India's Digital Personal Data Protection (DPDP) Act, 2023 and the DPDP Rules, 2025 decide how every business may collect and use personal data. If your website has a contact form, your app has a login or your sales team keeps leads in a spreadsheet, the law applies to you.
The good news: the main deadline is 13 May 2027, so you have time to fix things properly. The bad news: most of the work sits inside your website, app and CRM, and those changes take a few weeks to design, build and test. This guide turns the law into a practical checklist.
This article explains the rules in plain language for business owners. It is not legal advice. For your specific case, check the official text published by MeitY or speak to a lawyer.
Key DPDP dates
The three DPDP phases. Most website and app obligations apply from 13 May 2027.
| Date | What starts |
|---|---|
| 13 November 2025 | Rules notified; the Data Protection Board of India is set up |
| 13 November 2026 | Consent Manager registration and rules begin |
| 13 May 2027 | Core duties for every business: notices, consent, security, breach reporting, children's data, data principal rights, retention and erasure |
Commentators disagree on exactly when the Board can begin penalty proceedings, so the safe plan is to be ready well before May 2027 rather than on the day.
Who has to comply?
Every Data Fiduciary: any business or organisation that decides why and how personal data is processed. That includes:
- a coaching institute collecting student phone numbers,
- a clinic storing patient appointments,
- an online store with customer addresses,
- a SaaS product with user accounts,
- a foreign company selling to people in India.
Your developer, hosting company or CRM vendor is usually a Data Processor. You remain responsible for what they do with your customers' data, so your contracts with them matter too.
What the law asks of your website and app
1. A clear, itemised notice
Wherever you collect data, such as a contact form, sign-up page or checkout, you must show a notice that is easy to understand on its own. It should list:
- what data you collect (for example name, phone, email, address),
- why you collect each item (for example "to send your quote", "to deliver your order"),
- how to withdraw consent and how to exercise rights,
- how to complain to the Data Protection Board.
A long legal privacy policy linked in the footer is not enough on its own. Put a short notice right next to the form.
2. Consent that is free, specific and easy to withdraw
- No pre-ticked boxes. The person must actively agree.
- Separate consent for separate purposes. Agreeing to a quote must not silently sign someone up for marketing.
- Withdrawing consent must be as easy as giving it, for example an unsubscribe link or a toggle in account settings.
- Keep a record of when and how each person agreed.
3. Reasonable security safeguards
The Rules expect, at a minimum:
- encryption or masking of personal data,
- access control so only the right staff can see it,
- logs of who accessed what, kept for at least one year,
- backups and the ability to restore data after an incident,
- security terms in contracts with your vendors.
Our mobile app security checklist covers the technical side in more detail.
4. Breach reporting
If personal data leaks, you must:
- inform each affected person without delay, in plain language, with what happened and what they should do,
- send a detailed report to the Data Protection Board within 72 hours.
Failing to report a breach can cost up to ₹200 crore.
5. Children's data
If anyone under 18 may use your service, which is common for schools, coaching, gaming and e-learning, you need verifiable consent from a parent or guardian before processing their data. You also cannot track children's behaviour or target ads at them. If you run an e-learning platform, plan this into sign-up now.
6. Rights requests and grievances
People can ask to see, correct or delete their data and to nominate someone to act for them. You must publish a contact for these requests and resolve grievances within 90 days.
7. Retention and erasure
Delete personal data when the purpose is over or consent is withdrawn, unless another law requires you to keep it. Large e-commerce, gaming and social media platforms have specific timelines, including notice to the user 48 hours before deletion.
Penalties at a glance
Maximum penalties under the DPDP Act Schedule. Penalties apply per breach of duty.
| Violation | Maximum penalty |
|---|---|
| Failing to take reasonable security safeguards | ₹250 crore |
| Failing to report a personal data breach | ₹200 crore |
| Violating duties for children's data | ₹200 crore |
| Significant Data Fiduciary duties | ₹150 crore |
| Other breaches of the Act or Rules | ₹50 crore |
The DPDP website and app checklist
Use this as a working list with your developer.
Forms and sign-up
- Short itemised notice next to every form that collects personal data
- Separate, un-ticked checkbox for marketing messages
- Consent records saved with date, time and the notice version shown
- Only the fields you actually need (remove "date of birth" if you never use it)
Cookies and analytics
- Cookie banner with real Accept and Reject buttons
- Analytics and ad tags load only after consent, or in a privacy-safe mode
Accounts and CRM
- "Withdraw consent" and "Delete my data" options in the account or by email
- Role-based access in your CRM and admin panel
- Access logs kept for at least one year
- Old leads and inactive accounts deleted on a schedule
Security and incidents
- HTTPS everywhere, encrypted database and backups
- Written breach plan: who decides, who informs users, who reports to the Board within 72 hours
- Data protection clauses in contracts with hosting, CRM, email and WhatsApp providers
People and process
- Named grievance contact published on the site
- A way to verify parental consent if children may use the service
- Updated privacy policy that matches what the site really does
Where most businesses are exposed today
When we review small business websites, the same gaps appear again and again:
- Contact forms with no notice at all.
- Marketing consent bundled into "I agree to the terms".
- Leads exported to shared spreadsheets that anyone can open.
- No way to delete a customer's data on request.
- WhatsApp and email tools that keep data forever.
Each of these is a design and development fix, not just a policy document, which is why it makes sense to start now rather than in April 2027.
Get your website DPDP-ready
Susraj Tech builds and updates websites, mobile apps and custom software for Indian businesses. We can review your forms, consent flows, analytics tags and admin panels against this checklist and fix the gaps. Ask for a free DPDP website check and we will send you a short list of what needs to change.
