Yes, the Digital Personal Data Protection Act, 2023 applies to almost every Indian business website that collects a name, phone number or email address. For a normal site, compliance comes down to seven things: a clear notice at every form, a separate opt-in for marketing, no advertising tags firing before consent, a privacy policy that matches what you actually do, a published contact for data requests, a retention schedule and a written breach plan. Most of it is text and process, not a new website.
We build websites; we are not lawyers. Confirm anything that affects your business with a data protection lawyer.
Where the law stands as of 2026
The Act received Presidential assent in August 2023 and is law. The DPDP Rules were notified by the Ministry of Electronics and Information Technology (MeitY) in November 2025 with phased start dates. As widely reported, the Data Protection Board provisions took effect first, while most website-facing duties — notices, security, breach reporting, retention, grievances — were given about 18 months, which would mean around mid-2027. The government can change these dates, so check the current MeitY notification before planning around one.
Meanwhile, the 2011 rules under the Information Technology Act still apply and already expect a published privacy policy, so “not in force yet” is no excuse for having nothing.
Penalties are financial, imposed by the Data Protection Board of India. The Act’s Schedule caps each category of failure; the highest cap is up to ₹250 crore, for failing to take reasonable security safeguards to prevent a personal data breach. These are ceilings: the Board weighs the nature, gravity and duration of the breach, the data involved and what you did to limit harm.
Does it apply to your website?
If you decide why and how personal data is collected, you are a “Data Fiduciary”; the people whose data you hold are “Data Principals”. There is no general small-business exemption. The Act lets the government exempt certain classes, including startups, from some duties by notification; do not assume one covers you until you see it in writing.
Three points people miss. The Act covers data collected offline and later digitised, so visiting cards typed into a spreadsheet count. Your vendors — hosting, form tool, email service, CRM, WhatsApp API provider — are usually your “Data Processors”, and you stay responsible for what they do. And extra duties for “Significant Data Fiduciaries” apply only to entities the government notifies, which a normal business website is unlikely to be.
What each part of a typical website needs
| Website element | Personal data involved | What to change |
|---|---|---|
| Contact or enquiry form | Name, phone, email, message | Short notice beside the button; fewer fields; separate unticked box for marketing |
| WhatsApp click-to-chat button | Number and name, once they message you | Mention it in the privacy policy; no broadcasts without opt-in |
| Newsletter or offers sign-up | Email or phone | Purpose-specific consent, easy unsubscribe, a record of consent |
| Analytics | Device identifiers, usage data | List it in the policy; consider loading it after consent |
| Ad pixels and remarketing tags | Browsing behaviour shared with ad platforms | Block until the visitor accepts |
| Job application form | CVs, addresses, salary history | Separate notice; delete rejected applications on schedule |
| Login, checkout or booking | Accounts, addresses, orders | Full notice, account deletion route, strong security |
Contact forms
The Act’s “legitimate uses” provision covers data a person gives voluntarily for a specified purpose, so replying to an enquiry is on reasonably safe ground. Anything beyond that — a WhatsApp broadcast list, a newsletter, passing leads to a partner — needs consent, and consent must be free, specific, informed, unconditional and unambiguous, given by a clear action. A pre-ticked box fails that test. So does one checkbox bundling terms, privacy policy and marketing.
Cut the fields too: consent covers only the data needed for the stated purpose, and every extra field lowers your enquiry rate anyway.
WhatsApp buttons
A click-to-chat link collects nothing on the website itself. But once a visitor messages you, their number sits in your WhatsApp and you are responsible for it. The real risks are staff phones full of customer chats, numbers exported into spreadsheets, and broadcast lists built without opt-in, which WhatsApp’s own business policy also requires. An API provider or CRM handling your WhatsApp is your processor; read its data terms.
Cookies, analytics and ad pixels
The Act has no cookie-specific rule like Europe’s, and whether cookie identifiers count as personal data is not settled. The safe reading: strictly necessary cookies (logins, carts, security) are fine; analytics is a judgement call; ad pixels that share behaviour with Meta or Google for remarketing should wait for consent. A banner with equal “Accept” and “Reject” buttons, where tags genuinely stay blocked until acceptance, is the defensible setup. If you run Google Ads, pair it with consent-aware tracking — see our conversion tracking guide.
Honest note: a brochure site with no ad pixels does not need a paid consent platform; a free, well-configured banner is enough. If your site serves under-18s, the stakes rise. The Act requires verifiable parental consent and bars tracking, behavioural monitoring and targeted advertising directed at children. The Rules allow limited sector exemptions, so take legal advice before adding any tracking.
Consent notices and your privacy policy
The notice at the point of collection must say what data you collect and why, how people can withdraw consent and exercise their rights, and how they can complain to the Board. Withdrawing must be as easy as consenting. The Act also gives people the option to read the notice in English or any of the 22 languages in the Eighth Schedule. How strictly that will apply to small websites is not yet clear; at minimum, offer English plus your customers’ main language.
A privacy policy template is a fine start, but it must describe your business; the common failure is a copied policy mentioning GDPR and a foreign address but not the real vendors. Cover who you are, what you collect and why, the basis (consent or legitimate use), which processors receive data, retention periods, how to access, correct or erase data, your grievance contact and how to reach the Board. Keep dated versions.
Retention, grievances and breaches
Data retention
Personal data must be erased once the purpose is served or consent is withdrawn, unless a law requires you to keep it. Tax records follow tax law — ask your CA. For everything else, choose a period and write it down, for example deleting unconverted enquiries after a set number of months. The Rules also require processing logs to be kept for a minimum period (one year, as notified in 2025), so do not wipe everything the day a lead goes cold.
Remember the copies: a form submission usually lives in the website database, an inbox, a Google Sheet, a CRM and someone’s phone. Retention has to cover all of them.
Grievance contact
Publish contact details for someone who can answer data questions and handle complaints; people must approach you before going to the Board. A dedicated email address, a named role and a stated response time on your contact and privacy pages is enough for most businesses. The Rules, as notified, set an outer limit of 90 days; a well-run business replies in days.
Breach handling
A “personal data breach” is broad: a hacked site, a lead sheet shared with “anyone with the link” or ransomware with no backup can each count. Unlike Europe’s GDPR, there is no threshold below which you can skip reporting: you must inform the Board and every affected person. The Rules, as notified, ask for notice to affected people without delay and a detailed report to the Board within 72 hours of becoming aware. Write a one-page plan now: who decides, who informs, who fixes the site. For the technical side on WordPress, see fixing and preventing a hacked WordPress site.
Also own your logins. If your agency holds the hosting and domain accounts, you cannot act fast after a breach. At Codelith Lab we create the domain, hosting and every login in the client’s name for this reason; whoever builds your site, insist on the same.
The DPDP website checklist
- Map your data: every place it enters (forms, WhatsApp, chat, calls) and every place it ends up (inbox, sheets, CRM, phones).
- Cut form fields to what the stated purpose needs.
- Add a short notice beside every form button, linked to the privacy policy.
- Separate marketing consent into its own unticked checkbox.
- Store proof of consent: timestamp, form name and notice version.
- Block ad pixels until the visitor accepts; make “Reject” as easy as “Accept”.
- Rewrite the privacy policy to match your real vendors, purposes and retention.
- Offer the notice in English and your customers’ main language.
- Publish a grievance contact and response time.
- Give people a route to withdraw consent and request access, correction or erasure.
- Review vendor terms for hosting, forms, email, CRM and WhatsApp providers.
- Set retention periods and a quarterly clean-up that includes sheets and phones.
- Secure the basics: HTTPS, two-factor login on admin and hosting, updates, backups, limited staff access.
- Write a breach plan with names, message templates and reporting steps.
- Check for children: if under-18s use your site, get advice before any tracking.
What this costs, honestly
You do not need a new website to comply. On a typical brochure site, items 2 to 10 are a few hours of developer time plus a lawyer’s review of your policy and notice text — worth paying for if you handle health, financial or children’s data. The Act provides for no official “DPDP certified” website badge, so treat anyone selling one as marketing. The harder work is internal: who can see the lead sheet, and whether anyone ever deletes it.
If you are rebuilding anyway, put these items in the written scope, not “later”. For reference, our pricing starts at ₹24,999 plus GST for a Business Website; the website cost calculator shows the rest. Customer accounts, patient records or portals are custom software territory and need proper data design, not just a banner. Planning a first site? Start with this guide to small business websites.
The short version
- The DPDP Act, 2023 is law and covers almost any website that collects names, numbers or emails; the Rules (notified November 2025) phase in, so check MeitY’s current notification.
- Replying to an enquiry is generally fine; marketing, broadcasts and ad tracking need clear, separate consent.
- Publish an honest privacy policy, a grievance contact and retention periods, and keep a breach plan ready.
- Most fixes are text and process, not a rebuild; penalties can reach ₹250 crore, but a messy lead sheet is the likelier problem.
Frequently Asked Questions
Does the DPDP Act apply to a small business website in India?
In most cases, yes. If your website collects a name, phone number or email address through a form, chat or sign-up, you are processing digital personal data and count as a Data Fiduciary. The Act has no general small-business exemption, though the government can exempt certain classes, including startups, from some duties by notification. As of 2026, check whether any such notification actually covers you before relying on it, and confirm with a lawyer.
Is a cookie banner mandatory under the DPDP Act?
The Act has no cookie-specific rule, so there is no single legal line saying every site needs a banner. But if your site runs advertising pixels or remarketing tags that track visitors and share data with platforms such as Meta or Google, consent is the safe basis, and a banner is the practical way to collect it. A site with only essential cookies and basic analytics carries far lower risk and can use a simple, free banner.
What is the maximum penalty under the DPDP Act?
The highest penalty in the Act’s Schedule is up to ₹250 crore, for failing to take reasonable security safeguards to prevent a personal data breach. Other categories of failure carry lower maximums. Penalties are imposed by the Data Protection Board of India after an inquiry, and the Board must weigh the nature, gravity and duration of the breach, the data involved and the steps you took to limit harm. The penalties are financial; the Act does not provide for imprisonment.
When do the DPDP Rules come into force for businesses?
The DPDP Rules were notified in November 2025 with phased start dates. The parts that set up the Data Protection Board took effect first, and most duties affecting business websites, including notices, security safeguards, breach reporting and grievance handling, were widely reported as starting about 18 months after notification. The government can change these dates, so as of 2026 check the current MeitY notification and confirm with a lawyer before you plan around a specific date.
Do I need a lawyer to make my website DPDP compliant?
Not for every step. Cutting form fields, adding a notice and a separate marketing checkbox, blocking ad pixels until consent and publishing a grievance email are practical tasks your developer can do. A lawyer is worth paying for to review your privacy policy and notice text, and is strongly advised if you handle health, financial or children’s data, run customer accounts, or send data to vendors abroad. A web developer, including us, cannot give you legal advice.
