If your website has a contact form, you are collecting personal data, and India’s Digital Personal Data Protection Act applies to you. There is no turnover threshold and no small-business exemption. A five-person interior design studio in Lajpat Nagar is subject to the same core obligations as a listed company.
Most articles on this law are written for enterprise compliance officers — data protection officers, DPIAs, cross-border transfer frameworks. This one is written for the person who owns a business website and needs to know what to change on it.
Two dates matter. 13 November 2026 is roughly six weeks away, when Consent Manager registration opens under Rule 4 and the Board’s enforcement machinery moves forward. 13 May 2027 is the hard deadline, when the substantive obligations that apply to your website — notice, consent, security safeguards, breach reporting and data principal rights — all come into force. The IT Secretary has publicly confirmed there will be no grace period after that date.
Before anything else: this is general information written by a marketing agency, not legal advice. Have a lawyer review your specific position. What follows is the practical list of things that will need to change on a typical Indian business website.
Where the law currently stands
MeitY notified the Digital Personal Data Protection Rules, 2025 on 13 November 2025, converting the 2023 Act from principle into operating law and starting an 18-month clock.
| Phase | Date | What activates |
|---|---|---|
| Phase 1 | 13 Nov 2025 | Data Protection Board of India established, statutory definitions in force |
| Phase 2 | 13 Nov 2026 | Consent Manager registration opens under Rule 4 |
| Phase 3 | 13 May 2027 | Notice, consent, security, breach reporting, retention and data principal rights — full compliance, no grace period |
Commentators differ on precisely when the Board’s penalty powers begin to bite, with some reading them as live from Phase 1 and others from Phase 2. That disagreement shouldn’t change what you do. Penalties reach ₹250 crore per violation category, and the work below takes months, not weeks.
Does this actually apply to you?
Yes, if your website does any of the following — which is to say, almost certainly yes:
- Has a contact form, enquiry form or callback request
- Runs a newsletter signup
- Has a WhatsApp click-to-chat button that captures numbers
- Runs Google Analytics, Meta Pixel or any remarketing tag
- Takes bookings, appointments or orders
- Has user accounts or logins
- Stores a customer list anywhere, including a spreadsheet
Under the Act you are a Data Fiduciary — the entity deciding why and how personal data is processed. The people filling in your forms are Data Principals. If you use an agency, a CRM, an email tool or a web host, they are generally Data Processors acting on your instructions, and you remain responsible for what they do.
What the law requires, in plain terms
Notice. Before or at the point you collect data, you must tell the person what you’re collecting, why, how to withdraw consent, how to exercise their rights, and how to complain to the Board. The notice must be clear and standalone — not a clause buried on page four of your terms. It must be available in English and, at the person’s option, in the Eighth Schedule languages.
Consent. Free, specific, informed, unconditional and unambiguous, given by a clear affirmative action. That last phrase kills three common practices: pre-ticked boxes, consent bundled with terms acceptance, and “by submitting this form you agree to receive marketing.”
Purpose limitation. Data collected for one purpose can’t quietly be used for another. A quote request is not permission to add someone to your newsletter.
Withdrawal. Must be as easy as giving consent was. If someone consented with one click, they must be able to withdraw with roughly one click.
Data principal rights. Access, correction, completion, erasure, and grievance redressal. You need a working process and a published contact point.
Children. Under the Act, a child is anyone under 18 — higher than most global regimes. Processing a child’s data requires verifiable parental consent, and tracking or behavioural advertising directed at children is prohibited. This is a significant issue for education, coaching, paediatric healthcare and anything youth-focused.
Breach notification. On discovering a personal data breach, you notify the Board and the affected individuals, with the 72-hour window applying to the notification process under Rule 7.
The website checklist
Notice and policy
- Privacy notice rewritten in plain language, not a downloaded template
- Notice lists each category of data collected and the specific purpose for each
- Withdrawal method described and actually functional
- Grievance officer’s name and contact email published and monitored
- Details of how to complain to the Data Protection Board included
- Notice linked from every page footer and beside every form
- Eighth Schedule language availability addressed
Consent at each collection point
- Every form has an unticked consent checkbox — never pre-ticked
- Separate consent for service communication and for marketing
- Consent language is specific (“send me monthly offers”), not blanket (“I agree to the terms”)
- Consent is not a condition of receiving a quote or service
- Timestamp, IP, form version and consent text logged for every submission
- Those logs are retrievable — you may have to produce them
Trackers and advertising
- Google Analytics, Meta Pixel and remarketing tags do not fire before consent
- Cookie or tracker consent banner implemented with genuine reject capability
- Meta Custom Audience uploads reviewed — you need a lawful basis for the list you’re uploading
- Remarketing audiences reviewed for the children’s prohibition, particularly on education accounts
Rights and processes
- A monitored email address for access, correction and erasure requests
- A documented internal process with an owner and a response timeline
- The ability to actually delete a person’s data from every system, including backups and spreadsheets
- A breach response plan naming who does what within 72 hours
Data inventory and vendors
- Written inventory of every place personal data lives — CRM, email tool, forms plugin, host, WhatsApp, sheets, inboxes
- Retention period defined for each category, with data deleted when purpose is served
- Written agreements with every processor: your agency, developer, host, CRM and email provider
- Confirmation of where each vendor stores data
Children
- Assessment of whether you knowingly process under-18 data
- Verifiable parental consent mechanism if you do
- Behavioural advertising and tracking disabled for that audience
What this means for your marketing specifically
This is the part most legal guides skip, and it’s where the practical cost lands.
Purchased lead lists become close to unusable. If you didn’t obtain consent from the person and can’t evidence it, sending marketing to them is difficult to defend. The Indian market for scraped and bought databases is large. It is on borrowed time.
Your existing email list needs examining. Contacts who never gave specific marketing consent are a problem. The standard remedy is a re-permission campaign — one honest email asking people to confirm they want to keep hearing from you. You will lose a chunk of the list. The remainder will perform better, which is the small consolation.
“Fill this form to download our guide” needs restructuring. Gating content is fine. Automatically enrolling that person into a nurture sequence without separate consent is not — that’s a different purpose from the one they agreed to.
Meta Custom Audiences and Google Customer Match involve uploading customer data to a third party. Make sure your notice covers it and your consent supports it.
Education and coaching clients need a full review. The under-18 definition plus the behavioural advertising prohibition makes standard lead-gen tactics risky for this entire sector. If you market to students, start this conversation now.
Four things people get wrong
“It’s just India’s GDPR, we’ll reuse our GDPR work.” Overlapping but not identical. DPDP has no legitimate interest basis, so consent carries far more weight. The child threshold is 18, not 13 or 16. Don’t assume a GDPR-compliant setup transfers cleanly.
“Small businesses are exempt.” There is no size or turnover exemption for the core obligations. Certain relaxations exist for startups by notification, but the default position for an ordinary SMB website is that the Act applies.
“May 2027 is far away.” Consent logging, a real data inventory, and the ability to actually delete someone from every system are engineering tasks. Sites that start in early 2027 will not finish.
“We’ll just paste a privacy policy template.” A template that doesn’t describe what your site genuinely collects is arguably worse than nothing — it’s a written record that you didn’t look.
Start with these five, this month
- List every place you collect personal data. Walk your own site as a visitor. Most owners find three or four forms they’d forgotten.
- Fix the pre-ticked boxes. Fastest visible change, and a common default in Indian form plugins.
- Turn on consent logging. Most form tools support it; it’s usually a settings toggle nobody has switched on.
- Publish a grievance contact. A name and a monitored email address.
- Ask your agency and developer where your data lives. If they can’t answer, that’s your first finding.
Frequently asked questions
Does the DPDP Act apply to small businesses and startups in India?
Yes. There is no general turnover or size exemption for the core obligations. If you collect personal data through a website, you are a Data Fiduciary regardless of scale, though certain notified relaxations exist for specific categories of startups.
When is the DPDP compliance deadline?
The Rules were notified on 13 November 2025. Consent Manager registration opens on 13 November 2026, and full substantive compliance is due by 13 May 2027. Officials have stated there will be no grace period after that date.
Do I need a cookie consent banner in India?
If your site sets analytics or advertising cookies, you need consent for that processing, and a banner is the usual implementation. It must allow a genuine refusal, not just an acknowledgement button.
What are the penalties under the DPDP Act?
Up to ₹250 crore per violation category, with failure to implement reasonable security safeguards carrying the highest exposure in the schedule. Penalties are assessed on the nature and severity of the breach.
Can I still buy lead lists in India?
Sending marketing to people who never gave you consent, and for whom you hold no consent record, is very difficult to justify under a consent-based regime. Treat purchased lists as a liability rather than an asset.
The honest summary
Most Indian business websites are not close to compliant today, and most will not start until someone is fined publicly. The work is unglamorous — inventory, consent plumbing, vendor paperwork — and none of it generates revenue.
What it does do is make your marketing defensible. A consented list, an accurate inventory and a working deletion process are also just better operating practice.
Namo Marketing builds and maintains websites for Indian businesses and can handle the site-side work on this list — forms, consent logging, tracker gating and notice placement. For the legal assessment itself, work with a qualified data protection lawyer; we’ll work alongside them. If you’d like us to walk your site and tell you what needs changing, get in touch or call +91 9717 710 650.
This article is general information current as of September 2026 and is not legal advice. The DPDP Rules are being implemented in phases and guidance continues to evolve. Consult a qualified lawyer regarding your specific obligations.