A customer completes your enquiry form on a Tuesday evening. Name, phone number, a line about what they need. And where does that information go? If you can't say it in one breath, the DPDP rules for websites are immediately your problem.
India's Digital Personal Data Protection Rules came into force in late 2025 and will be implemented in stages over the following 18 months. Things don't suddenly change. However, penalties for significant violations can be as high as ₹250 crore, and just that figure worries company owners.
DPDP Rules for Websites: What Changes
Every website gathering personal data from a user in India is now required to deal with it responsibly. This includes contact forms, newsletter pop-ups, booking widgets, cookies (for example, for analytics), and WhatsApp chat buttons. The law makes a simple set of demands – ask, only gather what you need, and keep it safe – of every one of these small clinics in Madurai or every big ecommerce site in Mumbai.
Where Most Business Websites Fall Short
- Unclear consent. Just having a pre-selected box or a button that reads "by proceeding, you agree" is not enough to constitute clear, specific and informed consent.
- No escape route. Users should be free to withdraw their consent just as easily as they gave it.
- No margin for error. A registration form requesting address, date of birth and income just to book a call? No.
- Zeroflows security. Rules demand sensible protection, so an example would be an old plugin or a non-https website.
- Information about children. You require verifiable parental consent before you can process a child's data. This is relevant to schools, tuition centres and kids' brands.
A Practical Checklist to Get Ready
Begin with all your forms and trackers-you can't safeguard the information you're unaware that you're gathering. Then, rephrase your consent content in straightforward language and specify precisely why you're requesting each piece of information.
Add a clear, accessible privacy notice (and to make it even more accessible, in a regional language too if your customers require this). And then review your plugins, hosting and backups. If the vendor accessing your data is now part of your responsibility, it's a data breach waiting to happen. Our SEO services team can combine the cleanup with a technical audit to ensure privacy and performance are addressed in one shot.
If you employ chatbots or automation, discover the place messages from customers are being saved. That's all the time the place our AI advertising and marketing work begins.
The benefit of Choosing to Act Early
Most will delay until deadline day. The more shrewd approach would be to address the straightforward items now, as visitors are more likely to spend more time on sites that appear as if they're attentive to their details. You should read the instructions by visiting the official website of MeitY and consult a legal professional regarding your queries on this. This is a general guideline, not legal counsel.
Your website can get ahead of DPDP regulations without blowing your budget with this simple first step. Wondering where your website stands? Learn about us on the One Hub India home page, or get your website assessed with our free website check-up.
Frequently Asked Questions
Do DPDP rules apply to small business websites?
You bet. If you have a website even just with a newsletter box or a contact form.
At what point do the DPDP rules come into play?
Given the phased rollout of these rules, which will be around 18 months from late 2025, some provisions will apply earlier than others so best to get ready early.
How severe is the maximum penalty under DPDP?
Penalties can go up to ₹250 crore for serious violations, so even small businesses are avoiding lax practices until they are brought under a tighter range.
Is a cookie banner compliant enough?
No, the rules require consent to be explicit and given for a specific reason, along with a simple way for you to withdraw your consent. So a "by continuing you agree" banner on a website isn't quite enough.
Do I need an attorney to set up my company website?
The legal jargon may be checked by your lawyer, but you can also review forms, consent statements and the fundamentals of security, in collaboration with your web team, before passing them on for legal review.
