Compliance · 7 min read
DPDP Act compliance for websites and apps: a checklist before May 2027
What India’s data protection rules mean for your forms, apps and databases, in plain English, with a checklist your developer can work through.
Does your website have a contact form? Does your app have a login, or your store keep customer addresses? Then India’s Digital Personal Data Protection Act applies to you. For a long time that felt theoretical. It won’t for much longer, because the rules that give the Act its teeth take full effect in May 2027.
What follows is my attempt to translate the law into what it means for the websites and apps you actually run, finishing with a checklist your developer can work through item by item. I’m a technologist, not a lawyer, so treat this as a practical starting point and have your legal adviser look at your specific situation.
The timeline, in brief
- August 2023: the Digital Personal Data Protection Act, 2023 was passed.
- 13 November 2025: the DPDP Rules, 2025 were notified, and the Data Protection Board was set up straight away.
- November 2026: the provisions for registering consent managers came into force, twelve months after notification.
- Mid-May 2027: eighteen months after notification, the main obligations apply. That covers notices, consent, security safeguards, breach reporting, individuals’ rights and the Board’s power to impose penalties.
Eight months sounds like plenty of time. Once you add up a website, an app, a CRM and a handful of marketing tools, it goes quickly.
Does it apply to your business?
Almost certainly. The Act covers personal data collected in digital form in India, and data collected offline and digitised later. It also reaches businesses outside India if they offer goods or services to people here. There’s no small-business exemption from the core obligations, either. A clinic in Porur with an appointment form is covered in the same way a national retailer is.
The key terms, in plain English
- Data principal: the person the data is about. Your customer, user, applicant or patient.
- Data fiduciary: you, the business that decides why and how the data is used.
- Data processor: anyone processing data on your behalf, such as your hosting company, email tool, CRM or AI provider.
- Consent manager: a registered platform that lets people give, manage and withdraw consent across different businesses.
What it means for a typical website
Contact and enquiry forms
Any form that collects a name, phone number or email needs a clear notice of what you’re collecting and why, plus consent where consent is your basis for using it. Collect only what you need. If a phone number is enough to call someone back, you don’t need their date of birth as well.
Newsletters and marketing
Consent for marketing has to be separate from consent to answer an enquiry, and it can never be pre-ticked. People must be able to withdraw it as easily as they gave it.
Analytics, pixels and tracking tools
Tracking that identifies individuals involves personal data. So audit the scripts running on your site: what each one collects, and whether you need it at all. A side benefit is that fewer third-party scripts make a site faster and safer.
Chat widgets and AI assistants
People share personal details in chat without thinking twice. Check that your provider has proper data-processing terms and doesn’t use your customers’ messages to train its models. I go into this in more depth in our guide to AI chatbots and their costs.
Careers pages
Résumés are packed with personal data. Say how long you keep them, then delete them once you no longer need them.
What it means for apps and customer portals
- Sign-up and onboarding need clear notices before any data is collected. A link to a 20-page policy doesn’t do the job.
- Permissions for location, contacts and camera should be requested only at the moment they’re needed, with a plain reason.
- Users under 18 need verifiable consent from a parent or guardian, and you can’t track them, monitor their behaviour or target ads at them. For education, gaming and social apps this shapes the product itself.
- Account deletion should be available inside the app, and it should really delete the data (subject to any legal retention requirements).
- Admin panels need role-based access, so staff only see the data their job requires.
The checklist
1. Know your data
- List every place personal data comes in: forms, apps, WhatsApp, the payment gateway, spreadsheets, the CRM.
- Write down what’s collected, why, where it’s stored, who can access it and which vendors process it.
2. Rewrite your notices
- Make them standalone, clear and in plain language, with an itemised list of the data collected and the purpose of each item.
- Explain how to withdraw consent, exercise rights and complain to the Data Protection Board.
- Be ready to provide the notice in English or in any language listed in the Eighth Schedule of the Constitution, which includes Tamil, if someone asks for it.
3. Fix consent
- No pre-ticked boxes. Separate consent for separate purposes, such as enquiries and marketing.
- Keep a record of when and how each person consented.
- Make withdrawing consent as easy as giving it, and check that withdrawal really does stop the processing.
4. Secure it properly
- Encryption in transit and at rest, strong access control, and two-factor login on admin accounts.
- Logs that let you detect and investigate misuse, kept for at least a year.
- Tested backups, with security updates applied promptly. Our website maintenance guide explains what that involves.
5. Prepare for a breach before one happens
- Tell affected people without delay, and send the Data Protection Board a detailed report within 72 hours of becoming aware of the breach.
- Write down who does what, who decides and who talks to customers. Then practise it once.
6. Delete what you no longer need
- Set a retention period for each type of data, and delete it once the purpose has been served, unless the law says you have to keep it.
- Very large ecommerce, gaming and social media platforms have specific rules for erasing data after three years of user inactivity, with 48 hours’ notice beforehand.
7. Honour people’s rights
- People can ask what data you hold about them, correct it, have it erased and nominate someone to act on their behalf.
- Publish a contact for data questions and grievances, and reply within the timelines the rules set.
8. Tighten vendor contracts
- Your hosting, email, CRM, analytics, payment and AI providers should be bound by contract to protect the data and use it only on your instructions.
What happens if you ignore it
The Act’s penalties are set per breach, and they’re large. Up to ₹250 crore for failing to take reasonable security safeguards. Up to ₹200 crore for failing to report a breach or to meet the obligations around children’s data. Up to ₹50 crore for other failures. A small business is unlikely to face the maximum, but the reputational damage from a leaked customer list lands immediately, whatever size you are.
What it costs to get compliant
For a typical business website the technical work is fairly modest: rewritten notices, better forms, consent records, a clear-out of third-party scripts and some security hardening. Apps and portals take more, since consent, deletion, access control and logging all reach into the product itself. Building this in during a redesign or a new build costs far less than retrofitting it, which is one good reason to plan it into your development process from the first week.
How we can help
We aren’t lawyers and won’t pretend to be. We handle the technical side: auditing what your website or app collects, rebuilding forms and consent flows, securing the data, setting up logging and breach procedures, and working alongside your legal adviser while we do it. See our custom software and website development pages, or get in touch for an audit.
