India finally has a working data protection law. The Digital Personal Data Protection Act was passed in 2023, but it only became real for businesses when the DPDP Rules, 2025 were notified in November 2025. The government gave most obligations an 18-month runway, which puts the main compliance date in May 2027. The consent-manager registration provisions start earlier, one year after notification.
That sounds far away. It is not. If your website has a contact form, your app has a sign-up screen, or your CRM stores customer phone numbers, you are a data fiduciary under this law, and the changes touch code, copy, process and vendors. This guide explains what actually has to change and in what order.
Who the DPDP Act applies to
Anyone who decides why and how personal data is processed. For a typical Kerala business that means:
- Your website's enquiry, quote and newsletter forms
- Your mobile app's registration, profile and location features
- Your ERP, CRM, billing, HR and matrimonial or membership databases
- WhatsApp Business lists, email marketing lists and lead sheets
Size does not exempt you. The Act applies to a three-person clinic as much as to a bank, though the heavier "significant data fiduciary" duties apply only to organisations the government notifies.
The seven things that have to change
1. A plain-language notice at the point of collection
Before or at the moment you collect personal data, you must tell the person what data you take, why, and how they can withdraw consent, complain, and exercise their rights. The Rules require this in clear, standalone language, not buried in a privacy policy link. In practice: every form needs a short notice above the submit button, and the full privacy policy needs rewriting around the purposes you actually process for.
2. Consent that is specific, informed and separate
Pre-ticked boxes, bundled consents ("by submitting you agree to receive marketing") and consent hidden in terms and conditions will not hold up. Each purpose needs its own affirmative action. A quote request and a marketing subscription are two consents, not one.
3. Withdrawal as easy as giving consent
The Rules say withdrawing consent must be comparable in ease to giving it. If someone subscribed with one click, they must be able to unsubscribe with one click. For apps this means a self-serve data and consent screen, not an email to support.
4. Verifiable parental consent for children
Processing data of anyone under 18 requires verifiable parental consent, and behavioural tracking or targeted advertising to children is prohibited. Schools, coaching centres, ed-tech apps and gaming sites are most exposed. If your school ERP or learning app stores student records, this is your biggest workstream.
5. Breach notification
Every personal data breach has to be reported to the Data Protection Board and to each affected person, with the Rules setting a 72-hour window for the detailed report. You need a logging and alerting setup that can actually detect a breach, and a written procedure for who does what in the first day.
6. Retention and erasure
Data has to go when its purpose is served. The Rules set specific retention triggers for large platforms and expect everyone else to define and enforce their own. Your databases need a deletion policy and a job that runs it, and your backups need to honour it.
7. Vendor and processor contracts
Your hosting provider, email tool, SMS gateway, analytics platform and the agency that built your app are data processors. You remain responsible for what they do with your customers' data. Contracts need DPDP clauses, and you need a register of who holds what.
What this means for your website in code
- Forms: purpose notice, separate consent checkboxes, timestamped consent records stored with the submission
- Cookies and analytics: a consent banner that blocks non-essential scripts until accepted, with a withdrawal control that is always reachable
- Accounts: a self-serve page to view, correct, export and delete personal data — app stores already demand the deletion part
- Logging: access logs, admin-action logs and alerting that can prove when a breach started
- Retention: scheduled jobs that purge leads, applicants and inactive accounts on the schedule your policy states
Most Laravel and Flutter applications we see need two to four weeks of engineering to get here. Legacy WordPress sites with a dozen plugins each setting their own cookies are harder, which is one more reason to consolidate onto a platform you control. Our web development team builds these controls into every new site and retrofits them on existing ones.
The penalties
The Act allows penalties up to ₹250 crore per instance for failing to take reasonable security safeguards, and up to ₹200 crore for breach-notification failures. For a small business the practical risk is lower, but customers, enterprise clients and app stores will increasingly ask for DPDP compliance as a condition of doing business.
A realistic timeline
- Now to December 2026: map the personal data you hold, rewrite the privacy policy, fix forms and consent flows
- January to March 2027: build account self-service and deletion, set up breach detection and the response procedure, update vendor contracts
- April 2027: test everything, train staff, document it
- May 2027: the main obligations apply
Frequently asked questions
Does the DPDP Act apply to a small business with only a contact form?
Yes. A name, phone number and email collected through a form is personal data, and the business deciding to collect it is a data fiduciary. The obligations scale with risk, but notice, consent and reasonable security apply to everyone.
Do I need a cookie banner in India now?
If you set non-essential cookies such as analytics or advertising pixels, you need informed consent before they fire, and a way to withdraw it. A notice-only banner that just says "we use cookies" does not satisfy the Rules.
Is a privacy policy page enough?
No. The policy is still required, but the law also needs a short notice at the point of collection and a working withdrawal mechanism. A policy nobody reads cannot deliver either.
If you want a DPDP readiness review of your website, app or ERP, talk to our team. We will tell you what has to change and what does not.
