DPDP Act: a plain-language checklist for business websites

This is a general guide, not legal advice. Check your specific situation with a lawyer.

The short version: If your website collects names, phone numbers or emails, or uses tracking and ad pixels, India's Digital Personal Data Protection Act applies to how you handle that data. The rules are being phased in, so it is sensible to get ready now.

Where things stand

The DPDP Act was passed in August 2023. The government notified the DPDP Rules on 13 November 2025 and set three sets of enforcement dates: 14 November 2025, 14 November 2026 and 14 May 2027. As we understand it, most day-to-day obligations for businesses, such as notice, consent and security safeguards, are expected to apply from the last of those dates. That leaves time to prepare, but not much.

The checklist

1. Map the personal data you collect

List every place: enquiry forms, WhatsApp chats, newsletter sign-ups, analytics, ad pixels and your CRM.

2. Give a clear notice where you collect data

Say what you collect, why, how a person can withdraw consent or ask for deletion, and how to complain. Put it next to the form, not buried in a footer.

3. Ask for consent properly

Consent should be clear and specific, not bundled with unrelated purposes. Keep a record of when and how people agreed.

4. Collect only what you need

If you do not need a field to provide the service, remove it.

5. Set retention and deletion rules

Decide how long you keep enquiry data, and delete it when it is no longer needed. Make it easy for people to ask you to delete their data.

6. Check your tools and vendors

Form tools, CRMs, email platforms and ad platforms handle data on your behalf. Know who they are, what they receive and how it is protected.

7. Take extra care with children's data

The Act treats anyone under 18 as a child. It requires verifiable consent from a parent or guardian before processing a child's data, and it prohibits tracking, behavioural monitoring and targeted advertising directed at children. The Rules provide limited exemptions for certain organisations, such as some educational institutions and healthcare providers, only for defined purposes. Schools and colleges should review their admissions forms and ad targeting with particular care.

8. Protect the data and plan for a breach

Use sensible security: access controls, strong passwords and limited access. Know whom you would tell, and how, if something went wrong.

9. Name a contact for questions and complaints

Publish an email address people can use, and respond to it.

What this means for marketing

Tracking, retargeting and lead forms all touch personal data. The practical steps are a clear consent notice, tracking that matches what you tell people, and no behavioural tracking or targeted ads aimed at children.

Where to start

If you want your forms, tracking and consent set up in a way that fits these rules, Request a Growth Audit and we will send a short video showing where your budget is leaking and what to fix first.

Related: Service businesses · Our privacy policy

Written by the MIMIC Digital team. General information, not legal or financial advice.