DPDP Act website checklist for small businesses

If your website has a contact form, a WhatsApp button or Google Analytics, it collects personal data, and India's data protection law applies to how you handle it. This post explains the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 in plain words, what they ask of a small business website, and a DPDP Act website checklist of tasks you can finish this month. It is general information, not legal advice: have a lawyer check your notice and consent texts before you publish them.

The law and its dates

The Digital Personal Data Protection Act, 2023 sets the duties. The DPDP Rules, 2025, published in the Gazette on 13 November 2025, fill in the detail and set the dates. PIB describes an 18-month phased timeline:

• 13 November 2025: rules 1, 2 and 17 to 21 came into force, and the Data Protection Board of India was set up.
• About 13 November 2026: rule 4, on Consent Managers, applies one year after publication.
• About 13 May 2027: rules 3, 5 to 16, 22 and 23 apply, eighteen months after publication by our count. They include the notice (rule 3), security safeguards (rule 6) and breach reporting (rule 7).

Eighteen months sounds long, but changing forms, banners, software settings and staff habits takes time. Starting now means you are ready, not rushing.

Key words in plain language

• Personal data: any data about a person who can be identified by it or with it, such as a name, phone number or email address.
• Data Principal: the person the data is about, such as your customer or a visitor who fills in your form.
• Data Fiduciary: you, the business that decides why and how the data is used.
• Data Processor: a company that handles data for you, such as your web host, email service or booking software.

The Act covers personal data in digital form, and data collected on paper that is later typed into a computer. So the enquiry slips you copy into a spreadsheet count too.

What a small business website collects

Start by listing every place personal data enters your business through the website. For most small businesses the list looks like this:

• Contact and enquiry forms: name, phone, email and message, often landing in an email inbox.
• Booking forms: the date and the reason for a visit, often in booking or practice software.
• WhatsApp chats started from a click-to-chat button, kept in the WhatsApp Business app.
• Newsletter or offer sign-ups by email, SMS or WhatsApp.
• Cookies from analytics and advertising tags, such as Google Analytics, Google Ads or the Meta pixel.
• Payments, customer accounts, job applications and, for clinics, health details.

Take Smile Studio Dental in Kothrud, Pune, a made-up clinic. Its website has a contact form that emails the front desk, an appointment form linked to practice software, a WhatsApp button and Google Analytics. Patients share health details, parents book visits for their children, and job applicants send CVs. The data sits in the website's database, an email inbox, spreadsheets, the practice software and WhatsApp, and the web host, email service, analytics provider, software company and a dental lab each handle some of it. Every one of those is a line on its list, and each needs a notice, a purpose, a safeguard and a deletion date.

Notice and consent in plain language

Notice. Under section 5, when you ask for consent you give a notice that says what personal data you collect and why, how a person can withdraw consent and use their rights, and how they can complain to the Data Protection Board. People must be able to read it in English or any language in the Eighth Schedule to the Constitution. PIB's summary of the Rules adds that the notice must be clear and understandable on its own, and explain the specific purpose. If you already hold data from before, the Act asks you to give these people a notice too, as soon as practicable.

Consent. Section 6 says consent must be "free, specific, informed, unconditional and unambiguous with a clear affirmative action", and cover only the data needed for the purpose. Withdrawing it must be as easy as giving it. In practice, our suggestion is a box the person ticks themselves, with marketing as a second, separate box, and an unsubscribe link in every offer.

When you may not need consent. Section 7(a) allows you to use data a person gave you voluntarily for a specified purpose, unless they said they do not consent. Our reading, to check with your lawyer: a phone number given to book an appointment may be used to confirm that appointment, but not to send offers.

Cookies, analytics and ad tags

We found no rule written only for cookies in the Act or the Rules. Our suggestion is to treat analytics and advertising cookies like any other consent: keep them off until the visitor accepts, make "Reject" as easy as "Accept", and add a "Cookie choices" link so visitors can change their mind, since consent can be withdrawn at any time.

If your site uses Google tags, run a page through our Google Ads Tag and Consent Checker. It reads the page's HTML and its public Tag Manager container, and reports the Google tags it finds, your Consent Mode defaults and updates (ad_storage, ad_user_data, ad_personalization and analytics_storage), the order of the code and whether it can see a consent banner. It cannot see tags that a banner or script adds after the page loads, so confirm the result in Google Tag Assistant by accepting and rejecting your banner.

Purpose, retention and security

Use data only for the purpose you stated. Under section 8(7), erase it when that purpose is over or the person withdraws consent, unless a law makes you keep it, and have your service providers erase it too. A fixed period is easier to follow than case-by-case decisions: for example, delete enquiries 12 months after the last contact. Tax, accounts and medical records may need longer, so ask your CA which records a law makes you keep.

Section 8(5) asks for reasonable security safeguards, including for data your service providers handle. Rule 6 names measures such as encryption, masking and access control, and asks you to keep logs for one year. For a small business, the basics go a long way:

• Turn on 2-step verification for the email inbox where enquiries arrive.
• Share spreadsheets with named staff only, never "anyone with the link".
• Give each staff member their own software login, and remove it when they leave.
• Keep the website, its plugins and HTTPS up to date.

Your service providers must work for you only under a valid contract, and you stay responsible for what they do with the data on your behalf (sections 8(1) and 8(2)).

Breaches, complaints and children's data

Breaches. Under rule 7, after a personal data breach you tell each affected person without delay, in plain language. You also tell the Data Protection Board without delay, and send it a detailed report within 72 hours of becoming aware of the breach, or longer if the Board allows it on a written request. Write the plan before you need it. If you will tell people by email, make sure your domain's email is set up so the message arrives and cannot easily be faked: our post on why business emails land in spam explains SPF, DKIM and DMARC.

Questions and complaints. Publish the contact details of a person who can answer questions about personal data (section 8(9)), and give people an easy way to raise a grievance. PIB's summary says requests should be answered within a maximum of 90 days.

Children. Anyone under 18 counts as a child. You need verifiable consent from a parent or lawful guardian before using a child's data, and you may not track children, monitor their behaviour or target ads at them (section 9). PIB names some exempt classes, such as healthcare and education, so ask your lawyer whether one fits you.

The stakes are high. The Schedule to the Act allows penalties of up to ₹250 crore for failing to take reasonable security safeguards, and up to ₹200 crore each for not reporting a breach and for breaking the duties on children.

What to do this month

1. List what you collect, where you keep it and who else gets it.
2. Remove form fields you do not use.
3. Write a plain notice for your privacy page, in the languages your customers read.
4. Add an unticked consent box to each form, with marketing as a separate box.
5. Keep analytics and ad tags off until visitors accept, and test the result.
6. Name the person who answers questions about personal data, and publish their email.
7. Set a deletion period for each kind of data, and clear old enquiries.
8. Turn on 2-step verification and review who can open what.
9. Write a breach plan with the 72-hour timeline.
10. Check that your contracts with your host and software providers cover personal data.

Our DPDP Compliance Kit covers most of this list. Tick the personal data you collect, where you keep it and who else gets it, and it builds a checklist in which each item names its section of the Act or its rule, or says it is our suggestion. It also drafts a privacy notice and consent text you can edit, a cookie banner that keeps Google Analytics off until a visitor accepts, and a breach plan that works out the 72-hour deadline from the time you became aware. It runs in your browser, and your answers stay there. It cannot tell you how the law applies to your business, so have a lawyer check the texts before you publish them.

Your next step

Open the DPDP Compliance Kit, press "Try an example" to see the dental clinic above, then answer the questions for your own business. If you would like help putting the banner and forms on your website, get in touch. More free tools for your website are on our free tools page.