Updated 2 November 2026. This is a practical guide for founders, product owners and developers, not legal advice. Read the Rules on the MeitY website and speak to a lawyer for your specific case.
Short answer: India's Digital Personal Data Protection (DPDP) Act, 2023 applies to almost every business that collects personal data online, from a contact form to a full app. The DPDP Rules, 2025 were notified in November 2025 with a phased timeline. The Consent Manager rules start on 13 November 2026, and most obligations for businesses start on 13 May 2027. That leaves roughly six months to fix consent, notices, security and data deletion in your website and apps.
Key dates to know
| Date | What happens |
|---|---|
| 13 November 2025 | DPDP Rules, 2025 notified; provisions on the Data Protection Board took effect |
| October 2026 | A Removal of Difficulties Order clarified wording in sections 9 (children and persons with disability) and 10 (data audit for Significant Data Fiduciaries) |
| 13 November 2026 | Rule on registration and obligations of Consent Managers takes effect |
| 13 May 2027 | Main obligations for Data Fiduciaries take effect: notice, consent, security, breach reporting, retention, children's data and rights |
Sources: Legal 500 and SCC Online. Always check for later changes before you finalise plans.
Does the DPDP Act apply to your business?
If you collect personal data of people in India in digital form, the answer is very likely yes. That includes names and phone numbers from an enquiry form, customer accounts in an e-commerce store, patient records in clinic software, student data in a school app and leads in your CRM. In the Act's language, your business is a Data Fiduciary, the person whose data you hold is a Data Principal, and an agency or software vendor that processes data for you is a Data Processor. You remain responsible for what your processors do with the data.
The checklist for websites and apps
1. Know what data you collect
Make a simple data map: every form, signup, checkout, app screen, analytics tool, chat widget and CRM where personal data enters. Note what you collect, why, where it is stored, who can access it and which vendors receive it. You cannot comply with what you cannot see.
2. Collect less
Remove fields you do not need. If a lead form only needs a name and phone number, do not ask for date of birth or address. Less data means less risk and a simpler notice.
3. Give a clear notice before consent
The Rules require a notice in clear and plain language that can be understood on its own. It should list the personal data and the specific purposes, explain how to withdraw consent and exercise rights, and say how to complain to the Data Protection Board. A long legal privacy policy in the footer is not enough on its own; show a short notice at the point of collection and link to the full policy.
4. Get valid consent and make withdrawal easy
- Use unticked checkboxes, not pre-ticked ones or "by continuing you agree" banners.
- Ask for consent per purpose. Marketing messages need their own opt-in, separate from order updates.
- Withdrawing consent should be as easy as giving it, for example a toggle in the account settings or an unsubscribe link.
- Store a consent record: who agreed, to which notice version, when and through which screen.
5. Review cookies and trackers
Analytics, ad pixels and session recording tools often collect personal data. Load non-essential trackers only after the visitor agrees, and list the vendors in your notice. Our technical SEO checklist explains how to keep a site fast while doing this.
6. Put reasonable security safeguards in place
The Rules list measures such as encryption, masking or tokenisation of data, access control, monitoring of access, backups for continuity and contracts with processors that require similar safeguards. They also require logs that help detect and investigate unauthorised access to be kept for at least one year, as explained by iPleaders. For a typical web app this means HTTPS everywhere, hashed passwords, role-based admin access, multi-factor login for staff, encrypted backups, regular updates and an access log you actually review. Our cyber security team can run a quick assessment.
7. Prepare a breach response plan
If personal data is breached, you must inform each affected person and the Data Protection Board. A detailed report to the Board is due within 72 hours of becoming aware, unless the Board allows more time. Write the plan now: who decides, who investigates, message templates, and how you will reach users by email, SMS or WhatsApp.
8. Delete data when the purpose is over
Set retention periods for each type of data and automate deletion or anonymisation. Inactive accounts, old leads and abandoned carts should not stay forever. Certain large platforms have specific time limits and must warn users before erasure, so check whether those apply to you.
9. Handle children's data carefully
Under the Act a child is anyone below 18. Processing a child's personal data needs verifiable consent from a parent or lawful guardian, and tracking, behavioural monitoring and targeted advertising aimed at children are restricted. Schools, coaching institutes, ed-tech and gaming apps need a proper age and parental consent flow. If you build for education, see our school management software guide.
10. Support user rights and grievances
People can ask for a summary of their data, correction, completion, erasure and nomination. Publish the contact of the person who answers data questions, give a simple request form or email, and respond within the time you state, which under the Rules should not exceed 90 days.
11. Update vendor contracts
Your hosting provider, CRM, email and WhatsApp tools, payment gateway and development agency all process data for you. Make sure contracts cover security, confidentiality, breach notice and deletion at the end of the service. If you use the WhatsApp Business API, check how message data is stored and for how long.
Penalties
The Data Protection Board can impose penalties of up to ₹250 crore per instance for serious failures such as not taking reasonable security safeguards. Smaller businesses are unlikely to face the maximum, but the cost of a breach, lost trust and rework is real for any company.
A practical six-month plan
- November-December 2026: data map, remove extra fields, list vendors.
- January-February 2027: rewrite notices, build consent capture and withdrawal, fix cookie loading.
- March 2027: security review, access logs, encrypted backups, breach plan.
- April 2027: retention and deletion jobs, rights request flow, vendor contracts.
- Before 13 May 2027: test everything end to end and train staff.
How we can help
Nextinera builds privacy-friendly websites and mobile apps and updates existing ones with consent capture, consent records, role-based access, audit logs and automated deletion. We are a software company, not a law firm, so we work alongside your legal advisor. Book a free call to review your website or app.