What India's DPDP Act means for your website and app: the dates, the duties and a checklist.

The key dates

The Digital Personal Data Protection Act became law on 11 August 2023. The government published the DPDP Rules, 2025 in the Gazette of India dated 13 November 2025, with an 18-month phased start (MeitY; PIB, 14 November 2025).

• November 2025: the Rules on the Data Protection Board of India came into force, and the Board was set up as a fully digital office.
• November 2026: one year after publication, the rule on consent managers starts. Consent managers are registered platforms that let people give, review and withdraw consent in one place. They must be companies incorporated in India with a net worth of at least ₹2 crore.
• May 2027: eighteen months after publication, the main duties for businesses start: notices, consent, security safeguards, breach intimation, children's data, retention and erasure, and people's rights.

On 5 August 2026 the government told the Lok Sabha that the Rules provide for phased implementation over an eighteen-month transition period (PIB, 5 August 2026). Commentators differ by a day on the exact start dates, so check the Gazette text with your lawyer.

Who the law covers

The Act applies to digital personal data processed in India, and to processing outside India connected with offering goods or services to people in India (section 3). Personal data means any data about an individual who can be identified by or from it (section 2(t)). If your website or app collects names, phone numbers, email addresses, delivery addresses, order details or device identifiers, the Act applies to you.

In the Act's words, your business is a data fiduciary: it decides why and how personal data is used. A data processor handles data on your behalf, such as your hosting company, CRM or developer. The person the data is about is the data principal.

What a data fiduciary must do

Give a clear notice

Every request for consent must come with a notice that makes sense on its own, in clear and plain language. It must give an itemised list of the personal data, the specific purpose, a description of the goods or services involved, and how the person can withdraw consent, use their rights and complain to the Board (section 5 and Rule 3). People must be able to read it in English or any language in the Eighth Schedule to the Constitution (section 5(3)).

Get valid consent for a specific purpose

Consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the data needed for the stated purpose (section 6(1)). Withdrawing consent must be as easy as giving it (section 6(4)). If a dispute arises, your business must prove that it gave the notice and got the consent (section 6(10)).

Some uses do not need consent, for example using data a person gave you voluntarily for a purpose they asked for, such as sending a receipt (section 7). Read the full list with your lawyer before you rely on it.

Keep data safe

You must take reasonable security safeguards, including for work your processors do for you (section 8(5)). The Rules set a minimum: encryption, masking or tokens; access control; logs and monitoring to detect unauthorised access; backups; a security clause in each processor contract; and keeping logs and personal data for one year to investigate incidents, unless another law says otherwise (Rule 6).

Report breaches to users and to the Board

If a personal data breach happens, you must tell each affected person without delay, in plain language: what happened, the likely consequences, what you are doing and what they can do to protect themselves (Rule 7(1)). You must also tell the Data Protection Board without delay, then send a detailed report within 72 hours (Rule 7(2)).

Erase data you no longer need

Erase personal data when a person withdraws consent or when the purpose is no longer served, unless a law requires you to keep it, and make your processors erase it too (section 8(7)). Separately, keep personal data, traffic data and logs of processing for at least one year for purposes listed in the Rules (Rule 8(3)). E-commerce platforms with at least 2 crore registered users in India, and large gaming and social media platforms, must erase data after three years without contact, after warning the user 48 hours before (Rule 8 and the Third Schedule).

Answer questions and grievances

Publish on your website or app the contact details of a person who can answer questions about your use of personal data, or of your Data Protection Officer if you need one (section 8(9) and Rule 9). Publish how people can use their rights, and answer grievances within a reasonable time of no more than 90 days (Rule 14). People must use your grievance process before they go to the Board (section 13(3)).

Protect children's data

Under the Act, a child is anyone under 18 (section 2(f)). Before you process a child's personal data, you must get verifiable consent from a parent, after checking that the parent is an identifiable adult, for example through details you already hold or a token through DigiLocker (section 9(1) and Rule 10). You must not track or behaviourally monitor children, or target advertising at them (section 9(3)). Some health, education, childcare and school transport services have limited exemptions (Rule 12 and the Fourth Schedule).

Significant data fiduciaries

The government can notify some businesses as significant data fiduciaries, based on the volume and sensitivity of the data, the risk to people and other factors (section 10(1)). They must appoint a Data Protection Officer based in India and an independent data auditor, and carry out a Data Protection Impact Assessment and an audit every 12 months (section 10(2) and Rule 13). Unless the government notifies your business, these extra duties do not apply to you.

Penalties

The Data Protection Board can impose penalties of up to ₹250 crore for failing to take reasonable security safeguards. Failing to report a breach, or breaking the rules on children's data, can each cost up to ₹200 crore. A significant data fiduciary's extra duties carry up to ₹150 crore, and any other breach of the Act or Rules up to ₹50 crore (the Schedule to the Act).

What changes for your website and app

Forms

• Ask only for the data you need for the stated purpose. If you do not need a phone number, do not make it compulsory.
• Show the notice next to the form, with an unticked consent checkbox for each separate purpose, such as replying to an enquiry and sending offers.
• Store a record of which notice each person saw and when they consented, because you may need to prove it.
• Give a simple way to withdraw consent, such as an unsubscribe link or a WhatsApp reply.

Cookies and tracking

The Act does not mention cookies by name. If a cookie, pixel or tag collects personal data, such as an identifier linked to a person, the rules on notice and consent apply to it unless a legitimate use covers it. Ask your lawyer which of your cookies need consent, and use a banner that lets people refuse non-essential cookies as easily as they accept them.

CRM and email tools

• Sign a contract with each data processor, such as your CRM, email or hosting provider, that covers security safeguards (section 8(2) and Rule 6).
• Record the purpose and consent you hold for each contact, and erase contacts who withdraw consent or whose purpose is over.
• For people who gave consent before the Act started, the Act requires you to send them a notice as soon as reasonably practicable (section 5(2)).

WhatsApp marketing

Get clear, separate consent before you send marketing messages. WhatsApp's own Business Messaging Policy already says you may contact people only if they have given you their number and opted in to hear from you, and that you must respect requests to stop (WhatsApp Business Messaging Policy, updated 23 September 2026). Keep a record of each opt-in, and make stopping messages as easy as starting them.

Analytics

Collect only what you use. Turn off features you do not need, such as advertising signals and user-ID tracking, shorten or mask identifiers where the tool allows it, and set a short retention period. Name your analytics tools and their purpose in your notice or privacy policy. The Act allows transfers outside India except to countries the government restricts by notification, and stricter sector rules still apply (section 16 and Rule 15).

Until May 2027: the IT Act and the SPDI Rules

Until the main DPDP duties start, section 43A of the Information Technology Act, 2000 and the SPDI Rules, 2011 still apply. Section 43A makes a company that handles sensitive personal data liable to pay compensation if it is negligent in keeping reasonable security practices. The DPDP Act removes section 43A when its main provisions start (section 44(2)).

The SPDI Rules cover sensitive data such as passwords, bank and card details, health information and biometrics. Today they require:

• a privacy policy published on your website (Rule 4);
• consent in writing, by letter, fax or email, before you collect sensitive data (Rule 5(1));
• a Grievance Officer named on your website, who resolves complaints within one month (Rule 5(9));
• reasonable security practices, such as IS/ISO/IEC 27001 or an approved code of practice (Rule 8).

CERT-In: report incidents within 6 hours

The CERT-In Directions of 28 April 2022 already apply to companies, service providers, intermediaries, data centres and government bodies. You must report listed cyber incidents to CERT-In within 6 hours of noticing them, keep logs of your ICT systems securely for a rolling 180 days within Indian jurisdiction, sync system clocks with NIC or NPL time servers, and name a point of contact for CERT-In. The listed incidents include data breaches, data leaks, website defacement, ransomware and attacks on applications (CERT-In Directions under section 70B(6) of the IT Act).

A practical checklist

1. Map your personal data: what you collect, where it is stored, who can access it and which tools receive it.
2. Remove form fields and tools you do not need.
3. Write a clear notice for each form and screen that collects personal data, in English and the Indian languages your customers use.
4. Add unticked consent checkboxes for each purpose, and store consent records.
5. Make withdrawing consent and unsubscribing as easy as signing up.
6. Review cookies, pixels and analytics settings with your lawyer.
7. Sign contracts with every processor that cover security and erasure.
8. Turn on encryption, access control, logging and backups, and keep logs for the periods the law requires.
9. Write a breach plan: who reports to CERT-In within 6 hours, who tells the Board and users, and who decides.
10. Publish a contact for data questions and a grievance process, and answer within the time limits.
11. If children may use your service, plan verifiable parental consent and switch off tracking and targeted ads for them.
12. Set retention periods, and delete data when they end.

We build websites and apps to support these duties, and we name in writing every provider that handles your data, as our Data Processing Addendum explains. Whether your business complies is a decision for you and your lawyer. See how we handle security and data.