DPDP compliance checklist for websites and apps, before May 2027

Open your website's enquiry form and read the fields out loud. Name, phone number, email, city, maybe "class you're preparing for". Could you explain why you collect each field, who can see it and what happens when the person asks you to stop?

India's Digital Personal Data Protection Rules were notified in November 2025. The main business obligations start eighteen months after publication, conventionally stated as 13 May 2027. The work can touch your form, spreadsheet, WhatsApp provider, CRM, payment gateway and backups. Official commencement notification.

The dates that matter#

The notification separates provisions that started immediately, after one year and after eighteen months. Use this as a preparation timeline, and recheck the official notices before implementation. Commencement notification, Rules, Rule 1.

Does this apply to a small business?#

An enquiry form, customer database or booking app is a reason to investigate scope. Personal or domestic processing and certain publicly available data fall outside Section 3. Other exceptions depend on the activity and the legal provision.

Section 17 allows notified exemptions from specified duties for certain businesses, including recognised startups. Ask an adviser which exemption applies to your activity and which duties remain; a startup registration doesn't excuse the whole business. DPDP Act, Sections 3 and 17.

The checklist#

Map every piece of personal data you hold#

Start with an inventory, because every later step depends on it. For each field you collect, record:

• where it enters: website form, app sign-up, WhatsApp, phone call or walk-in register;
• where it ends up: database, Google Sheet, CRM, inbox, payment gateway, backups;
• who can see it, inside your team and at vendors;
• why you need it, and for how long.

For a coaching app, the inventory could include student phone numbers, parent contacts, uploaded answer sheets, payments and attendance. The sign-up form shows only part of it, so add exports and support inboxes before calling the inventory complete.

Rewrite the notice#

For consent-based processing, Rule 3 requires a clear notice that stands on its own, identifying the data and purposes, with ways to withdraw consent, exercise rights and complain. Section 5 lets people choose English or a language in the Eighth Schedule. Rules, Rule 3, Act, Section 5.

Our recommendation is a short notice beside the form, linked to further detail, so a visitor understands the request before submitting. Keep the notice version with each submission so you can reconstruct what they saw.

Collect consent you can prove#

First decide the processing basis with your adviser. Section 7 lists specified legitimate uses, such as certain data voluntarily provided for a stated purpose. That isn't a general permission to add people to a marketing list. When you rely on consent, Section 6 requires an informed, specific, affirmative choice that is as easy to withdraw as it was to give. Act, Sections 6 and 7.

We recommend:

• no pre-ticked boxes;
• separate choices for separate purposes: a callback about an enquiry is not consent to marketing messages;
• withdrawal as easy as the original checkbox, not a support call or a long form;
• a consent record: who agreed, to which notice version, for which purposes, when and on which screen.

Store the withdrawal event too, and make sure downstream marketing systems receive it.

Treat anyone under 18 as a child#

The Act defines a child as someone under 18. The general rule requires verifiable parental consent. Rule 10 addresses adult identity and age verification, permitting reliable information already held or specified identity details or tokens. A self-declared parent checkbox alone doesn't establish those facts. Act, Section 9, Rules, Rule 10.

Section 9 also restricts tracking, behavioural monitoring and targeted advertising directed at children. Rule 12 and the Fourth Schedule contain conditional exemptions, including certain educational and safety activities. An exemption for a classroom activity doesn't automatically cover advertising or unrelated analytics.

If your app serves minors, review each activity and exemption before choosing the flow, and ask whether you can avoid keeping an identity document after verification. Our coaching app guide covers platform selection.

Put the security safeguards in writing and in code#

Rule 6 covers data protection, access control, monitoring, continuity and processor contracts. Rules, Rule 6. Our implementation checklist:

• encryption, obfuscation, masking or virtual tokens for personal data;
• access controls on the systems that hold it;
• logs and monitoring that let you detect and investigate unauthorised access, with retention mapped to the rule;
• backups and the ability to keep processing after an incident;
• contracts that require your data processors to apply safeguards too.

In practice that means named admin accounts, restricted permissions, encrypted connections and an audit trail for sensitive exports. Check hosting defaults rather than assuming logs survive long enough. Don't record complete messages, passwords or payment secrets when an event identifier is enough.

Prepare the breach runbook before you need it#

Rule 7 requires notifying affected people and the Board without delay. The Board's detailed follow-up is normally due within 72 hours of becoming aware, with a longer period possible if the Board accepts a written request. The initial notification can't simply wait for that deadline. Rules, Rule 7.

Seventy-two hours disappears fast when nobody knows who decides. Write a one-page runbook: who investigates, who approves the message to users, who files with the Board and where the contact list lives.

Schedule deletion#

Don't attach one deletion date to every record. Rule 8 includes inactivity rules for specified large platforms. Its separate one-year minimum covers personal data, associated traffic data and processing logs for Seventh Schedule purposes, running from the processing date. The Rules' own e-book example keeps transaction evidence even after account deletion. Rules, Rule 8 and Schedules 3 and 7.

Have counsel reconcile purpose completion, consent withdrawal, statutory retention and any other record-keeping law. A deletion request should stop unnecessary operational use while keeping only records that must remain, with access limited to their retention purpose.

Then make the schedule executable. Record the reason for retention, the event that starts the clock, the systems holding copies and who approves exceptions. For backups, document expiry and a way to reapply deletions after a restore. A restored database shouldn't silently bring back an opted-out lead.

Publish a contact and answer requests#

Publish the processing contact required by Rule 9 and a clear route to exercise rights. Publish the grievance response period too: it must be reasonable and no more than 90 days under Rule 14. That limit concerns grievances, not every access, correction or erasure request. Rules, Rules 9 and 14.

Build a request queue with an owner, an identity check, the applicable deadline and completion evidence. Find records across the inventory, but don't delete a whole family's records because several accounts share a phone number. Record what was erased, restricted or kept, and why.

Check your vendors#

The Act keeps responsibility with the Data Fiduciary for processing done on its behalf, and Rule 6 requires appropriate safeguards in processor contracts. Map each vendor's role with counsel; a payment provider may have its own legal duties as well as the services it supplies to you. Act, Section 8.

Ask each provider how it handles exports, deletion, incident notices, subprocessors and retained copies, and keep those answers beside the contract and settings. A sales-page assurance is weaker evidence than a contract and a working deletion procedure.

What changes in a typical small-business stack#

For WhatsApp specifically, our WhatsApp API cost guide covers consent and opt-outs alongside the budget.

What the penalties look like#

The Act's Schedule sets these ceilings, applied by the Board under Section 33. They are maximums; the Board doesn't impose them automatically whenever an incident happens. DPDP Act and Schedule.

The Board considers factors such as the nature of the breach and the steps taken to reduce harm, so keep evidence of the measures you put in place and the decisions made after an incident.

Where I'd start this month#

If you have one afternoon, do the inventory. If you have a week, settle the processing bases and add the agreed notices and consent records to your website forms. You can then trace one submission through every system instead of treating the privacy policy as the whole job.

If your forms, app or CRM need this work, tell us what you collect and where it goes. We'll map it with you, separate the engineering changes from the questions for a lawyer, and fix the engineering part.

Sources#

Checked 4 October 2026. Recheck new notifications before you implement.

• Ministry of Electronics and IT, Digital Personal Data Protection Act, 2023, Sections 3 to 9, 17, 33 and the penalty Schedule.
• Ministry of Electronics and IT, Digital Personal Data Protection Rules, 2025, the notified text. English starts on page 24 of the PDF.
• Ministry of Electronics and IT, December 2025 corrigendum, read with the Rules.
• Ministry of Electronics and IT, commencement notification, with the phased start dates.
• Press Information Bureau, DPDP Rules, 2025 explainer, November 2025.