Quick answer: India's Digital Personal Data Protection (DPDP) Rules, 2025 were notified on 13 November 2025. Most duties for businesses that collect personal data online, such as notice, consent, security safeguards and breach reporting, start on 13 May 2027. Use the time to map the data your website collects, rewrite your privacy notice and consent forms, and tighten security and vendor contracts. This article is general information, not legal advice.
Key takeaways
- Rules notified 13 November 2025; consent-manager rules start 13 November 2026; most business duties start 13 May 2027.
- MeitY floated a shorter 12-month timeline in January 2026, but a report dated 8 October 2026 says no amendment had been published. Plan for May 2027 and watch for official updates.
- Contact forms, newsletter sign-ups, checkout pages, analytics, chat widgets and CRMs all collect personal data.
- Start with a data map, then fix your notice, consent, retention, security and breach process.
- Speak to a qualified lawyer for your specific situation.
Almost every business website collects personal data: a name and phone number in a contact form, an email in a newsletter box, an address at checkout, or an IP address in analytics. The DPDP Rules turn the 2023 Act into practical duties. This checklist focuses on what a website owner can actually change.
Table of Contents
- 01.When do the DPDP Rules apply?
- 02.Step 1: Which personal data does your website collect?
- 03.Step 2: Is your privacy notice clear and complete?
- 04.Step 3: Is consent specific and easy to withdraw?
- 05.Step 4: Do you handle children's data?
- 06.Step 5: Are reasonable security safeguards in place?
- 07.Step 6: Can you detect and report a breach within 72 hours?
- 08.Step 7: How long do you keep data, and how do you delete it?
- 09.Step 8: Can people access, correct or erase their data?
- 10.Step 9: Which vendors and agencies see your data?
- 11.Frequently Asked Questions
When do the DPDP Rules apply?
The DPDP Rules, 2025 were notified on 13 November 2025. They come into force in phases, according to law-firm summaries of the notification:
| Date | What starts |
|---|---|
| 13 November 2025 | Preliminary rules and the rules that set up the Data Protection Board |
| 13 November 2026 | Rule 4: registration and obligations of Consent Managers |
| 13 May 2027 | Most duties for businesses: notice, consent, security safeguards, breach reporting, retention and erasure, children's data and data principal rights |
In January 2026 the Ministry of Electronics and Information Technology (MeitY) discussed shortening the 18-month runway to 12 months with industry. A proposal is not law, and a report dated 8 October 2026 states that no amendment had been published at that time. Check the official Gazette or a lawyer before you rely on any date.
Not legal advice. This is a plain-language summary for website owners. Obligations depend on what data you process and why. Confirm details with a qualified lawyer.
Step 1: Which personal data does your website collect?
You cannot write an accurate notice until you know what you collect. List every place your site or app touches personal data:
- Contact, enquiry and booking forms
- Newsletter and lead-magnet sign-ups
- Checkout, payment and account pages
- Analytics, advertising pixels and session-recording tools
- Live chat and WhatsApp widgets
- Your CRM, email platform and any spreadsheets leads are copied into
- Job application forms
For each one, note what is collected, why, where it is stored, who else receives it (payment gateway, email tool, agency) and how long you keep it. This one-page map drives every other step.
Step 2: Is your privacy notice clear and complete?
Under the Rules, a business must give people a notice before or when it asks for consent. Law-firm summaries describe it as needing to be clear, in plain language, and to itemise the personal data being processed and the purpose of each use. A generic copied privacy policy rarely meets that bar.
- Place a short notice next to every form, not only in the footer.
- Describe each purpose specifically, for example "to call you back about your enquiry".
- Explain how a person can withdraw consent and how to contact you about their data.
- Keep the language simple. Consider offering the notice in Hindi or Marathi if your customers use them.
Step 3: Is consent specific and easy to withdraw?
Where you rely on consent, it should be free, specific and informed, with an unambiguous action from the person. In practice:
- Do not pre-tick consent boxes.
- Do not bundle marketing consent with a service request. Offer separate choices.
- Make withdrawing consent as easy as giving it, for example an unsubscribe link or a simple email address.
- Record when and how each person consented.
- Review analytics and ad pixels: if they process personal data on a consent basis, your banner must actually control them.
Step 4: Do you handle children's data?
The Rules require verifiable consent from a parent or guardian before processing a child's data, and restrict tracking, behavioural monitoring and targeted advertising aimed at children, with listed exceptions. Schools, coaching classes, edtech and kids' product sites should review sign-up and ad setups carefully. If children are not your audience, say so in your notice and avoid collecting age-sensitive data.
Step 5: Are reasonable security safeguards in place?
The Rules describe the safeguards a business should keep, rather than naming one required standard. For a typical website, sensible basics include:
- HTTPS everywhere and up-to-date CMS, themes and plugins
- Strong, unique admin passwords with two-factor authentication
- Role-based access, so only people who need the data can see it
- Regular backups and tested restores
- Logging of access to personal data
- Signed agreements with vendors and agencies that handle your data
Keep records of what you did. If something goes wrong, you will need to show your safeguards were reasonable.
Step 6: Can you detect and report a breach within 72 hours?
Summaries of the Rules say a data fiduciary must inform affected people without delay and give the Data Protection Board a detailed report within 72 hours of becoming aware of a breach. Decide now who will investigate, who talks to customers and who contacts the Board. Write the steps down and rehearse them once.
Step 7: How long do you keep data, and how do you delete it?
Personal data should not be kept longer than needed for its purpose, unless a law requires it. The Rules also require certain personal data, traffic data and processing logs to be retained for at least one year for specified purposes. Set a retention period for each item on your data map, and automate deletion of old leads, abandoned carts and applicant CVs where you can.
Step 8: Can people access, correct or erase their data?
People have rights over their data, and summaries of the Rules mention a 90-day response time for requests. Publish a contact point, such as a dedicated email, and create an internal process to find and update or erase a person's data across the website, CRM and email tools. Our CRM development and website development teams build these workflows into custom systems.
Step 9: Which vendors and agencies see your data?
If an agency, hosting company, email platform or WhatsApp provider processes personal data for you, you remain responsible. List them, check what they collect, and put clear written terms in place. Remove tools you no longer use.
Frequently Asked Questions
When do the DPDP Rules apply to my business?
The Rules were notified on 13 November 2025. Most business duties start on 13 May 2027, while Consent Manager rules start on 13 November 2026. MeitY discussed shortening the timeline in January 2026, but a report dated 8 October 2026 says no amendment had been published. Check official sources.
Does the DPDP Act apply to a small business website?
It applies to digital personal data processed in India, which includes a contact form or newsletter list. Some exemptions exist for specific cases, so confirm with a lawyer how it applies to you.
Do I need a cookie banner under the DPDP Rules?
The Rules do not prescribe a banner design. If analytics or advertising tools process personal data on the basis of consent, that consent must be informed, specific and withdrawable, and the tools must actually respect the choice.
What should a DPDP privacy notice contain?
Summaries of the Rules describe a clear notice that itemises the personal data collected, the purpose of each use, how to withdraw consent and how to contact you about your data.
How fast must I report a data breach?
Law-firm summaries of the Rules say affected people must be told without delay and a detailed report goes to the Data Protection Board within 72 hours of becoming aware of the breach.
Can Bafna Digitech make my website DPDP-ready?
We can update forms, consent flows, privacy notices, security settings and CRM processes on your website. We are a digital agency, not a law firm, so you should confirm legal requirements with your lawyer.
Sources and further reading
- S.S. Rana & Co.: MeitY notifies final Digital Personal Data Protection Rules 2025
- The Privacy Labs: DPDP 13 November 2026, what actually starts (8 October 2026)
- S.S. Rana & Co.: MeitY plans to cut short DPDP compliance timeline (13 February 2026)
This article is general information and not legal advice. Dates and obligations are taken from the sources above as of 2 November 2026 and may change.