The key points
- The Act was passed in August 2023 and the Rules were notified on 13 November 2025, with most business duties starting eighteen months later.
- Every enquiry form, signup and checkout is a point of collection that needs a clear, standalone notice and a specific purpose.
- Your hosting, CRM, email and chatbot vendors are Data Processors, and the Act says you may use them only under a valid contract.
- Breaches must be reported to affected people and to the Data Protection Board, with a detailed report within seventy-two hours.
- This is a practical summary as of November 2026, not legal advice. Have a lawyer review your notices and contracts.
Does the DPDP Act apply to a small business website?
Almost certainly yes. The Act applies to digital personal data processed in India, and to processing outside India when it relates to offering goods or services to people in India. There is no small-business exemption for the core duties. A contact form that asks for a name, phone number and email is collecting personal data, and the business that decides why and how it is used is the Data Fiduciary.
That covers more than the obvious forms. A WhatsApp chatbot that captures a phone number, an appointment booking widget, newsletter signups, a careers form with CV upload, and the analytics and ad pixels that tie behaviour to an identifiable person all count. Start by listing every place your website or app takes in data, because the rest of the work follows from that list.
When do the obligations actually start?
The timeline is phased, which is why many businesses think the law is not in force yet. The Act was passed on 11 August 2023. The government notified the DPDP Rules on 13 November 2025, and the Press Information Bureau described an eighteen-month phased compliance timeline.
The Rules spell out the phases. Rules 1, 2 and 17 to 21, which set up the Data Protection Board, took effect on publication. Rule 4, on Consent Managers, takes effect one year after publication, around 13 November 2026. Rules 3 and 5 to 16 and 22 and 23, which hold the notice, security, breach and retention duties a normal business cares about, take effect eighteen months after publication, around 13 May 2027.
Eighteen months sounds generous until you count the systems involved. Changing forms is quick. Renegotiating vendor contracts, building an erasure process into a custom CRM or admin panel, and setting up log retention take longer, so start the inventory now.
What has to change on your forms and checkout?
The notice is the visible part. Rule 3 says the notice must stand on its own, be in clear and plain language, list the personal data and the specific purpose for each item, and give a link to withdraw consent, exercise rights and complain to the Board. Withdrawing consent has to be as easy as giving it.
The Act also says consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action. A pre-ticked box fails that test. So does a single tick that bundles a quote request with permission to send marketing messages forever. Ask for the minimum: if you only need a phone number to call back, the date of birth field goes.
People must be able to read the notice in English or in any language in the Eighth Schedule to the Constitution. If your customers write to you in Telugu or Hindi, a notice they can read in that language is the honest default.
- A short notice next to each form, written for that form's purpose
- Separate, unticked choices for marketing messages
- A visible way to withdraw consent and to contact a named person
- No collection of fields you do not use
What about the tools behind the website?
This is where most of the risk sits, because data rarely stays on the website. It moves into email, a CRM, a spreadsheet, an ad platform and sometimes an AI model. Under the Act, each of those vendors is a Data Processor, and section 8 says you may engage one only under a valid contract. You remain responsible for what they do with the data.
Rule 6 sets minimum security safeguards: encryption or masking, access control, logs that let you detect and investigate unauthorised access, backups for continued processing, and keeping those logs for one year unless another law says otherwise. It also says your contracts with processors should cover reasonable security safeguards. If you are adding AI features to your product, the model provider joins that list.
Children's data is stricter. Before processing data of anyone under eighteen, you need verifiable consent from a parent or guardian, with narrow exemptions. Schools, coaching centres and apps used by teenagers should plan for this first.
What happens if there is a breach?
Rule 7 has two audiences. You must tell each affected person, without delay and in plain language, what happened, the likely consequences, what you are doing about it, what they can do, and who to contact. You must also tell the Data Protection Board without delay, and then send a detailed report within seventy-two hours of becoming aware, unless the Board allows longer.
The penalty schedule in the Act goes up to two hundred and fifty crore rupees for failing to take reasonable security safeguards. Fines at that level are aimed at large failures, but the practical point for a small business is simpler: if you cannot tell what data you hold and where, you cannot meet a seventy-two-hour deadline.
How to prepare a website or app for DPDP
Inventory the collection points
List every form, chatbot, booking tool, pixel and import that takes in personal data, and what each field is for.
Cut what you do not need
Remove fields and tracking that do not serve a stated purpose. Less data means less to secure and erase.
Rewrite the notices
Write a standalone notice for each purpose, with separate opt-ins for marketing and a link to withdraw consent.
Map the processors
List the vendors that receive the data, from hosting to CRM, and check each contract covers security and erasure.
Build the operational pieces
Add erasure, access-request handling, log retention for a year and a written breach plan with named owners.
Review before May 2027
Have a lawyer check notices and contracts, then test that withdrawal and erasure actually work end to end.
DPDP readiness checklist
- Every form has its own plain-language notice
- Marketing consent is separate and never pre-ticked
- Withdrawing consent is as easy as giving it
- Each vendor that receives personal data is under a written contract
- Access logs are kept for one year
- A breach plan names who informs users and the Board
- Data of under-eighteens has verifiable guardian consent
- Notices are available in the languages your customers use
Sources
Rules and guidance this answer relies on. Policies change, so check the current version before acting on it.