Key takeaways

The DPDP Act 2023 and its Rules change how Indian businesses should collect and handle personal data online. Start by mapping what your website collects, then fix your privacy notice, consent and cookie flows, rights and grievance handling, security and breach response, and the contracts with vendors who process data for you.

The Digital Personal Data Protection Act, 2023 (the DPDP Act) is India's first comprehensive law on personal data. Together with the Rules made under it, it sets out how organisations may collect, use, store and share digital personal data, and what rights individuals have over that data. For most businesses, the website is where much personal data first arrives: contact forms, sign-ups, checkout pages, chat widgets, job applications and the analytics and advertising tags running in the background.

This checklist walks through the website-facing parts of the Act in practical terms, so you can see where you stand and what to prioritise. It is written for business owners and marketing or IT teams, not lawyers.

Know the key roles

The Act uses a few specific terms. Understanding them makes the rest of the checklist easier to follow:

  • Data Principal: the individual the personal data relates to, such as your customer, enquirer or job applicant. For a child, this includes their parent or lawful guardian.
  • Data Fiduciary: the organisation that decides why and how personal data is processed. For your own website, that is usually you.
  • Data Processor: a third party that processes data on your behalf, such as a hosting provider, CRM, email platform or payment gateway.
  • Consent Manager: a registered entity that lets individuals give, manage and withdraw consent through an accessible platform.
  • Data Protection Board of India: the body that handles complaints, breach matters and enforcement under the Act.

Map the personal data your website collects

You cannot write an accurate notice or ask for meaningful consent until you know what you collect. Build a simple inventory, even a spreadsheet, covering every point of collection:

  1. List every form, sign-up, checkout step, chat widget, file upload and survey on your site.
  2. List every third-party script: analytics, advertising pixels, heatmaps, embedded videos, chat tools and social plugins.
  3. For each item, record what data is collected, the purpose, where it is stored, who can access it, which vendors receive it and how long it is kept.
  4. Mark which purposes rely on consent and which may fall under a legitimate use recognised by the Act, and have that judgement checked by your legal adviser.

This exercise often reveals forgotten forms, unused tracking tags and old exports sitting in shared drives. Removing what you do not need is the simplest compliance step of all. A data protection architecture review can help you map data flows across your website, CRM and back-office tools.

Rewrite your privacy notice for real people

Under the Act, a request for consent should be accompanied or preceded by a notice that tells the Data Principal what they need to know. In practice, your notice should typically cover:

  • The personal data you collect and the specific purpose for each category.
  • How individuals can exercise their rights and withdraw consent.
  • How they can raise a grievance with you, and how they can complain to the Data Protection Board.
  • Contact details of the person who can answer questions about your processing of personal data.

Write in clear, plain language and avoid copying long templates that do not reflect what you actually do. The Act also contemplates offering the notice in English or in languages listed in the Eighth Schedule to the Constitution, which is worth considering if your audience is regional. Show a short notice at the point of collection, such as beside a form, with a link to the full version, rather than relying only on a footer link.

Where you rely on consent, the Act expects it to be free, specific, informed, unconditional and unambiguous, given through a clear affirmative action, and limited to the data necessary for the stated purpose. On a website, that usually means:

  • No pre-ticked boxes. The person must actively opt in.
  • Separate choices for separate purposes. Agreeing to be contacted about an enquiry should not automatically sign someone up for marketing emails or WhatsApp promotions.
  • Withdrawing consent should be as easy as giving it, for example an unsubscribe link or a preferences page rather than a request by post.
  • Keep a record of when and how consent was given, and what notice was shown at the time.

Cookies and tracking

The Act does not set out a separate cookie regime, but cookies and tags that collect personal data, such as advertising pixels and many analytics configurations, generally need a lawful basis, which for tracking is in most cases consent. Group cookies into categories such as strictly necessary, analytics and marketing, and make sure non-essential tags do not load until the visitor agrees. Offer accept and reject options with equal prominence, and a persistent link to change preferences later. A consent-aware Google Tag Manager setup lets your tags respect these choices, and a clear cookie policy explains them to visitors.

Children's data

The Act treats anyone under 18 as a child and generally requires verifiable consent from a parent or lawful guardian before processing a child's personal data. It also restricts tracking, behavioural monitoring and targeted advertising directed at children, subject to exemptions in the Rules. If your website serves students, families or young customers, review these flows carefully with legal advice.

Support rights requests and grievances

Data Principals have rights that include obtaining information about the processing of their data, seeking correction, completion, updating and erasure, grievance redressal and nominating another person to exercise their rights in the event of death or incapacity. Your website should make these easy to use:

  • Provide a clear channel, such as a dedicated form or email address, for privacy requests. A page like our privacy requests page is one approach.
  • Verify the requester's identity proportionately before acting, without collecting more data than needed.
  • Log each request, track it against the response timelines in the Rules, and record the outcome.
  • Make sure erasure reaches every system that holds the data, including your CRM, email platform and backups where feasible.

Individuals are generally expected to use your grievance process before approaching the Board, so a responsive, well-documented process protects both your customers and your business.

Secure data, plan for breaches and manage processors

Reasonable security safeguards

The Act requires reasonable security safeguards to prevent personal data breaches. For a website, that typically includes HTTPS everywhere, patched plugins and frameworks, strong access control with multi-factor authentication for admin accounts, encryption of sensitive data, secure backups and logs that show who accessed what. A periodic website and application security review and proper security logging and audit trails give you evidence that these safeguards exist.

Breach response

If a personal data breach occurs, the Act requires you to inform the Data Protection Board and each affected Data Principal, in the form and manner set out in the Rules. Prepare a short incident response plan now: who decides, who investigates, who drafts notifications and which vendors to contact.

Processors and retention

You remain responsible for processing carried out on your behalf, so engage processors only under a valid contract that covers security, confidentiality, breach notification and deletion. Review your hosting, CRM, email, payment, analytics and WhatsApp providers. Finally, set retention periods: personal data should generally be erased once the purpose is served or consent is withdrawn, unless another law requires you to keep it, as is common for tax and accounting records.

Quick checklist

  • Data inventory completed and unnecessary collection removed.
  • Plain-language privacy notice published and shown at points of collection.
  • Consent captured actively, per purpose, with records and easy withdrawal.
  • Cookie banner blocks non-essential tags until consent.
  • Rights request and grievance channel live, with a named contact.
  • Security safeguards reviewed and incident response plan documented.
  • Processor contracts and retention periods in place.

Compliance with the DPDP Act is an ongoing practice rather than a one-time project, and much of it is simply good housekeeping. If you would like help with the technical side, such as data mapping, consent-aware tagging or security reviews, our data, testing and security team can work alongside your legal adviser, or you can contact us to discuss your website.

Written by the Yashmitra Global Solutions team. Published .