What the DPDP Act means for your website

India's Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 apply to almost every business with a website that collects names, phone numbers or emails, or runs analytics. Here is what that means in practice, in plain English.

General information, not legal advice. Last reviewed November 2026.

Does it apply to my business?

Very likely. The Act covers personal data in digital form: anything that identifies a person, such as a name, mobile number, email address or IP address. If your website has an enquiry form, a newsletter sign-up, a chat widget, a login, or Google Analytics, you are processing personal data and you are a data fiduciary under the Act. Size doesn't matter; there is no small-business exemption for websites.

When does it start?

The Rules were notified in November 2025 and come into force in stages. The duties that matter most for websites (notice, consent, security, breach reporting, grievance handling) apply from May 2027, eighteen months after notification. The Data Protection Board has existed since the Rules were notified.

What your website needs

1. A clear privacy notice

Before you collect personal data, tell people, in clear and plain language and on its own page:

• exactly what personal data you collect, and what you use each item for;
• how they can withdraw consent, as easily as they gave it;
• how they can exercise their rights (access, correction, erasure, nominating someone) and raise a grievance with you;
• how they can complain to the Data Protection Board of India.

Link it from every page, usually in the footer, and next to every form.

2. Consent that is real

Consent has to be free, specific, informed, unconditional and unambiguous, given by a clear action. For a website this means:

• Trackers wait. Analytics and advertising scripts (Google Analytics, Meta Pixel and similar) must not load until the visitor agrees.
• “Reject” is as easy as “Accept”. Same size, same place, no tricks.
• No pre-ticked boxes on forms.
• Withdrawal is always available, for example a “Privacy settings” link on every page.

3. Forms that explain themselves

Every form that asks for personal data should say, next to the submit button, what the details will be used for and link to the notice. Ask only for what you need.

4. Name the outside services

Analytics, chat widgets, captcha, embedded videos, payment gateways: each one receives your visitors' data. Your notice should say which services you use and why.

5. A grievance contact

Publish who people can contact about their data, with an email address, and reply within a reasonable time.

6. Keep data only as long as you need it

Decide how long you keep enquiries, newsletter lists and logs, say so, and delete data when the purpose is over.

7. Reasonable security, and a breach plan

Use HTTPS, keep your website software up to date and protect the admin login. If personal data leaks, the Rules expect you to inform the Board and the people affected without delay; have a plan ready.

8. Children

For anyone under 18 you need verifiable consent from a parent or guardian, and you may not track children's behaviour or target ads at them. If your site isn't meant for children, say so.

What happens if I ignore it?

The Data Protection Board can impose penalties of up to ₹250 crore for failing to take reasonable security safeguards, and up to ₹50 crore for most other breaches of the Act. Beyond fines, customers increasingly expect it, and larger companies now ask their vendors about it.

What this guide doesn't cover

The Act applies to all personal data you handle, not only your website: customer records, your CRM, WhatsApp, staff data, vendors. Large companies may also be named “significant data fiduciaries” with extra duties. For advice on your business as a whole, speak to a lawyer.