India's DPDP Act in 2026: What Every Small Website Owner Must Do Before May 2027

If your website collects even one name, email address, or phone number from an Indian visitor, a new law already applies to you. India's Digital Personal Data Protection Act (DPDP Act) was passed in August 2023, its operational rules were notified on 13 November 2025, and the clock is now running: the Consent Manager framework kicks in on 13 November 2026, and the main obligations for websites and apps apply from 13 May 2027.

Most small website owners have heard of the DPDP Act but assume it is only for big tech companies. That assumption is expensive. Penalties go up to ₹250 crore, and the law applies to anyone processing digital personal data in India — including a freelancer's portfolio site with a contact form, a coaching institute's enquiry page, or a small shop's WhatsApp order form. The good news: for a small site, compliance is a few days of focused work, not a legal department. This guide explains exactly what to do, in plain language.

1. What the DPDP Act Actually Is (and Why 2026 Changed Everything)

Before the DPDP Act, India's data rules came from a 2011 set of IT Act rules that covered only a narrow slice of "sensitive" data and had no dedicated regulator. The Supreme Court's 2017 Puttaswamy judgment recognised privacy as a fundamental right, and years of large data breaches made a comprehensive law unavoidable.

The DPDP Act, 2023, read with the DPDP Rules, 2025, changes the game in four ways. First, it gives every individual — called a "Data Principal" — real rights over their data: to know what you collect, to correct it, and to ask for it to be deleted. Second, it puts duties on every business that decides why and how personal data is processed — called a "Data Fiduciary". Third, it creates the Data Protection Board of India to hear complaints and levy penalties. Fourth, it sets hard deadlines. The rules were notified in stages through late 2025 and early 2026, so 2026 is the first full year in which the compliance calendar is real and dated — not theoretical.

Here is the mental shift that matters: a privacy policy page alone is not compliance. The Act is mostly about the plumbing beneath the policy — how data flows through your forms, who can see it, how fast you can find it when somebody asks, and how quickly you delete it when you no longer need it.

2. The Two Dates That Matter: 13 November 2026 and 13 May 2027

Two deadlines should be on every Indian website owner's calendar:

• 13 November 2026 — Consent Manager framework: the registration framework for Consent Managers (independent entities that let users manage their consents in one place) takes effect. If your site handles high volumes of users or consents across platforms, plan how you will work with a registered Consent Manager.
• 13 May 2027 — Main obligations apply: notice, consent, security safeguards, breach intimation, and data-principal rights obligations apply in full. This is the real deadline for small websites.

Do not wait until April 2027. The work below — consent flows, a rights process, a retention schedule — is the kind of thing that is cheap when done calmly and expensive when done in a panic after a complaint or a breach. Start now, finish in weeks, and the May 2027 date becomes a non-event for you.

3. Who Has to Comply — Spoiler: Probably You

The Act applies to anyone processing digital personal data in India, and to processing outside India that is linked to offering goods or services to people in India. "Digital personal data" is broader than most people think: a name, email, phone number, address, IP address, or cookie identifier all count.

That means you are very likely covered if your website has any of these: a contact or enquiry form, a newsletter signup, user accounts or login, an appointment-booking form, a payment or order flow, analytics that track individual visitors, or a chatbot that stores conversations. A static brochure site with no forms and no analytics is the rare exception. If you are unsure, assume you are covered — the cost of complying is small, and the cost of being wrong is not.

Small businesses get no blanket exemption. The Act does have lighter treatment for certain small-scale processing and for startups in specific notified cases, but the core duties — lawful consent, security, and respecting user rights — apply regardless of size.

4. The 7 Things Your Website Must Do

Strip out the legal language, and the rules come down to seven practical jobs:

1. Give a clear notice, in plain language. Before or at the moment you collect data, tell the person what data you collect, why, and how they can withdraw consent or raise a grievance. The notice should be available in English and in the languages your users actually read. One vague line — "we may use your data to improve our services" — does not pass.

2. Take consent per purpose, not in one bundle. A single checkbox at the bottom of a signup form that covers marketing, analytics, and sharing with partners is not valid consent. Consent must be specific, informed, and easy to withdraw. If you want to send marketing messages, that needs its own consent, separate from the consent to process an order.

3. Store proof of consent. Keep a timestamped record of what the user consented to, when, and through which notice. When a dispute arises, "they ticked the box" without a record is worth very little.

4. Make withdrawal as easy as giving consent. If signing up took one click, withdrawing must not take an email to support and a three-day wait. A visible "withdraw consent" or "unsubscribe" path on your site is the standard to aim for.

5. Build user-rights flows. A user can ask for a copy of their data, ask for corrections, or ask for erasure. You need a way to receive such requests, verify the requester, and respond inside the prescribed window. A simple "Request my data / Delete my data" page linked from your privacy policy covers most small sites.

6. Set a retention schedule — and actually delete. Keep personal data only as long as needed for the purpose you collected it for. "In case we need it later" is no longer a defence. Enquiry-form entries from three years ago, old newsletter lists, and abandoned account data should be deleted on a schedule, with logs kept for at least a year.

7. Publish a grievance contact. Your website must publish the contact details of a grievance officer (or the person handling data complaints) and a clear channel for complaints. For most small sites, this is a named email address on the privacy policy page plus a commitment to respond promptly.

5. Data Breaches: The 72-Hour Clock You Can't Afford to Miss

This is the duty small site owners most often miss — and the one with the sharpest teeth. If a personal data breach occurs, you must inform the Data Protection Board of India and the affected individuals without delay, and send the Board a detailed report within 72 hours. Separately, CERT-In's directions require cyber incidents to be reported within six hours.

What does that mean in practice? Write a one-page breach runbook before you need it: who discovers breaches (your hosting provider's alerts, your own log monitoring), who decides it is a breach, who drafts the notification, and where the Board's reporting channel is bookmarked. Test it once with a tabletop exercise — a pretend breach on a quiet afternoon. A breach discovered on Friday night with no plan is how a manageable incident becomes a ₹200 crore penalty exposure, because failure to notify a breach can itself cost up to ₹200 crore.

Security safeguards are the other half of this duty. The rules expect encryption of personal data, access controls so only authorised people can see it, logging and monitoring to detect unauthorised access, backups, and contracts requiring your processors (hosting provider, email tool, CRM) to take safeguards too. For a small site, this mostly means: HTTPS everywhere, strong unique passwords with two-factor authentication on admin accounts, automatic updates, and a hosting plan that backs up daily.

6. Children's Data and the Rules Most Small Sites Get Wrong

If your site or app is likely to be used by children under 18, the rules get stricter: you need verifiable parental or guardian consent before processing a child's data, and you must not track or behaviourally monitor children or target advertising at them. Breaching children's data obligations can cost up to ₹200 crore.

Many small sites trip over this accidentally — a coaching class signup form, a kids' activity booking page, or a school-adjacent app that collects a child's name and photo without a parent's verifiable consent. If children are even part of your audience, add a parental-consent step to those flows now. If children are not your audience at all, say so in your terms and keep age gates where relevant. Either way, do not collect children's data by default and hope nobody notices.

7. A Practical 30-Day Action Plan for Small Websites

Here is a realistic plan a freelancer or small business can finish in a month, working a few hours a week:

Week 1 — Map your data. List every form, signup, and tool on your site and what personal data each collects, where it goes (email inbox, spreadsheet, CRM), and who can see it. Most small sites find they collect more than they thought — and keep it longer than they need to.

Week 2 — Fix consent and notices. Rewrite your privacy notice in plain language, split bundled checkboxes into per-purpose consents, add a withdrawal link, and start storing timestamped consent records. If your contact form is the main collection point, this is the week to upgrade it.

Week 3 — Build the rights and retention machinery. Add a "Request / Correct / Delete my data" page, publish your grievance contact, write your retention schedule (for example: enquiries deleted after 12 months, inactive accounts after 3 years), and set a calendar reminder to run deletions.

Week 4 — Security and breach readiness. Turn on two-factor authentication everywhere, confirm daily backups, sign or update processor terms with your vendors, and write the one-page breach runbook. Then tell your users: a short note that you have updated your privacy practices builds trust — and trust is the real return on this work.

A compliant website is not just a safer website; it is a more trustworthy one. In a market where users are increasingly aware of data misuse, visible privacy hygiene — a clear notice, an easy opt-out, a fast answer to a data request — is a competitive advantage, especially for small Indian businesses competing against faceless big platforms.

Note: this article is general information for website owners, not legal advice. For complex cases — health data, children's platforms, or large user volumes — consult a lawyer familiar with the DPDP Act.

Frequently Asked Questions

Does the DPDP Act apply to my small website or only to big companies?

It applies to anyone processing digital personal data in India, regardless of size. If your site has a contact form, newsletter signup, login, or analytics that identify visitors, you are very likely covered. There is no small-business exemption from the core duties of consent, security, and user rights.

What is the last date for DPDP compliance?

The DPDP Rules 2025 were notified on 13 November 2025. The Consent Manager registration framework applies from 13 November 2026, and the main obligations for websites and apps — notice, consent, security, breach notification, and data rights — apply from 13 May 2027. Start well before that date; the work takes weeks, not days, if done properly.

What happens if my website does not comply with the DPDP Act?

The Data Protection Board of India can impose penalties of up to ₹250 crore for failing to take reasonable security safeguards, up to ₹200 crore for failing to notify a breach or for children's data violations, and up to ₹50 crore for most other violations. Users can also file complaints with the Board, which is why a visible grievance contact matters.

Do I need a lawyer to make my website DPDP-compliant?

For a typical small website, no. The seven steps in this guide — clear notice, per-purpose consent, consent records, easy withdrawal, rights flows, a retention schedule, and a grievance contact — can be implemented by the site owner or their developer. Get legal help if you handle sensitive data, children's data, or very large user volumes.

Ready to fix your own site's data collection? Start with the form where most of your visitors' data enters: your contact form. Our free PHP contact form with validation gives you a secure, spam-protected form with proper validation that you can adapt with per-purpose consent checkboxes — download the free source code here and make your site DPDP-ready one form at a time.