India's DPDP Rules 2025: a practical checklist for small websites

India's DPDP Act covers digital personal data processing in India, including data collected offline and then digitised. It also covers processing outside India connected with offering goods or services to people in India. Statutory exclusions and notified exemptions can affect the result; merely being a small website does not settle applicability. Start by mapping what you collect, where you process it and why, then check the Act and the applicable commencement notifications before deciding which duties apply.

Here is the kind of site this guide has in mind (a made-up example). A home bakery in Pune runs a WordPress site with a contact form, a newsletter box with 400 subscribers, and a small WooCommerce shop. Nobody there thinks of themselves as a "data company". Yet every enquiry, every subscriber and every delivery address is personal data, and the law has a name for the bakery: a Data Fiduciary.

This is general information, not legal advice. Use the checklist to prepare an inventory, document decisions and identify questions for a qualified adviser. The work required depends on your processing, vendors and risks; completing this article does not certify compliance.

What the DPDP law actually is

The Digital Personal Data Protection Act, 2023 is India's main privacy law for digital personal data. The DPDP Rules, 2025 fill in the practical details. The Rules notification, G.S.R. 846(E), is dated 13 November 2025; its e-Gazette identifier bears 14 November 2025. The commencement clauses use publication in the Official Gazette, so do not substitute a press-release or notification date when calculating a binding deadline.

Three definitions from the Act are worth knowing:

• Data Fiduciary: anyone who, alone or with others, decides the purpose and means of processing personal data. If you decide what your contact form collects and why, that is you.
• Data Principal: the person the data is about. For a child, it includes the parent or lawful guardian.
• Child: someone who has not completed 18 years of age. That is older than many people expect.

Think of it like being handed someone's house keys. You may use them for the reason they were given, you must keep them safe, you must say so if they are lost, and you should give them back when the job is done. Most of the law is a detailed version of that.

When do the duties start?

The Rules come into force in three stages, set out in Rule 1:

• On publication in the Official Gazette: Rules 1, 2 and 17 to 21, which cover definitions and how the Data Protection Board works.
• One year after publication: Rule 4, which covers registered Consent Managers.
• Eighteen months after publication: Rules 3, 5 to 16, 22 and 23. These include notices (Rule 3), security safeguards (Rule 6), breach reporting (Rule 7), contact details (Rule 9), children's data (Rule 10) and complaints (Rule 14). Use the operative publication date and any later official clarification when calculating the calendar deadline.

Timing check: read Rule 1 together with the Act’s commencement notification, G.S.R. 843(E), and the December 2025 corrigendum, G.S.R. 892(E). The substantive processing provisions also phase in; do not treat every requirement as already operative. Confirm publication-based deadlines and any later notification with your adviser before relying on them.

Preparation can involve form changes, processor contracts, access controls, retention decisions and incident procedures. Assign owners and check the current legal timetable; the amount of work depends on your actual systems and cannot be reduced to a promised number of hours.

Before you start

You need very little:

• Admin access to your website, its form plugin, your newsletter tool and your shop.
• A list of every place data enters your business: website forms, WhatsApp, phone calls, spreadsheets, email inboxes, your invoicing tool.
• Set aside time for an initial inventory, then assign owners to unresolved legal, vendor and technical questions. The first pass is not a completed compliance assessment; the effort depends on your systems and data flows.
• Someone to be the contact person. For a small business this is usually the owner.

Step 1: Make a simple data inventory

You cannot protect data you have forgotten about. Open a spreadsheet or a notebook and write one line for each type of personal data you hold, answering five questions:

• What data? For example: name, email, phone, delivery address, order history.
• Where does it come from? Contact form, newsletter signup, checkout, WhatsApp.
• Why do you need it? Reply to an enquiry, send the newsletter, deliver an order.
• Where is it stored, and who can see it? WordPress database, newsletter platform, Google Sheet, staff phones.
• How long is it retained, for what documented reason, and in which copies or backups? Record unknown periods as unresolved, not as an invented deletion deadline. Check statutory retention, business purpose and erasure requirements together.

A fictional inventory row might read: “Name, email and enquiry message; collected by the contact form; used to reply; copied to WordPress and a shared inbox; accessible to the owner and one staff member; retention period awaiting legal and operational review.” Resolve that final field before promising a deletion date.

Quick tip: while you are there, delete fields you do not need. If the contact form asks for a phone number you never call, remove the field. Data you never collect can never leak, and it shortens your notice.

Step 2: Write a clear notice for each form

From the 18-month date, Rule 3 says your notice must be understandable on its own, in clear and plain language, and must include at minimum an itemised description of the personal data and the specific purpose, plus how the person can withdraw consent, exercise their rights, and complain to the Data Protection Board.

A short notice beside the form can link to complete, standalone information. Treat the example below as a drafting aid, not a ready-to-publish legal notice. Replace every placeholder and have the responsible person check the purpose, retention and working rights/complaint routes against the applicable requirements:

DRAFT — adapt and review before use.
We collect your name, email address and enquiry message to reply to your enquiry.
Retention: [state the verified retention rule, including applicable legal exceptions].
To withdraw consent or exercise applicable data rights: [working link and contact details].
To raise a privacy grievance: [working route and published response period].
Complaints to the Data Protection Board: [current official route and applicable process].

Write a separate short notice for each purpose. Your newsletter notice talks about newsletters, your checkout notice talks about delivering orders. One long policy that covers everything at once is harder to understand, and the PIB summary of the Rules stresses a separate, clear notice for the specific purpose.

Step 3: Capture consent properly on your forms

The Act permits processing on consent or on certain legitimate uses specified in the Act. Identify and document the applicable ground for each purpose. Where you rely on consent, obtain a clear affirmative action rather than a pre-ticked box or wording hidden in terms; an unticked checkbox is one practical form design.

If your site uses the Contact Form 7 plugin for WordPress, its documented acceptance checkbox does exactly this. The checkbox is unticked by default and, unless you mark it optional, the form will not submit until the person ticks it. Add a line like this to the form template:

[acceptance your-consent] I agree that you may use my name, email address and enquiry message to reply to this enquiry, as described in the notice above. [/acceptance]

Most other form plugins have an equivalent consent or agreement field. Whatever you use, keep the wording specific to that form's purpose, and do not bundle newsletter signup into a contact form tick box. If you want both, give each its own checkbox.

Step 4: Put security in place (Rule 6)

Section 8(5) of the Act requires "reasonable security safeguards to prevent personal data breach". Rule 6 lists what that includes at minimum, in plain words:

• Encryption, masking or similar protection of personal data. For a website, that starts with HTTPS everywhere. Our guide on forcing HTTPS the right way walks through it.
• Access control. Only people who need the data can see it. Give each person their own login, remove staff who have left, and turn on two-step login for WordPress admins, your hosting panel and your email.
• Plan logs and monitoring for detection, investigation and recovery. Rule 6(1)(e) addresses one-year retention of the relevant logs and personal data, subject to other law. Review it alongside Rule 8(3), rather than assuming that keeping one web-server log satisfies every retention obligation.
• Backups and continuity, so you can recover if data is damaged or lost. Keep automatic backups, store one copy away from the server, and test a restore.
• Identify which vendors act as processors on your behalf and which determine purposes independently; a payment provider is not necessarily only your processor. Review the actual contracts and applicable security terms, rather than treating a downloaded generic policy as proof that the arrangement is compliant.

Maintain WordPress, themes and plugins, remove unused components, protect administrator accounts and test recovery. These controls reduce common risks; they do not prove compliance or prevent every breach.

Step 5: Publish a contact person (Rule 9)

Rule 9 asks every Data Fiduciary to prominently publish, on its website or app, the business contact details of a person who can answer questions about how personal data is processed (or of its Data Protection Officer, if it has one). For a small business that can be one line in the footer and on the privacy page:

Privacy questions: Anjali Rao, Owner, privacy@example.com, +91 00000 00000

That example name and number are made up. Use a real person and an inbox someone actually reads.

Step 6: Plan how you will answer requests and complaints

Rule 14(3) concerns the published response period for grievances, capped at ninety days. Do not turn that into a universal deadline for every access, correction or erasure request. Establish a request-handling process, identity checks and the deadlines that apply to each request type, with qualified advice where needed.

Practical setup for a small site:

1. Use one inbox for privacy requests (the one in your notice).
2. Keep a simple log: date received, what was asked, what you did, date closed.
3. Know how to find one person's data in every system from Step 1: WordPress (users, form entries, orders), newsletter tool, spreadsheets.
4. Locate active copies, processors, exports and backups before deciding an erasure request. Apply the verified retention and legal-hold rules, document what must remain and why, and ensure recovered backups do not silently reintroduce data that should stay deleted. Do not delete everything merely because this checklist says to.

Step 7: Write your breach plan before you need it

Prepare the breach-response workflow now. When Rule 7 is operative and applicable, the following notification stages need to be addressed. Other existing legal or sectoral incident-reporting duties may already apply; do not wait for the DPDP phase-in to investigate an incident.

• Tell affected people without delay, in plain language: what happened, the likely consequences, what you are doing about it, what they can do to protect themselves, and who they can contact.
• Tell the Data Protection Board without delay, with a description of the breach, its nature, scope, timing, location and likely impact.
• Within 72 hours of becoming aware, give the Board fuller details: the facts, the cause, what you have done to reduce the risk, any findings about who caused it, and a report on the notices you sent to affected people. The Board may allow a longer period on a request made in writing.

Write a one-page plan today: who decides that a breach has happened, who calls your host and developer, where your contact list of customers lives, and a draft message to affected people that you can adapt in minutes.

Step 8: Handle children's data with care (Rule 10)

The Act defines a child as under eighteen. Where operative and applicable, the children’s-data provisions and Rule 10 require attention to verifiable parental consent and due diligence, subject to statutory and notified exemptions. Check the complete requirements with an adviser rather than assuming a parent checkbox is sufficient.

Minimise unnecessary children’s data. Obtaining information from a parent does not by itself remove duties relating to the child’s data. If the service genuinely needs it, obtain advice on the lawful design, verification, notices and applicable restrictions before collection.

Does the three-year deletion rule apply to me?

The three-year inactivity rule in Rule 8(1)–(2) and the Third Schedule concerns specified large-platform classes. Separately, Rule 8(3) addresses personal data, associated traffic data and logs of processing undertaken by a Data Fiduciary or its processor: a minimum year from processing for Seventh Schedule purposes, followed by erasure unless other law or a government notification requires further retention. Small size is not a blanket exclusion from this separate provision. This is a description of the rule, not an instruction to retain every website record indiscriminately; assess scope, commencement and other applicable law with an adviser.

What the penalties look like

The Act lists different maximum penalties: up to Rs 250 crore for security-safeguard failures; Rs 200 crore for breach-notification or children’s-data failures; and Rs 150 crore for specified Significant Data Fiduciary failures. Data Principal duty breaches have a separate Rs 10,000 cap, while other covered contraventions can reach Rs 50 crore. These are statutory ceilings, not forecasts or a ranking of legal importance; consult the applicable Schedule and facts.

The one message worth forwarding

Send this to your developer, host or business partner:

"Our site collects enquiry, newsletter and order data. Can we review the Act’s scope and commencement dates, identify the lawful ground for each use, prepare the appropriate notices and consent controls, and check access security, backups, retention, the privacy contact and the breach response plan?"

The takeaway: you do not need a legal department to start, only a list of your data, clear notices, decent security, a named contact and a written plan.