India's data protection rules and what they mean for your website

Most business owners we speak to have heard of the Digital Personal Data Protection Act, know it involves large numbers, and have not yet been told anything actionable about it.

This is the website-shaped part of it: what your site collects, what the rules expect you to do about that, and what the actual engineering work is. It is the part we are qualified to talk about.

This is not legal advice. We build websites and business systems; we are not lawyers. On how the Act applies to your specific business — particularly if you handle children's data, health data, or data belonging to people outside India — get a professional opinion. What follows is the technical work that a legal opinion will almost certainly ask you to do.

You have more time than the headlines suggest, and less than you think

The dates that actually matter

1. Nov 2025

   Rules notified

   The eighteen-month transition opens. The obligations exist but are not yet enforced.

2. 13 Nov 2026

   Consent managers go live

   The registered consent-manager framework becomes operational.

3. 13 May 2027

   Full compliance due

   Notice, consent, security safeguards, breach reporting and data-principal rights all enforceable.

The distinction that matters: the obligations already exist. What arrives in May 2027 is enforcement. So there is no cliff edge next month, but there is also nothing to wait for — and the work is much cheaper done during a normal website change than as an emergency project alongside every other business in the country.

Whether this applies to you

Broadly, it applies if you process digital personal data in connection with goods or services offered to people in India — regardless of where your business or your server sits.

There is no small-business exemption from the core duties. Some obligations scale with size, but "we are only a twelve-person firm in Coimbatore" is not an exemption from having a lawful basis for the data on your contact form.

What your website is already collecting

This is the step almost everybody skips, and it is the one that makes the rest straightforward. Personal data is not just a customer database. On a typical business site:

• Enquiry and contact forms. Name, phone, email, and often a description of their business problem.
• Careers forms. CVs, which carry far more personal data than anything else you hold.
• Newsletter signups.
• Analytics and advertising tags, which collect identifiers whether or not you look at them.
• Chat widgets and WhatsApp click-throughs, including whatever the visitor typed.
• Server and hosting logs, which record IP addresses by default.

Write that list down for your own site, with where each one ends up — inbox, CRM, spreadsheet, a vendor's cloud. This inventory is the single most useful hour you will spend on the whole subject, because you cannot honestly describe, secure or delete data you have not enumerated.

The obligations, in plain terms

1. Notice. Before collecting, tell the person what you are collecting, what for, and how to withdraw. Specific and itemised — not a link to a policy nobody reads.
2. Consent. Free, specific, informed, unconditional, and for a stated purpose. Silence is not consent. Neither is a pre-ticked box, nor bundling a marketing opt-in into a support request.
3. Purpose limitation. Data collected for a quote is for that quote. Adding those addresses to a promotional mailing list is a separate purpose needing separate consent — this is the most commonly breached rule of the set, and the most commonly breached without meaning to.
4. Security safeguards. Reasonable technical and organisational measures over data you hold.
5. Retention and deletion. When the purpose is done, the data goes. This one is genuinely hard and is discussed below.
6. Rights. People can ask what you hold, ask for correction, ask for erasure, and complain. You need a route for that and someone whose job it is.
7. Breach reporting. If it leaks, you notify the Board and affected people. Having decided in advance who does what is the whole game.
8. Your processors are your problem. Your hosting provider, CRM, email tool and form vendor process data on your behalf, and that relationship needs to be contractual.

The penalties are the part that gets quoted, usually inaccurately, so here they are as they are actually structured:

Maximum penalties, by type of failure

Failure to secure personal data₹250 cr

Failure to report a breach₹200 cr

Other contraventions₹50 cr

The website checklist

The engineering work, roughly in order of how much it matters relative to effort:

1. Put a real notice at the point of collection. Next to the form, not only in a linked policy. A sentence or two: what you will do with this, how long you will keep it, how to ask you to delete it. This is the highest-value change on the list and usually takes an hour.

2. Unbundle marketing consent. If your form implies that submitting an enquiry signs the person up to your mailing list, separate them into two decisions, and leave the marketing one unticked.

3. Make your privacy policy match reality. Most privacy policies on Indian SMB websites are copied from a generator or another site and describe data flows that do not exist while omitting the ones that do. A policy that contradicts your actual behaviour is worse than a short accurate one, because it documents the gap. Ours is deliberately plain: our privacy policy says what we collect and nothing we do not.

4. Handle analytics and tags honestly. Decide what you actually load, and do not claim you anonymise something you do not.

5. Build a rights route. One published address that reaches a person, and an internal note of what to do when a request arrives. This does not need software. It needs a named owner.

6. Write down retention periods. Enquiries that never converted, CVs from a closed vacancy, form submissions sitting in an inbox for six years. Decide the period per category, then actually schedule the deletion.

7. Cover the basics of security. Certificate valid, admin accounts individually owned rather than shared, no personal data in spreadsheets on a laptop, updates applied. Nothing exotic — the largest penalty in the schedule attaches to the most ordinary failure of all.

8. List your processors and check each has terms covering data handled on your behalf.

The two genuinely hard parts

Being honest about where this stops being a checklist.

Deletion is harder than it sounds. Consider one enquiry from 2023. It is in your CRM, your inbox, your sent items, a downloaded spreadsheet, your form tool's own storage, and a backup. "Delete when the purpose is fulfilled" means all of those. Doing that reliably needs data in fewer places to begin with, which is why the honest first step for many businesses is consolidation rather than compliance tooling. The same argument applies as when choosing between building and buying business software.

Language. The notice has to be capable of being given in English or any of the languages in the Eighth Schedule to the Constitution. What that means in practice for a small website is still settling, and it is a good question for your legal advisor rather than your developer. Tamil alongside English is a reasonable starting assumption for a Tamil Nadu business, and worth doing on customer-facing terms regardless of what the rules ultimately require.

What this costs

Less than the consulting figures circulating suggest, if you are a small business with an ordinary website and you start from the inventory. Items 1, 2, 3 and 5 above are a day of work for most sites and cover a substantial share of the exposure. Retention and deletion cost more, because they are process changes rather than page changes. The expensive version is the one where nobody looks at this until 2027 and it becomes urgent.

If any of it is being done anyway — a redesign, a new form, a move to better hosting — fold it in then. It is close to free at that point, and there are usually other reasons a site is due for attention at the same time.

The summary

Take an inventory of what your site collects and where it goes. Put a plain notice next to every form. Separate marketing consent from enquiry consent. Make the privacy policy true. Name someone to handle requests. Decide retention periods and honour them.

That is most of the website-level work, it is not expensive, and none of it needs to wait for a deadline.

If you would like us to go through your site and tell you which of these are missing, send us the address — we will give you a specific list rather than a compliance package, and we will say plainly which parts need a lawyer rather than a developer.