DPDP Act 2026: What Every Small Business Website in India Must Fix
If your website has a contact form, a newsletter signup, or even just a "name and phone number" field for a callback request, India's Digital Personal Data Protection Act now applies to your business — and there's no small business exemption anywhere in the law. The DPDP Rules, 2025 were notified in November 2025, the Data Protection Board of India is already operational, and every substantive obligation becomes fully enforceable by May 13, 2027. That deadline feels distant until you realize how much of it requires rebuilding things most small business websites never thought about — privacy notices, consent flows, and breach response procedures.
Who This Actually Applies To
The Act applies to any organization processing digital personal data in India, regardless of size — no turnover threshold, no headcount threshold, and no MSME exemption anywhere in the Act or Rules. It also applies to foreign entities processing the personal data of individuals in India in connection with offering them goods or services, even without a physical presence in the country. If your business collects a customer's name, email, or phone number digitally, through any channel, DPDP applies to you starting now, not at some future point when enforcement "really begins."
The Core Obligations Every Business Needs to Meet
- Valid, informed consent before collection. Consent is the primary legal basis for most personal data processing under the Act — a pre-ticked checkbox or buried assumption of consent won't hold up.
- A clear, plain-language privacy notice at the point of collection — not a dense legal document buried in the footer. The notice needs to actually explain what information is being requested and why, in terms a visitor can genuinely understand, rather than generic legal boilerplate.
- Honoring individual rights — access, correction, and erasure of personal data, along with a functioning grievance redressal process.
- Data retention limits. Personal data can only be stored for as long as the original purpose remains valid; once that purpose ends, the data must be deleted.
- Breach notification within 72 hours to both the Data Protection Board and affected individuals, in plain language explaining what happened, the likely impact, and what steps are being taken.
- Published contact details for a reachable person who can answer data-related questions — prominently displayed on your website and in every reply, under Rule 9. A small business doesn't need a formal Data Protection Officer (that's specifically a Significant Data Fiduciary obligation), but it does need someone who actually responds.
What This Means for Your Website Specifically
Compliance isn't just a legal document problem — it extends into the technology running your site:
- Every form that collects personal data needs a clear, specific consent mechanism and an accompanying plain-language notice, not a single generic privacy policy link assumed to cover everything.
- Security safeguards built into the underlying technology, not just the visible interface — encryption and appropriate data protection measures are explicit obligations under the Rules, not a best-practice suggestion.
- Cookies and tracking technologies aren't explicitly named in the Act, but where they involve collecting or processing personal data — which most analytics and marketing cookies do — DPDP's requirements apply to them regardless.
- A documented breach response procedure, identifying who does what if a breach actually occurs, given the tight 72-hour notification window.
- Verifiable parental or guardian consent wherever a business knowingly collects data from children — a notably stricter requirement than many businesses currently have in place.
Your Agency and Vendors Are "Data Processors" — And That Matters
If you work with a marketing agency, freelancer, or SaaS tool that touches customer data on your behalf, they're classified as Data Processors under the Act, while your business remains the Data Fiduciary responsible for how that data is ultimately handled. This is genuinely important for any business running email marketing (see our Email Marketing ROI guide) or using third-party tools for forms, chat, or analytics — you remain accountable for how your vendors handle data collected on your behalf, which makes vendor due diligence a genuine compliance requirement, not just a security nicety.
The Penalties Are Not Symbolic
This isn't a law with token fines designed to be ignored. Penalties scale with the severity of the violation:
- Up to ₹250 crore for failing to implement reasonable security safeguards.
- Up to ₹200 crore for failing to notify a breach, or for violations involving children's data.
- Up to ₹150 crore for Significant Data Fiduciary non-compliance specifically.
- Up to ₹50 crore as a residuary penalty for breach of any other provision of the Act or Rules.
Even at the lower end of this scale, these figures are structured to be genuinely consequential for a business of any size — this isn't a law where non-compliance is a reasonable financial gamble.
Key Dates to Actually Track
- November 2025 — DPDP Rules, 2025 notified; Data Protection Board of India operational.
- November 14, 2026 — the Consent Manager registration framework takes effect.
- May 13, 2027 — the hard deadline for full enforceability of every core obligation: notice, consent, breach reporting, data principal rights, and Significant Data Fiduciary duties.
May 2027 sounds distant, but rebuilding consent flows, privacy notices, and backend data handling across an entire website is genuinely not a last-month project — starting now gives you room to do it properly rather than rushing a compliance patch under deadline pressure.
A Practical Starting Checklist
- Audit every form and data-collection point on your website — contact forms, newsletter signups, checkout fields, chat widgets — and list exactly what personal data each one captures.
- Rewrite your privacy notice in plain language, specific to each collection point, rather than relying on a single generic policy page to cover everything.
- Add clear, specific consent mechanisms to every form — no pre-ticked boxes, no assumed consent.
- Publish a clearly visible contact point for data-related questions, per Rule 9's requirement.
- Review your vendor and agency relationships — confirm how each one handles the personal data they touch on your behalf, since you remain accountable as the Data Fiduciary.
- Draft a basic breach response procedure now, before the 72-hour notification window becomes something you're working out under actual pressure.
- Set a data retention review — know what you're storing, why, and for how long, and build in a process to actually delete data once its purpose ends.
5 Frequently Asked Questions About the DPDP Act
1. Does the DPDP Act really apply to small businesses and startups with no exemption?
Yes. There is no turnover threshold, no headcount threshold, and no MSME exemption anywhere in the Act or Rules. Any business collecting personal data digitally in India is covered, regardless of size.
2. Do I need to hire a Data Protection Officer for a small business?
No — a formal Data Protection Officer is specifically a Significant Data Fiduciary obligation under Section 10, which applies to larger-scale data processors. A small business does still need to publish contact details for a reachable person who can answer data-related questions, under Rule 9.
3. What's the actual deadline for full DPDP compliance?
May 13, 2027 is when all core obligations become fully enforceable — notice, consent, breach reporting, data principal rights, and Significant Data Fiduciary duties. The Consent Manager framework takes effect earlier, from November 14, 2026.
4. Does DPDP apply to cookies and website tracking tools?
The Act doesn't explicitly name cookies, but where cookies or similar tracking technologies collect or process personal data — which most analytics and marketing cookies do — DPDP's requirements apply regardless of the specific technology involved.
5. If I use a marketing agency or third-party tool, am I still responsible for DPDP compliance?
Yes. Your agency, freelancer, or SaaS vendor is classified as a Data Processor, but your business remains the Data Fiduciary — ultimately accountable for how personal data collected on your behalf is handled. Vendor due diligence is a genuine compliance requirement, not optional.
How RS Info Solutions Can Help
DPDP compliance touches both the legal side (privacy notices, consent language) and the technical side (how your website forms, cookies, and backend systems actually handle data) — and most small businesses are only thinking about one half of that equation. We audit your website's data collection points, rebuild consent flows and privacy notices in genuinely plain language, and make sure the technical safeguards required under the Rules are actually built into your site, not just promised in a policy document.
