DPDP Act for Indian Small-Business Websites: What to Prepare Before May 2027

1. Understand the DPDP Act dates before treating a deadline as urgent

India's Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 are being brought into force in stages. The Rules were notified in the Gazette on 13 November 2025. The commencement notification and Rule 1 set different dates for different provisions; there is no single date on which every part of the framework began.

The one-year milestone on 13 November 2026 concerns registration of Consent Managers and related Board powers. Section 6(9) of the Act and Rule 4 of the Rules concern Consent Managers. A normal business using a contact form, CRM or WhatsApp enquiry channel does not become a Consent Manager simply by collecting customer details.

The main Data Fiduciary obligations and most operational Rules are scheduled for 13 May 2027: the commencement notification places sections 3–17 and related provisions in the eighteen-month group, while Rule 1(4) places Rules 3, 5–16, 22 and 23 in that group. Some institutional and definitional provisions took effect earlier. Check the official notifications for the exact provision and date before making a legal decision.

• 13 November 2025: initial provisions, including the Data Protection Board framework, commenced.
• 13 November 2026: Consent Manager registration and related provisions are scheduled to commence.
• 13 May 2027: the principal Data Fiduciary duties and most operational Rules are scheduled to commence.

2. Check whether your website processes digital personal data

The Act defines personal data as data about an individual who is identifiable by or in relation to that data. It covers digital personal data processed in India and can also apply to processing outside India connected with offering goods or services to people in India. A small business is not automatically outside scope just because it has a small team or a simple website.

If your business decides why and how enquiry details are used, it may be the Data Fiduciary. A hosting provider, CRM, email platform or developer processing those details on your behalf may act as a Data Processor, depending on the actual arrangement. The label in a vendor proposal is not a substitute for reviewing what each party really does.

• Contact form: name, phone, email and the message a visitor submits.
• WhatsApp or callback: phone number, conversation history and follow-up notes.
• Newsletter or marketing: email or phone number and communication preferences.
• Checkout or booking: customer, delivery, payment and order information.
• Analytics or advertising: identifiers and event data; assess whether the information relates to an identifiable person.

3. Create a simple data inventory before rewriting the privacy policy

Spend 30–60 minutes tracing one real customer journey from the first click to the final follow-up. For every form, chat button, pixel, CRM integration or checkout, write down the fields collected, the purpose, the system receiving the data, the people with access and the point at which the information is no longer needed.

For example, if a visitor submits a name, phone number and service question, the immediate purpose may be to respond to that enquiry. That does not automatically explain why the same details should be added to an unrelated promotional list, shared with another business or kept indefinitely. Keep each purpose visible in your process.

• List every collection point, including embedded forms and third-party widgets.
• Record the minimum fields needed for each purpose.
• Name the database, inbox, CRM or vendor where each field goes.
• Identify the business owner and staff roles that can view or export the data.
• Write down the retention reason and deletion method for each system.

4. Put a clear privacy notice next to the point of collection

Rule 3 of the DPDP Rules describes a notice that is understandable on its own, written in clear and plain language, and itemises the personal data and the specific purposes for processing. It also requires links or other means through which a person can withdraw consent, exercise rights and make a complaint. These operational requirements are scheduled for the eighteen-month commencement date, so use the time before May 2027 to design the notice and the process behind it.

A footer link alone may not answer the visitor's question at the moment a form asks for a phone number. Place a short explanation near the form and link to the full notice. Keep the wording consistent with what the website and connected tools actually do.

• Explain which fields are collected and why they are needed.
• Identify the service or response the visitor is requesting.
• Explain any optional marketing use separately from handling the enquiry.
• Provide a working contact route for privacy questions and requests.
• Offer the notice in the languages appropriate to the people you serve.

5. Do not bundle an enquiry with unrelated marketing

Where consent is the basis for processing, section 6 says it must be free, specific, informed, unconditional and unambiguous, with a clear affirmative action. It must be limited to the personal data necessary for the specified purpose. The Act also recognises certain legitimate uses, including where a person voluntarily provides data for a specified purpose and has not indicated otherwise. Which basis applies depends on the actual purpose and facts; do not assume every use of a lead record is covered by the original enquiry.

A practical form can explain that the business will use the submitted details to respond to the request, then offer a separate optional choice for newsletters or promotional WhatsApp messages. Do not make a marketing opt-in a hidden condition of asking for a quotation. If consent is used, build a way to record it and make withdrawal workable rather than relying on a checkbox that nobody can trace later.

6. Map the vendors and keep control of your business accounts

List the services that touch customer information: website hosting, form delivery, email, WhatsApp providers, analytics, advertising pixels, CRM, cloud storage and support contractors. Record what each receives, why it receives it, who administers the account and how access is removed when a contract ends.

Section 8 of the Act makes a Data Fiduciary responsible for processing carried out on its behalf and provides for engaging a Data Processor under a valid contract. The Rules also describe security provisions in processor contracts. Prepare a written vendor register and make sure agreements cover permitted use, confidentiality, security, incident notification, subcontractors, return or deletion of data and exit assistance.

Keep the domain registrar, hosting, analytics, Search Console and primary CRM under a business-controlled email address. Give developers named collaborator access instead of sharing the owner's password. A recent r/IndiaBusiness discussion about website ownership described the practical risk of a business losing domain, hosting, admin or source-code access when its original developer became unavailable. Treat that discussion as a qualitative warning, not a measure of how often this happens.

• Use separate named accounts and least-privilege access.
• Enable multi-factor authentication on owner and administrator accounts.
• Keep recovery details and renewal dates in a controlled business record.
• Remove former staff and vendors promptly when access is no longer needed.
• Confirm who can export, change or delete customer records.

7. Prepare security, retention and deletion workflows

Rule 6 describes reasonable safeguards including encryption or masking, access controls, logs and monitoring, backups, processor-contract provisions and organisational controls. Rule 7 describes breach intimation, including detailed information to the Board within seventy-two hours, subject to the Rule's wording and process. These Rules are scheduled for the eighteen-month commencement date, but the underlying controls are sensible to design before a problem occurs.

Do not invent one universal retention period for every lead. Set a documented period based on the purpose and any other law that requires records to be kept. When the purpose ends and no legal retention requirement applies, create a reliable way to delete or de-identify the record in the CRM, inbox, exports and relevant processor systems. The Rules include specific retention provisions and schedules, so check the exact category and purpose rather than applying a blanket one-year or three-year rule to every record.

Write a short incident checklist: who investigates, who can disable a compromised account, where logs are found, how backups are restored, who contacts affected people and who obtains legal advice. Keep an inventory of vendors so the team knows whom to notify.

8. Test the real customer journey, not only the privacy-policy page

A policy can say that a person may withdraw consent or request deletion, but the business still needs a process that works. Test a form submission with a controlled test record, confirm where the data appears, verify that only authorised people can access it, and trace how an update or deletion would reach connected systems. Do not use real customer data for development tests unless the environment and access are appropriate.

For a website project, include these checks in acceptance and handover: form fields, notice placement, separate optional choices, confirmation messages, access roles, analytics configuration, backups, export capability and a named contact for privacy requests. Ask the developer to demonstrate the workflow and document what is outside the agreed scope.

A practical 30-day preparation plan

You do not need to buy an enterprise compliance platform to begin. Start with a spreadsheet, a named owner and a weekly review. Bring in qualified legal or security advice where the business handles sensitive, children's, financial, health or high-volume personal data, or where the legal basis is unclear.

• Week 1 — inventory every website and messaging collection point; map fields, purposes and systems.
• Week 2 — draft plain-language notices and separate optional marketing choices; have the legal wording reviewed.
• Week 3 — list vendors, review contracts, tighten account access, enable MFA and confirm backups.
• Week 4 — test a data request, withdrawal and deletion path; write an incident contact list and record unresolved gaps.

Frequently asked questions

Does the DPDP Act apply to a small business website? Potentially, yes. The key questions are whether digital personal data about identifiable individuals is processed and whether the Act's territorial scope is met; business size alone is not the test.

Is 13 November 2026 the general deadline for every business? No. The one-year commencement group concerns Consent Manager registration and related provisions. The main Data Fiduciary duties and most operational Rules are scheduled for 13 May 2027.

Is a privacy policy enough? No. The notice must match actual collection and use, and the business needs working access controls, vendor arrangements, retention and deletion processes, and a way to handle requests.

Does the Act mean every website needs a Data Protection Officer? The Act's specific DPO appointment requirement is for Significant Data Fiduciaries. The Rules separately require publication of business contact information for a person who can answer questions about processing. Confirm which requirements apply to your business and current commencement date with qualified counsel.

Can a website developer make my business compliant? A developer can implement forms, consent interfaces, access controls, logs and deletion workflows. The business must still decide its purposes, legal basis, notices, retention and vendor responsibilities. Legal review should be done by a qualified professional.

Official sources and further reading

Use the official Act, Gazette Rules and commencement notification as the legal source of truth. The MSME Ministry's annual report also describes website and app provision for online presence as part of its Digital MSME initiative; this is policy context, not a claim that a specific grant is currently open. Founder discussions on Reddit are useful for understanding practical questions, but they are not legal guidance or verified market statistics.