DPDP Act compliance starts with understanding what your business actually does with personal data. A contact form may send information to WordPress, an email inbox, a CRM and a marketing platform within seconds. A privacy policy cannot manage those copies by itself. Your notices, permissions, software settings, retention decisions and support processes need to work together.
Reviewed: 7 September 2026. India’s Digital Personal Data Protection Act, 2023 and the final DPDP Rules, 2025 have phased commencement. The main business-facing duties are scheduled for the eighteen-month phase in May 2027 under the notified timetable. It would be inaccurate to say that every duty is already enforceable simply because a website collects an email address. Existing legal and contractual obligations still need separate attention.
This guide provides general information and technical readiness guidance for Indian businesses. Obtain qualified Indian legal advice on your particular processing, exemptions and statutory deadlines. The examples and project timings below are practical planning suggestions, not a legal opinion or a compliance certification.
For the wider operational context, explore Technology Consulting and Business Technology. The goal is a process your team can explain, demonstrate and maintain.
What the DPDP Act Covers
The DPDP Act, particularly sections 2–4, addresses digital personal data processed in India, including information collected on paper and later digitised. It also reaches certain processing outside India connected with offering goods or services to individuals in India. The question is whether an individual is identifiable from, or in relation to, the information; a technology’s product name alone does not settle that question.
Names and contact details in an enquiry are straightforward examples. Account identifiers, purchase histories and advertising identifiers also need assessment in context. Calling data “anonymous” in a dashboard does not establish that no person can be identified. Review what is collected, what other records it connects to and who can make those connections.
A Data Fiduciary determines the purpose and means of processing. A Data Processor processes on its behalf. The person to whom the information relates is the Data Principal. A business can have different roles for different activities. An agency’s handling of a client’s enquiry list may differ from its use of its own prospects database.
Do not assume that being a startup or a sole proprietor creates a blanket exemption. Equally, do not ignore statutory exclusions or notified exemptions. Personal or domestic processing and specified publicly available data have particular treatment under the Act. Any proposed exemption should be documented against its exact conditions rather than inferred from company size or a public website address.
DPDP Rules 2025: The Phased Timeline
Read Rule 1 of the final DPDP Rules with the official commencement notifications. The December 2025 corrigendum clarifies wording referring to publication in the Official Gazette; it does not replace the one-year and eighteen-month periods with a new universal deadline.
| Phase under the notified schedule | Main effect | Practical response |
|---|---|---|
| November 2025: immediate phase | Initial institutional and administrative provisions; Rules 1, 2 and 17–21. | Identify an owner and track official implementation notices. |
| November 2026: one-year phase | Rule 4 and the specified Consent Manager registration provisions. | Check the role and registration claims of any service marketed as a statutory Consent Manager. |
| May 2027: eighteen-month phase | Most substantive business-facing obligations and Rules 3, 5–16, 22 and 23. | Complete the applicable notice, consent, rights, security, retention and incident-response work before commencement. |
Keep the actual applicable commencement date from the Gazette in your compliance register. This month-level table is for project planning, not for calculating the last permissible day. If a new notification changes the timetable for your organisation, update the register and delivery plan. A proposal, news report or software vendor’s deadline is not a substitute for an operative notification.
Aim to finish implementation with time for failures, vendor responses and staff training. Buying a banner shortly before a deadline does not address old spreadsheets, CRM exports, outsourced campaigns or a privacy inbox that nobody monitors. Assign each work item a responsible person, a completion date and evidence showing that the change works.
A registered Consent Manager under the Act is a defined regulated role. A consent management platform, cookie banner or WordPress plugin is not automatically such an entity. Ordinary businesses should evaluate the function they need and verify a supplier’s precise claim, rather than assume that every banner vendor must have statutory Consent Manager registration.
Map Website and Marketing Data Before Buying Tools
Start with one customer journey: a visitor asks for a quotation. Submit a clearly labelled test enquiry containing fictional details and trace it through every system. Check the website database, notification email, CRM, automation history, salesperson’s inbox and any spreadsheet export. The result should be a usable inventory, not merely a list of plugins.
| Collection point | Copies or destinations to investigate | Question to answer |
|---|---|---|
| Contact or quotation form | Form entries, inboxes, CRM, integration logs | Which fields are necessary to answer this request? |
| Newsletter subscription | Email platform, CRM, confirmation records | Can the system distinguish subscription from a service enquiry? |
| Analytics and advertising | Tags, browser storage, events, audience exports | What leaves the browser before and after each choice? |
| Chat, booking or WhatsApp enquiry | Widget provider, conversations, staff devices | Where can a correction or withdrawal be applied? |
| Customer or partner onboarding | Documents, shared folders, account records | Who needs access, and what retention rule applies? |
For each activity, record the business purpose, fields collected, responsible team, proposed legal basis, recipients, access permissions, retention decision and deletion method. Add links to the actual notice and relevant vendor terms. Avoid a single “consent: yes” column that tries to cover every possible use of the record.
Include information collected outside the main website: lead forms hosted by advertising platforms, event registrations, incoming email, referral partners and manually imported contacts. These routes often bypass the banner entirely. A website scan cannot show whether a salesperson uploads a customer list to an advertising account next week.
Treat the inventory as a working document. When a plugin, campaign or integration changes, the person requesting that change should explain whether it introduces another destination or purpose. This connects privacy review to ordinary business decisions and makes later investigations far more manageable.
Choose a Lawful Basis and Write Useful Notices
The Act distinguishes consent from the certain legitimate uses listed in section 7. For example, voluntarily supplied information can support the specified purpose in the circumstances set out there. This is not an unrestricted “legitimate interests” permission for marketing. Have the basis for each activity assessed instead of adding a mandatory checkbox to every form and assuming the analysis is complete. See sections 4–7 of the Act.
A request for a quotation and a request for promotional email are different choices. Make that distinction visible in both the form and the CRM. An optional marketing choice should not silently become required when somebody asks a service question. The form’s wording, the saved record and the automation rules should all describe the same purpose.
Write notices around the actual journey. Explain the personal data involved, the specific purpose, the available contact or rights route and how withdrawal works where consent is used. Make the information understandable before the person acts. Assess the Act’s language-access requirements rather than assuming a dense English-only policy will suit every audience.
A Form Example to Adapt
Illustrative purpose statement: “We use the contact details and project information you provide to respond to this website-design enquiry and discuss the requested work.” A separate, unticked choice might say: “Send me occasional website and marketing tips by email. I can unsubscribe at any time.” These are drafting examples, not a complete statutory notice: connect them to the required information and working rights channels for your business.
Avoid promising a response within twenty-four hours unless your team can consistently deliver it. Do not request a home address, identity document or date of birth merely because a form template contains those fields. Ask each field owner what decision would become impossible without that information. If there is no useful answer, reconsider the field.
Store enough evidence to reconstruct the choice: the notice version, purpose, submission time, source form and relevant consent or withdrawal status. Protect those records and give them an assessed retention schedule. Evidence should show what the person saw and did; a retrospective tick in a spreadsheet cannot establish that.
Existing records need attention too. Separate documented consent, unclear provenance and records held for other assessed purposes. The Act has transition provisions for consent given before commencement. Review those with counsel; do not fabricate historic consent or assume that sending a new privacy policy automatically repairs an unsupported marketing list.
Keep Marketing Permissions Connected to the CRM
A well-designed collection form is only the beginning. If an integration marks every incoming contact as subscribed, the downstream system defeats the choice made on the website. Test both paths: an enquiry without marketing permission and an enquiry with it. Check the resulting contact status, mailing lists, follow-up sequences and advertising exports.
- Use separate fields for enquiry status and permission for each marketing purpose or channel.
- Prevent routine imports from overwriting a withdrawal or suppression status.
- Record where an imported list came from and what use was actually authorised.
- Restrict who can export contacts or create advertising audiences.
- Test whether an unsubscribe reaches connected systems and stops the intended communications.
An email unsubscribe should not require a sales conversation. A person who withdraws promotional permission may still need a response about an existing order or open support request; keep these workflows distinguishable and assess their respective bases. Avoid treating every message containing a company logo as the same kind of communication.
The same discipline applies to WhatsApp, SMS and partner referrals. Permission in one context should not be assumed to cover every other channel. Telecommunications requirements and platform policies may create additional conditions beyond DPDP. Record the channels and intended use before launching a campaign, rather than treating permission as a reusable marketing asset.
Suppression creates a practical design question: how will you prevent a withdrawn contact from being added again? Assess whether a restricted, minimal suppression record should be kept, why it is necessary and for how long. Keep it separate from active campaigns and explain the decision in your retention documentation.
Cookie Consent, GA4 and Advertising Tags
DPDP is a personal-data framework, not a rule that every cookie is identical. Assess the information and purpose behind each technology. Authentication, fraud prevention, audience measurement and personalised advertising are different activities. For optional analytics or advertising relying on consent, blocking the relevant processing until a valid choice is a practical approach. Have any alternative processing basis reviewed.
Make choices understandable and usable on mobile. Use clear labels, avoid preselected optional permissions and provide an accessible way to revisit a decision. A visitor should not need to hunt through several policy pages to find the control. Test keyboard access, zoom, scrolling and whether the banner obscures the form it is meant to explain.
What GA4 Does With IP Addresses
Google states that Analytics does not log or store IP addresses. Advising every GA4 user to turn on an old IP-anonymisation setting is therefore misleading. Other identifiers, configured events and linked products still need review. This technical feature does not by itself prove that a particular deployment is outside personal-data obligations. See Google’s data-safeguarding documentation.
Inspect what your own implementation sends. Google’s guidance on avoiding personally identifiable information highlights risks in page URLs, titles and other collected fields. A thank-you page containing an email address in its query string can disclose information even when nobody intentionally created an “email” event parameter.
Use fictional test values when checking forms. Review URLs, event parameters, custom dimensions and integration payloads. Keep enquiry messages, phone numbers and email addresses out of ordinary Analytics collection. Special advertising features that intentionally accept user-provided information need their own policy and legal assessment; they should not be treated as permission to send form contents everywhere.
Basic and Advanced Consent Mode Are Different
According to Google’s Consent Mode documentation, a basic implementation blocks Google tags until consent and sends no Google data when consent is denied. An advanced implementation can load tags and send cookieless signals in a denied state. Therefore, “Consent Mode enabled” does not mean “nothing is transmitted before consent.”
Choose the implementation that matches the assessed processing and the promise made to visitors. If your notice says no optional analytics data will leave the browser before agreement, verify that precise behaviour. Do not describe cookieless measurement as automatically lawful or anonymous in every legal context. The technical settings and the legal assessment answer different questions.
Review analytics_storage, ad_storage, ad_user_data and ad_personalization where relevant. Set and update them intentionally, and check other tags separately. Google’s implementation guide explains default states and updates. A Google consent signal cannot be assumed to control every chat widget, social pixel or custom script.
For reporting context, our GA4 guide can help you discuss events and measurement with your developer. Keep the privacy review attached to the actual configuration rather than a generic list of recommended analytics features.
A WordPress Privacy Test You Can Repeat
WordPress can load scripts through a theme, page builder, tag manager, advertising plugin or manually inserted code. Removing one installation may leave another active. Start by identifying every place where the relevant code is added. Work on a controlled test setup where appropriate, and repeat the final checks on the public site after release.
| Test scenario | What to inspect | Evidence to keep |
|---|---|---|
| Fresh visitor, no choice | Optional scripts, storage and outgoing requests | A dated trace of the observed behaviour. |
| Optional purposes refused | Whether refused processing starts anyway | The choice shown and the requests that follow. |
| One purpose accepted | Whether unrelated purposes remain disabled | Category settings and the corresponding event trace. |
| Consent later withdrawn | Future tag activity and downstream updates | The revised state, reload result and system changes. |
| Form submitted without marketing opt-in | CRM and mailing-list status | A labelled fictional test record and automation result. |
Include cached pages, mobile layouts, returning visitors and embedded booking or chat screens. If the site serves several regions, test the actual regional configuration rather than assuming the default applies everywhere. A screenshot of a banner is useful evidence of wording, but it does not show network behaviour.
A consent plugin or the WordPress Consent API may help compatible components exchange choices. Neither supplies the whole compliance process. Check the installed versions, supported integrations and fallback behaviour. After an update, confirm that duplicate tags, delayed scripts or custom forms have not bypassed the agreed controls.
Build a Working Rights and Grievance Process
Prepare for requests covering access information, correction, erasure, grievance redressal and nomination under the applicable provisions. The Government’s DPDP overview explains the citizen-facing rights and contact expectations. Your process must reach the systems holding the information, including relevant processors; publishing a mailbox alone does not achieve that.
The ninety-day provision in Rule 14 concerns the published grievance-response period, which must be reasonable and not exceed ninety days. It is not a blanket entitlement to leave every access, deletion or unsubscribe request untouched for ninety days. Set practical internal targets, track the applicable requirement and escalate approaching deadlines.
- Acknowledge the request and record its type, receipt date and responsible person.
- Verify identity proportionately before revealing or changing personal information.
- Locate relevant records using the data inventory, including processor-held copies.
- Assess any continuing purpose or legal retention requirement before erasure.
- Record the action, explain any limitation and confirm the outcome through an appropriate channel.
Do not require an Aadhaar scan for every simple newsletter request merely to make verification feel formal. Verification should address the risk of disclosure or alteration without creating unnecessary collections. More sensitive account requests may need stronger checks. Document the reasoning and make the route workable for people who cannot access their old account.
For ordinary businesses, designate a person able to answer privacy questions and maintain the required contact information. Do not assume that every website must appoint a statutory Data Protection Officer under DPDP. A named operational owner, backup cover and tested escalation route make the process more dependable than an impressive title without authority.
Retention and Erasure Need a Record-by-Record Plan
Avoid both extremes: keeping every lead forever and promising that every record disappears immediately after an unsubscribe. Classify active enquiries, completed transactions, marketing subscriptions, security records, consent evidence and backups separately. Their purposes and applicable retention requirements can differ.
The final Rules include specific retention provisions that an oversimplified deletion checklist can miss. Rule 6 addresses certain security-related logs and data, while Rule 8(3) provides for a minimum one-year retention period for processing-related personal data, traffic data and logs for the specified purposes. The Third Schedule’s inactivity periods apply to specified classes, not a universal three-year rule for every website. Review the exact requirements in the official Rules before setting automated deletion.
Create a schedule with the record category, owner, purpose, trigger date, applicable requirement, access restriction and deletion or review action. Where continued retention is required, distinguish that controlled retention from permission to keep using the record for marketing. A legal hold or security archive should not feed an active audience list.
Include the less visible copies: exports on laptops, integration logs, email attachments, old staging databases and backup snapshots. Ask vendors how erasure works in live systems and backups. Document restrictions and expiry rather than promising selective backup deletion that your infrastructure cannot deliver.
Test a deletion workflow using a fictional record. Check whether an overnight sync recreates it or an old import changes its status. Record exceptions and resolve them with the system owner. The useful outcome is a repeatable decision and a verifiable action, not an unexplained “delete after ninety days” setting.
Security and Breach Notification: Do Not Wait Seventy-Two Hours
Reasonable security is an ongoing operating task. Use individual accounts, appropriate access rights, strong authentication, supported software, protected backups and monitoring. Review export permissions as carefully as administrator permissions: a user who can download every contact can create substantial exposure without changing the website.
For the DPDP breach process when the relevant provisions commence, Rule 7 requires initial intimation to the Board and communication to affected individuals without delay. Updated, detailed information goes to the Board within seventy-two hours of awareness, unless the Board allows a longer period on a written request. The seventy-two-hour period is not permission to postpone the initial notification.
Maintain an incident procedure that identifies who coordinates technical containment, establishes facts, seeks legal advice and authorises communications. Record the time of awareness, systems involved, affected information, known consequences and measures taken. Distinguish confirmed facts from questions still under investigation; do not wait for a perfect root-cause report before assessing notification duties.
Existing reporting regimes also matter. The CERT-In directions require covered entities to report specified cyber incidents within six hours of noticing them or being informed of them. Assess their scope and any sectoral requirements separately. A future DPDP reporting process must not displace obligations already applicable to an incident.
Rehearse a realistic scenario such as a publicly exposed form export. Can staff identify the owner, preserve relevant evidence, restrict access, contact the processor and reach the decision-maker outside office hours? Keep an accessible contact tree and a secure record of decisions. Do not circulate the exposed customer file through ordinary email while trying to investigate it.
Children’s Data and Significant Data Fiduciaries
Children’s services require their own assessment. The Act generally treats a person under eighteen as a child, and the framework addresses verifiable parental consent, harmful processing, tracking, behavioural monitoring and targeted advertising, with specific exceptions and conditions. The Government’s August 2026 statement on children’s online privacy restates these protections.
For an education or family-facing website, review who actually uses the service and what the advertising tools infer or collect. Do not assume that a basic age checkbox is a complete parental-verification system. Equally, do not collect identity documents from every visitor without assessing necessity, safeguards and suitable alternatives. Seek specialist advice before relying on a child-data exception.
A Significant Data Fiduciary is designated by government notification; growing traffic does not automatically confer that status. Section 10 of the Act provides for additional responsibilities including an India-based DPO and independent data audit. Rule 13 adds requirements including an assessment and audit every twelve months. Monitor relevant designations and their scope rather than guessing an unofficial user-count threshold.
Cross-Border Vendors and Cloud Platforms
Do not assume that every global SaaS product stores every customer’s data outside India, or that choosing an Indian hosting region resolves every transfer question. Verify the selected region, subprocessors, support access, backup locations and contractual arrangements for the particular service and plan.
Section 16 of the Act permits notified restrictions on overseas transfers and preserves stronger protections under other applicable laws. Rules 13 and 15 add matters to assess, including specified SDF data and government requirements concerning availability to foreign states or related entities. Read the transfer provisions alongside your sector’s requirements; a general-purpose article cannot certify a vendor arrangement.
Ask each important provider how it handles requests, incidents, return of data and deletion on termination. Identify who will respond when your business needs evidence quickly. For agencies, document client instructions and which party manages each destination. A supplier’s statement that it is “DPDP ready” should start a review, not finish it.
Understand Penalties Without Treating Them as Automatic Fines
The Schedule to the Act sets maximum penalties for specified contraventions. The Government’s official framework summary explains the principal ceilings. These are not automatic charges for every website error, and the applicable provisions, facts and adjudication matter.
| Contravention category | Maximum statutory penalty |
|---|---|
| Failure to take reasonable security safeguards | Up to ₹250 crore |
| Failure to give the required breach intimations | Up to ₹200 crore |
| Breach of obligations relating to children | Up to ₹200 crore |
| Breach of additional Significant Data Fiduciary obligations | Up to ₹150 crore |
| Other breaches covered by the residual provision | Up to ₹50 crore |
Use this information to prioritise ownership and controls, not to frighten a small-business owner into buying a plugin. A useful readiness report explains the particular issue, the applicable requirement, the evidence and the proposed fix. Avoid unsupported claims that one missing checkbox will necessarily attract the maximum penalty.
A Thirty-Day DPDP Readiness Project
The following is a suggested first project for a manageable small-business website. It is not a statutory grace period or a promise that every organisation can finish in thirty days. Larger or higher-risk operations may need substantially more work and specialist support.
Week One: Establish the Facts
Appoint a business owner and map the main data journeys. List forms, scripts, accounts, agencies, integrations and exports. Collect existing notices and vendor agreements. Trace one enquiry from collection to the final destination. Ask staff which records they keep outside the formal systems. By the end of the week, unresolved questions should have an owner instead of remaining informal assumptions.
Week Two: Agree the Decisions
Review purposes, proposed bases, optional marketing choices, retention and rights procedures with the appropriate advisers. Draft clearer notices and decide how the interface will communicate choices. Identify changes that require a developer or vendor. Prioritise unsupported sharing, exposed records and broken withdrawal routes before cosmetic policy edits. Keep the decision log readable enough for the people who will operate the process.
Week Three: Implement and Test
Update the forms, CRM mappings and tag behaviour. Apply access restrictions and create or repair request-handling workflows. Run the test scenarios above with fictional records. Verify that a refused marketing choice stays refused after integrations run. Document both the intended result and the observed result. Fix the difference before considering the task complete.
Week Four: Rehearse and Hand Over
Rehearse a rights request and an incident. Confirm that the backup owner can locate the relevant information and contact vendors. Review the live website after deployment. Give staff a short operating guide explaining common decisions and escalation points. Schedule checks when systems or purposes change, and maintain a list of outstanding legal or technical dependencies.
Your handover should include the inventory, assessed purposes and bases, notice versions, relevant consent evidence, vendor register, retention schedule, request procedure, incident contacts and test results. Limit access appropriately; a compliance folder should not become a second uncontrolled customer database.
Common Questions About DPDP Act Compliance
Does a small business need to prepare?
Yes, if its activities fall within the framework’s scope. Size alone is not a blanket exemption. Determine the processing activities, applicable phase and any specific exemption with qualified advice. Start with the records you actually hold instead of assuming either complete exclusion or identical obligations for every business.
Must every contact form contain a mandatory consent checkbox?
No single interface pattern establishes the correct basis for every activity. A service enquiry and optional newsletter signup require separate analysis. Where consent is the chosen basis, make the choice specific and affirmative and keep suitable evidence. Do not bundle optional marketing into a required service request.
Does Consent Mode make a site DPDP compliant?
No. It is a technical mechanism for communicating choices to supported tags. The notice, processing basis, configuration, other scripts, downstream systems and organisational processes still need assessment. In particular, an advanced implementation can transmit signals while storage consent is denied.
Does a privacy policy or GDPR banner cover everything?
No. Existing privacy work can be useful, but it needs to be mapped to the applicable Indian framework and your actual operations. If your business serves other jurisdictions, assess those regimes separately. A copied policy or a vendor badge cannot demonstrate what a form, integration or employee export actually does.
Will privacy improvements increase search rankings?
Clear privacy practices can help visitors make informed decisions and trust a business. They do not establish a guaranteed ranking improvement, a numerical E-E-A-T score or a Rank Math compliance certificate. Keep legal readiness, content quality and search-performance measurement distinct, and avoid unsupported claims about an automatic SEO reward.
What should be fixed first?
Begin with data exposure, unsupported uses, uncontrolled access and non-working withdrawal or request channels. Then connect notices to actual system behaviour and document the remaining decisions. A prioritised programme with tested controls is more useful than an ambitious checklist marked complete without evidence.
Discuss Your Website Readiness With My Advisers
If you need help inspecting forms, analytics, advertising tags and integrations, contact My Advisers to discuss a technical readiness review. Share your website address, main customer journeys and the names of the systems you use. Do not send customer databases, credentials or identity documents through an initial enquiry.
A useful project scope identifies the systems to review, the tests to perform, responsible owners and the evidence to deliver. Technical implementation should support decisions reviewed by qualified legal advisers; it should not be presented as legal certification. Our Web Development and Digital Marketing pages provide context for the website and campaign work involved.
Hashtags: #DPDPAct #DataPrivacyIndia #WebsitePrivacy #ConsentManagement #MarketingCompliance #DataSecurity
Related My Advisers guides: Technology Consulting for Digital Growth: Complete Guide · Affordable Website Development Agency in India · Best AI Digital Marketing Agency in India: Complete Guide to AI-Powered Digital Growth
Related My Advisers resources: Technology Consulting Guide · Business Technology
Related My Advisers Resources
Explore the Technology Consulting Guide and Business Technology resources for practical technology guidance. For business support, visit our Services, review Pricing Plans, or Apply for My Advisers services.