Does the DPDP Act apply to small business websites?

Yes. If your website collects personal data such as names, phone numbers or emails from people in India, the DPDP Act applies, whatever the size of your business.

When do the DPDP Rules come into force?

The Rules were notified in November 2025. Most core obligations, including consent and notice requirements, apply from May 2027.

Do I need a cookie banner in India?

If you use non-essential cookies or trackers for analytics or advertising, you should tell visitors and get their consent before loading them.

What should a website privacy policy include under DPDP?

What data you collect, why, how long you keep it, who it's shared with, and how people can access, correct or erase their data or raise a complaint.

All articles

Privacy & Security

DPDP Rules 2025: What Your Website Must Change Before May 2027

India's data protection rules are now notified, with the main duties due by May 2027. A practical checklist for contact forms, cookies, WhatsApp chats and privacy policies.

Focused Folks TeamOct 20, 20266 min read

DPDP Rules 2025: What Your Website Must Change Before May 2027

Every website that collects a name, phone number or email through a contact form is processing personal data. Under India's Digital Personal Data Protection (DPDP) Act, and the DPDP Rules notified in November 2025, that comes with clear duties.

The good news: most of the main duties apply from May 2027, so there's time to fix your website properly.

This is general information, not legal advice. Check the official Rules published by MeitY and speak to a lawyer for your specific case.

The DPDP timeline

November 2025: the DPDP Rules were notified, and provisions setting up the Data Protection Board of India took effect.
Around November 2026: the framework for registered Consent Managers begins.
May 2027 (18 months after notification): the core obligations apply, including notices, consent, security safeguards, breach notification and people's rights over their data.

What this means for a business website

Contact and enquiry forms

Collect only what you need. If a name, phone and message are enough, don't ask for date of birth or address. Next to the form, explain in plain language what you'll use the details for.

Consent must be free, specific, informed and unambiguous. A pre-ticked box saying "I agree to everything" won't do. If you want to send marketing messages, ask separately from the enquiry itself.

Privacy notice

Your privacy policy should say, in simple words, what data you collect, why, how long you keep it, who you share it with, and how people can contact you to access, correct or delete their data.

Cookies and tracking

If you use analytics or advertising pixels, tell visitors what they do and let them choose. Load non-essential trackers only after consent.

WhatsApp, email and CRM

Data doesn't stay on the website. Enquiries flow into WhatsApp, email inboxes and spreadsheets. Decide who can see them, and delete old leads you no longer need.

Security safeguards

Use HTTPS, keep software updated, protect admin logins and limit who can export customer data. A breach now carries reporting duties, so prevention is far cheaper.

A quick website checklist

Every form explains why the data is collected
Marketing consent is a separate, unticked choice
Privacy policy is up to date and linked from every form
Analytics and ad trackers wait for consent
There's a clear way for people to ask for their data to be deleted
Admin areas are protected and access is limited
Old enquiries are deleted on a regular schedule

We build websites with privacy and security designed in, from consent-ready forms to protected admin areas. Ask us to review your site.

DPDP Act website compliance
DPDP Rules 2025
Privacy policy India
Cookie consent India
Website development Ahmedabad