India's DPDP Act and Your Website: What Small Businesses Should Know

On this page

1. Where things stand
2. Key terms in plain English
3. Does it apply to your website?
4. Consent and notices on your forms
5. Collect less, and use it only for what you said
6. Analytics, pixels, chat widgets and other tools
7. Security, breaches and requests
8. A practical starting checklist

If your website has a contact form, an online store or even Google Analytics, it almost certainly handles personal data. India's Digital Personal Data Protection Act, 2023 (the DPDP Act) sets out how businesses must treat that data. This is a plain-English overview of what it generally means for a small business website, written by a web developer, not a lawyer. It isn't legal advice; for your situation, speak to a qualified lawyer.

Where things stand

Parliament passed the DPDP Act in 2023. The Act sets out the main principles, and government rules fill in details such as how notices work, how breaches are reported and when obligations take effect. Implementing rules have been notified, and many obligations are being phased in over a transition period rather than applying all at once.

Because dates and details can change, check the current rules or ask your lawyer before treating any deadline as settled. Most of what the Act asks for is sensible practice that also builds customer trust, so you can start now.

Key terms in plain English

Term in the Act	What it generally means for you
Data Principal	The person the data is about, such as a customer, patient or enquirer (for a child, this includes their parent or lawful guardian)
Data Fiduciary	The business that decides why and how the data is processed; for your website, usually you
Data Processor	A service that processes data on your behalf, such as a CRM or email marketing tool
Consent Manager	A registered platform people can use to give, manage and withdraw consent
Data Protection Board of India	The body that deals with complaints and breaches and can impose penalties

Does it apply to your website?

The Act covers digital personal data: information about an identifiable person that is collected digitally, or collected on paper and later digitised. For a typical business website, that includes:

• Names, phone numbers and emails from enquiry and quote forms
• Appointment bookings, orders, delivery addresses and customer accounts
• Newsletter and WhatsApp opt-ins
• Job applications and CVs sent through a careers page
• Data collected by analytics, advertising pixels and chat widgets, where it can identify a person

There's no blanket exemption for being a small business, although the government can exempt certain classes of businesses from some provisions. Don't assume you're exempt without checking.

Consent and notices on your forms

Consent is one of the main legal grounds for processing personal data under the Act. It generally needs to be free, specific, informed and unambiguous, given through a clear action (like ticking an unticked box), and limited to the data needed for the stated purpose. People must be able to withdraw consent as easily as they gave it.

When you ask for consent, the Act expects you to give a notice that explains:

• What personal data you're collecting and why
• How people can withdraw consent and exercise their rights
• How they can complain, including to the Data Protection Board

People must also be able to read the notice in English or any language in the Eighth Schedule of the Constitution, which matters if your customers prefer Hindi or a regional language.

The Act also recognises certain "legitimate uses" where consent isn't the basis, such as someone voluntarily sharing their details for a specific purpose. Where your forms fall is a question for your lawyer; in practice, a short, honest line next to the submit button and a separate, unticked box for marketing messages is a sensible start.

Collect less, and use it only for what you said

Data collected for one purpose shouldn't quietly be reused for another. For a website, that usually means:

• Removing form fields you don't need, such as date of birth or full address "just in case"
• Not adding enquiry numbers to WhatsApp broadcasts or promotional SMS lists unless people agreed to that
• Deciding how long you keep enquiries, CVs and old orders, and deleting what you no longer need unless another law (such as tax rules) requires it
• Limiting who in your team can see form entries and customer data; see WordPress user roles explained

Children's data needs extra care

For anyone under 18, the Act generally requires verifiable parental consent and restricts tracking, behavioural monitoring and targeted advertising directed at children. Schools, coaching institutes and kids' brands should get specific advice on their forms.

Analytics, pixels, chat widgets and other tools

Most websites pass data to other services: analytics, ad pixels, CRMs, booking tools, payment gateways, live chat and email platforms. Under the Act, you generally remain responsible for personal data that processors handle for you, and they should work under a proper contract.

• List every third-party tool on your site and what data it receives
• Remove tools you no longer use; old tracking codes often linger for years
• Check each provider's data processing terms and where data is stored
• Avoid sending names, phone numbers or emails into analytics or ad platforms

The Act has no cookie-specific rules like European law, but where tracking tools collect data that can identify a person, that's likely to be personal data. How consent applies to analytics and advertising is worth getting advice on. Transfers outside India are generally allowed unless the government restricts particular countries, though some sector rules are stricter, so check if your tools store data abroad.

Security, breaches and requests

The Act expects reasonable security safeguards to prevent personal data breaches, and requires informing the Data Protection Board and affected people if one happens. For a WordPress site, that typically starts with:

• HTTPS everywhere, strong passwords and two-factor authentication for admins
• Regular updates to WordPress, themes and plugins
• Backups, activity logs and malware monitoring
• Not leaving sensitive uploads, such as ID proofs or medical reports, in publicly accessible folders

The WordPress security checklist covers these in detail. Also publish contact details for someone who can answer privacy questions, and have a simple process for complaints and requests to access, correct or erase data.

A practical starting checklist

1. Map what personal data your site collects, where it goes and who can see it
2. Update your privacy notice to match; see privacy policy and cookie consent basics
3. Rewrite form consent lines, separate marketing opt-ins and remove unneeded fields and tools
4. Set retention periods and delete old data you don't need
5. Tighten security and user access
6. Name a contact for privacy questions and set up a way to handle requests
7. Have a lawyer review your approach against the current rules

Many of these changes are technical: form wording, consent checkboxes, removing old scripts and securing the site. For help putting them in place, see WordPress maintenance.