India's DPDP Rules 2025:a practical checklist for small websites

If your website collects names, emails, phone numbers or orders from people in India, the Digital Personal Data Protection Act, 2023 and its Rules apply to you, whatever your size. Most of the practical duties start 18 months after the Rules were published in November 2025, which puts them around mid-May 2027, so a small site has time to prepare calmly: a clear notice on every form, less data, sensible security, a contact person on the site, and a written plan for a breach.

Here is the kind of site this guide has in mind (a made-up example). A home bakery in Pune runs a WordPress site with a contact form, a newsletter box with 400 subscribers, and a small WooCommerce shop. Nobody there thinks of themselves as a "data company". Yet every enquiry, every subscriber and every delivery address is personal data, and the law has a name for the bakery: a Data Fiduciary.

This is general information, not legal advice. By the end you will know what the law asks of a small website, when each part starts, and you will have a step-by-step plan, with examples, that you can finish in an afternoon or two.

What the DPDP law actually is

The Digital Personal Data Protection Act, 2023 is India's main privacy law for digital personal data. The DPDP Rules, 2025 fill in the practical details. The Rules were published in the Gazette of India on 13 November 2025 (G.S.R. 846(E)), and the Press Information Bureau announced the notification on 14 November 2025.

Three definitions from the Act are worth knowing:

• Data Fiduciary: anyone who, alone or with others, decides the purpose and means of processing personal data. If you decide what your contact form collects and why, that is you.
• Data Principal: the person the data is about. For a child, it includes the parent or lawful guardian.
• Child: someone who has not completed 18 years of age. That is older than many people expect.

Think of it like being handed someone's house keys. You may use them for the reason they were given, you must keep them safe, you must say so if they are lost, and you should give them back when the job is done. Most of the law is a detailed version of that.

When do the duties start?

The Rules come into force in three stages, set out in Rule 1:

• On publication (13 November 2025): Rules 1, 2 and 17 to 21, which cover definitions and how the Data Protection Board works.
• One year after publication: Rule 4, which covers registered Consent Managers.
• Eighteen months after publication: Rules 3, 5 to 16, 22 and 23. These include notices (Rule 3), security safeguards (Rule 6), breach reporting (Rule 7), contact details (Rule 9), children's data (Rule 10) and complaints (Rule 14). Eighteen months from 13 November 2025 is 13 May 2027.

At the time of writing (3 October 2026), we have not seen an official notification that changes these dates. Check the official text on the MeitY website before you rely on any date, because governments can amend schedules.

Why this matters: the deadline feels far away, but the work is mostly habits and paperwork. Doing it now costs a few hours. Doing it in a panic in May 2027 costs much more.

Before you start

You need very little:

• Admin access to your website, its form plugin, your newsletter tool and your shop.
• A list of every place data enters your business: website forms, WhatsApp, phone calls, spreadsheets, email inboxes, your invoicing tool.
• About two to four hours for the first pass, plus a reminder in your calendar to review it every few months.
• Someone to be the contact person. For a small business this is usually the owner.

Step 1: Make a simple data inventory

You cannot protect data you have forgotten about. Open a spreadsheet or a notebook and write one line for each type of personal data you hold, answering five questions:

• What data? For example: name, email, phone, delivery address, order history.
• Where does it come from? Contact form, newsletter signup, checkout, WhatsApp.
• Why do you need it? Reply to an enquiry, send the newsletter, deliver an order.
• Where is it stored, and who can see it? WordPress database, newsletter platform, Google Sheet, staff phones.
• How long do you keep it? Write a number, even if it is a guess today.

A made-up example line for the bakery: "Email and name, from the contact form, to reply to cake enquiries, stored in the WordPress database and the shared inbox, visible to the owner and one staff member, deleted after 12 months."

Quick tip: while you are there, delete fields you do not need. If the contact form asks for a phone number you never call, remove the field. Data you never collect can never leak, and it shortens your notice.

Step 2: Write a clear notice for each form

From the 18-month date, Rule 3 says your notice must be understandable on its own, in clear and plain language, and must include at minimum an itemised description of the personal data and the specific purpose, plus how the person can withdraw consent, exercise their rights, and complain to the Data Protection Board.

For a small site, the easiest pattern is a short notice right next to each form, with a link to a fuller privacy page. Here is an example notice for a contact form, which you can adapt:

We collect your name, email address and message only to reply to your enquiry.
We keep enquiries for 12 months and then delete them.
You can withdraw your consent, ask to see, correct or delete your data, or raise a concern by emailing privacy@example.com.
If you are not satisfied with our reply, you can complain to the Data Protection Board of India.

Write a separate short notice for each purpose. Your newsletter notice talks about newsletters, your checkout notice talks about delivering orders. One long policy that covers everything at once is harder to understand, and the PIB summary of the Rules stresses a separate, clear notice for the specific purpose.

Step 3: Capture consent properly on your forms

Where you rely on consent, ask for it with a clear action, such as ticking an empty checkbox, rather than a pre-ticked box or a line hidden in your terms.

If your site uses the Contact Form 7 plugin for WordPress, its documented acceptance checkbox does exactly this. The checkbox is unticked by default and, unless you mark it optional, the form will not submit until the person ticks it. Add a line like this to the form template:

[acceptance your-consent] I agree that you may use my name and email to reply to this enquiry, as described above. [/acceptance]

Most other form plugins have an equivalent consent or agreement field. Whatever you use, keep the wording specific to that form's purpose, and do not bundle newsletter signup into a contact form tick box. If you want both, give each its own checkbox.

Step 4: Put security in place (Rule 6)

Section 8(5) of the Act requires "reasonable security safeguards to prevent personal data breach". Rule 6 lists what that includes at minimum, in plain words:

• Encryption, masking or similar protection of personal data. For a website, that starts with HTTPS everywhere. Our guide on forcing HTTPS the right way walks through it.
• Access control. Only people who need the data can see it. Give each person their own login, remove staff who have left, and turn on two-step login for WordPress admins, your hosting panel and your email.
• Logs and monitoring that help you detect and investigate unauthorised access and stop it happening again. Rule 6 asks for these logs to be retained for a period of one year. Ask your host which server and access logs they keep and for how long, and check what your own security plugin records.
• Backups and continuity, so you can recover if data is damaged or lost. Keep automatic backups, store one copy away from the server, and test a restore.
• Contracts with your processors. Your host, newsletter platform and payment provider process data for you. Rule 6 expects appropriate security terms in those contracts, so keep a copy of each provider's terms and data processing agreement.

On top of that, keep WordPress core, themes and plugins updated, delete plugins you do not use, and use strong, unique passwords. These boring steps prevent most real-world website breaches.

Step 5: Publish a contact person (Rule 9)

Rule 9 asks every Data Fiduciary to prominently publish, on its website or app, the business contact details of a person who can answer questions about how personal data is processed (or of its Data Protection Officer, if it has one). For a small business that can be one line in the footer and on the privacy page:

Privacy questions: Anjali Rao, Owner, privacy@example.com, +91 00000 00000

That example name and number are made up. Use a real person and an inbox someone actually reads.

Step 6: Plan how you will answer requests and complaints

People can ask to access, correct, update or erase their data, and PIB's summary says these requests must be addressed within a maximum of ninety days. Rule 14 also expects you to resolve grievances within a reasonable period not exceeding ninety days, and to publish that period on your website or app.

Practical setup for a small site:

1. Use one inbox for privacy requests (the one in your notice).
2. Keep a simple log: date received, what was asked, what you did, date closed.
3. Know how to find one person's data in every system from Step 1: WordPress (users, form entries, orders), newsletter tool, spreadsheets.
4. When you delete, delete everywhere, including old exports sitting in your downloads folder.

Step 7: Write your breach plan before you need it

A breach can be as simple as a hacked admin account or a lost laptop with a customer spreadsheet. Rule 7 sets out what happens next:

• Tell affected people without delay, in plain language: what happened, the likely consequences, what you are doing about it, what they can do to protect themselves, and who they can contact.
• Tell the Data Protection Board without delay, with a description of the breach, its nature, scope, timing, location and likely impact.
• Within 72 hours of becoming aware, give the Board fuller details: the facts, the cause, what you have done to reduce the risk, any findings about who caused it, and a report on the notices you sent to affected people. The Board can allow more time in writing.

Write a one-page plan today: who decides that a breach has happened, who calls your host and developer, where your contact list of customers lives, and a draft message to affected people that you can adapt in minutes.

Step 8: Handle children's data with care (Rule 10)

Because the Act treats anyone under 18 as a child, a tuition centre, a school supplies shop or a gaming community may well collect children's data. Rule 10 requires verifiable consent from a parent or guardian before processing a child's personal data, and due diligence that the person giving it is an identifiable adult.

For most small sites, the simplest answer is to design forms so you do not collect children's data unless you truly need it. If you do need it, collect it from the parent, not the child, and get proper advice on how to verify that consent.

Does the three-year deletion rule apply to me?

Probably not. Rule 8's time-based deletion rule, including the 48-hour warning before deletion, applies to the classes of Data Fiduciaries listed in the Rules' Third Schedule, such as e-commerce and social media platforms with at least 2 crore registered users. A small shop is not in that list. You still should not keep data forever: Step 1 already gave each type of data a retention period, and deleting on schedule reduces your risk.

What the penalties look like

The Act sets maximum penalties, which the PIB summary lists as up to Rs 250 crore for failing to keep reasonable security safeguards, up to Rs 200 crore each for failing to notify a breach and for breaking the children's data rules, and up to Rs 50 crore for other violations. These are ceilings, not typical fines. What they tell you is which duties the government treats as most serious: security, breach reporting and children.

The one message worth forwarding

Send this to your developer, host or business partner:

"We collect contact form, newsletter and order data from people in India. Before the DPDP Rules' main duties start around May 2027, can we review together: a short notice and an unticked consent checkbox on each form, HTTPS and two-step login everywhere, tested off-site backups, how long server logs are kept, a privacy contact in the footer, and a one-page breach plan?"

The takeaway: you do not need a legal department to start, only a list of your data, clear notices, decent security, a named contact and a written plan.