what to say and the 72-hour report.
Publish a contact for data questions and set up a way to handle requests within 90 days.
Check your vendors' contracts and where they store data.
Review children's data if any users might be under 18.

This is not legal advice

This article is general information for business owners, based on the public sources listed below as of 27 October 2026. It is not legal advice. The DPDP Rules may be amended, and how they apply depends on your sector, size and data. Please speak to a qualified data protection lawyer about your specific case.

Where to start

You do not need to rebuild everything at once. Start with the data map and the three things visitors see first: your privacy notice, your forms and your cookie banner. Then move to marketing lists, CRM and security before May 2027.

If you want help with the technical side, such as consent-aware forms, a proper cookie banner, tag setup or CRM cleanup, Rachyet can work alongside your legal adviser. Get in touch and tell us what your site uses today.

Sources

Frequently asked questions

When do the DPDP Rules apply to my business website?

The core duties for ordinary businesses, including notice, consent, security, breach reporting, retention and user rights, start 18 months after the Rules were published. Most sources give this as 13 May 2027, though some say 14 May 2027. A proposal to shorten the timeline to 12 months had not been notified as of October 2026, so keep checking for official updates.

Do I need to connect to a Consent Manager by November 2026?

No. The November 2026 phase covers the registration and duties of Consent Managers, which are separately registered platforms with their own eligibility rules. Ordinary businesses do not need to become one or integrate with one on that date. You may need to work with them later if your users choose to manage consent through one, once the core duties start in May 2027.

Does the DPDP Act require a cookie consent banner?

The Act does not mention cookies by name, but its consent rules apply when cookies collect personal data such as activity, IP addresses or device data. In practice, that covers most analytics and advertising tags. A banner with an equal accept and reject choice, no tracking before consent, and an easy way to change settings later is the sensible way to meet the consent standard.

Does DPDP apply to businesses outside India?

It can. The Act covers processing of digital personal data connected with offering goods or services to people in India, whatever country the business is based in. If your website sells to or takes enquiries from Indian customers, you should assume the law may apply and get advice on your specific situation from a qualified lawyer.

What are the penalties under the DPDP Act?

Penalties are fixed caps, not a share of turnover. They go up to ₹250 crore for failing to keep reasonable security safeguards, up to ₹200 crore for failing to report a breach or for breaking the rules on children's data, and up to ₹50 crore for other violations. The Data Protection Board decides the amount in each case.

DPDP Rules Website Compliance in India: A 2027 Checklist

What the DPDP Act and Rules are