Key takeaways
- The DPDP Rules were notified on 13 November 2025; the Consent Manager phase starts on 13 November 2026 and full DPDP compliance is due on 13 May 2027.
- Any website, app, CRM or WhatsApp list that holds customer personal data is covered, including small businesses.
- Websites need a clear notice, an unticked consent checkbox, easy consent withdrawal and a contact person for data requests.
- A data breach must be reported to the Data Protection Board within 72 hours, and logs must be kept for at least one year.
- Penalties go up to ₹250 crore for weak security and ₹200 crore for not reporting a breach.
Your website has a contact form. Your app asks for a phone number at sign-up. Your staff save customer numbers for WhatsApp offers. All of this is personal data, and in India it now comes under a law.
That law is the Digital Personal Data Protection (DPDP) Act, 2023, with the DPDP Rules, 2025. Many business owners think it starts "sometime in 2027". The real picture is different. The next phase starts on 13 November 2026, and full DPDP compliance is due on 13 May 2027. That is about six months away.
This guide explains, in simple words, what the law means for your website and app, the key dates, the penalties, and a practical checklist you can give to your developer today.
Quick answer: If your website or app collects names, phone numbers, emails, addresses or any other personal data, you need a clear privacy notice, a proper consent checkbox, an easy way to withdraw consent, safe storage, a plan for data leaks, and a person who answers data questions. All of this must be ready by 13 May 2027.
What is the DPDP Act, in simple words?#
The DPDP Act is India's first full law on how businesses collect, use, store and delete people's personal data in digital form. The DPDP Rules, notified on 13 November 2025, explain how the Act works in practice.
The law uses a few new words. Here is what they mean:
- Data Principal: the person whose data it is. Your customer, patient, student or lead.
- Data Fiduciary: the business that decides why and how data is used. That is you.
- Data Processor: a company that handles data for you, such as your hosting company, CRM, payment gateway or WhatsApp API provider.
- Consent Manager: a registered company that helps people give, see and withdraw consent across many apps from one dashboard.
- Data Protection Board: the government body that will hear complaints and impose penalties.
Does DPDP apply to my small business?#
Most likely, yes. The law applies to any business that handles digital personal data in India. That includes data that came in on paper and was later typed into a computer.
Being a small business does not automatically make you exempt. If you run any of these, DPDP applies to you:
- A website with a contact, enquiry or booking form
- An online store with customer accounts and delivery addresses
- A mobile app or PWA with login or sign-up
- A CRM, billing software or Excel sheet with customer phone numbers
- A WhatsApp Business number used for offers and updates
- A school, coaching, clinic or hospital system with student or patient records
Very large companies may also be named Significant Data Fiduciaries. They have extra duties, like appointing a Data Protection Officer based in India, independent audits and impact assessments. Most small businesses will not be in this group, but the basic duties still apply.
DPDP Act enforcement date: the three phases#
The DPDP Rules are coming into force in three steps.
| Date | What starts | What it means for you |
|---|---|---|
| 13 November 2025 | Data Protection Board set up | The regulator now exists |
| 13 November 2026 | Rule 4: Consent Manager framework | Consent Managers can register; your customers may start using them |
| 13 May 2027 | Notice, consent, security, breach reporting, children's data, user rights, erasure | Full DPDP compliance is required |
What changes on 13 November 2026? Rule 4 lets registered Consent Managers start working. A Consent Manager must be an Indian company with a net worth of at least ₹2 crore. Most businesses do not need to become one. But your customers may soon manage their consent through these platforms, so your website and app should be able to record and honour consent withdrawals.
The bigger date is 13 May 2027. From then, the main duties and penalties apply to everyone.
DPDP compliance checklist for websites and apps#
This is the practical part. Give this list to your developer or IT team.
1. Make a data map#
Write down every place you collect personal data: website forms, app sign-up, checkout, chatbot, WhatsApp, CRM, billing counter, Google Forms, Excel sheets. Note what data you collect, why, where it is stored and who can see it.
2. Collect only what you need#
If an enquiry form only needs a name and phone number, do not ask for date of birth and full address. Less data means less risk.
3. Show a clear privacy notice#
Before or at the time you collect data, show a short notice in plain language. It should say what data you collect, why you need it, and how the person can withdraw consent or complain. The notice should be available in English, and you can also offer it in Hindi or another Indian language.
4. Use a proper consent checkbox#
- The checkbox must not be ticked in advance
- Ask separately for marketing (WhatsApp offers, SMS, email) and for the main service
- Do not hide consent inside long terms and conditions
5. Make it easy to withdraw consent#
Withdrawing consent must be as easy as giving it. A "Manage my data" link in the footer, an option in the app settings, or a simple form works. When someone withdraws, stop using their data for that purpose.
6. Give a contact for data questions#
Show the name or email of a person who will answer data requests and complaints. People have the right to ask what data you hold, to correct it, and to ask you to delete it.
7. Protect the data#
The Rules expect "reasonable security safeguards". In simple terms:
- HTTPS (SSL) on every page
- Encryption or masking for sensitive data
- Strong passwords and limited admin access
- Regular backups
- Updated plugins, frameworks and servers
8. Keep logs for at least one year#
Access logs and processing logs must be kept for a minimum of one year, so a breach can be investigated later.
9. Prepare a data breach plan#
If data leaks, you must inform the affected people without delay and send a detailed report to the Data Protection Board within 72 hours. Decide now who does what, so you are not panicking on the day.
10. Check your vendors#
Your hosting company, CRM, payment gateway, SMS and WhatsApp API providers are your Data Processors. Your contract with them should require them to protect the data too. If a vendor leaks data, you are still answerable to the customer.
11. Delete data when the purpose is over#
Do not keep old leads and customer data forever. Set a retention period and delete data you no longer need. Large platforms have fixed rules: ecommerce and social media platforms with 2 crore or more users, and online gaming platforms with 50 lakh or more users, must erase the data of users who have been inactive for three years, with a 48-hour warning before deletion.
12. Take extra care with children's data#
Under DPDP, a child is anyone under 18. If your school app, coaching website or game collects children's data, you need verifiable consent from a parent. You also cannot track children's behaviour or target ads at them.
DPDP Act penalties#
The penalties are high, and they are meant to make businesses take data seriously.
| Failure | Maximum penalty |
|---|---|
| Not keeping reasonable security safeguards | Up to ₹250 crore |
| Not reporting a data breach | Up to ₹200 crore |
| Breaking the rules on children's data | Up to ₹200 crore |
| Other breaches of the Act | Up to ₹50 crore |
These are maximum amounts. The Board is expected to look at the size of the business and how serious the failure was. But even a small penalty, or a public complaint, can hurt a local business that runs on trust.
Industries that should act first#
Some businesses hold more sensitive data and should not leave this to the last few months:
- Hospitals, clinics and pharmacies hold health data. If you use hospital management software, ask your vendor about DPDP features.
- Schools and coaching centres hold children's data. Your school management software needs parent consent built in.
- Ecommerce stores hold addresses and payment records.
- Businesses that run WhatsApp marketing. Adding every enquiry to an offers list without permission is risky. Our WhatsApp chatbot guide explains how to set up proper opt-ins.
- Sales teams using a CRM. A good CRM for small business can store consent fields with every lead.
How much work is DPDP compliance for a website?#
For most small business websites, DPDP compliance is not a rebuild. It usually means:
- A new privacy notice page and short notices on forms
- Updated forms with consent checkboxes
- A "Manage my data" or withdraw-consent option
- Security checks, SSL, backups and log settings
- A simple admin view to find, export or delete a person's data
Apps, online stores and custom software need a little more work, because consent and deletion must work inside the app and the database too.
If you are building a new website or app now, include all of this from the start. Adding it later always costs more. Our website development cost guide and custom software guide cover build costs in detail.
Common mistakes to avoid#
- Copying a privacy policy from another website. It will not match how your business actually uses data.
- Pre-ticked checkboxes. Consent must be a clear action by the person.
- One checkbox for everything. Keep service consent and marketing consent separate.
- Customer data on staff phones. When a staff member leaves, the data leaves with them.
- No breach plan. Seventy-two hours goes by very quickly.
- Waiting until May 2027. Developers and consultants will be busy in the last few months.
This guide is general information, not legal advice. For your exact case, speak with your CA or a lawyer who works on data protection.
Get your website DPDP-ready with Larwell#
Larwell Technologies builds and maintains websites, ecommerce stores, PWAs, mobile apps, CRMs and billing software for businesses in Bokaro, Ranchi, Dhanbad, Jamshedpur and across India.
We can check your current website or app against this checklist, add proper notices and consent options, set up secure storage and logs, and build a simple "manage my data" flow. You can then focus on running your business.
Want to know how much work your website needs? Contact us with your website link. We will reply with a clear list of changes and an honest estimate.
