India DPDP: Set Up WordPress Privacy Tools Before May 2027

If you run a WordPress site that collects names or emails from people in India, the main duties under India's Digital Personal Data Protection (DPDP) Rules are scheduled to start 18 months after the Rules were published, which law firm summaries put at 13 May 2027. You do not need to panic about 13 November 2026, because only the consent manager rules start on that date. You can use the time now to set up a clear privacy page in WordPress and to practise the built-in Export Personal Data and Erase Personal Data tools.

Here is the surprising part: the WordPress documentation for these tools dates from December 2018, yet it is easy to run a site for years without clicking them once. The first time you test them should not be the day a real person emails you asking for their data.

Heads up: this guide is general information, not legal advice. It shows you the WordPress side of the work and points you to the official text. It does not make your site compliant, and the WordPress documentation itself says these tools "are not a compliance process in and of itself".

By the end, you will have a published privacy page, a tested export, a tested erase, and a short list of the gaps WordPress cannot cover for you.

What DPDP and the WordPress privacy tools actually are

The DPDP Act, 2023 is India's law on personal data, and the DPDP Rules, 2025 explain how it works in practice. A "Data Fiduciary" is the person or business that decides why and how personal data is used. If you own the site, that is probably you. A "Data Principal" is the person the data is about, such as a customer or a commenter.

According to the PIB document on the Rules, every Data Fiduciary must issue a separate consent notice that is clear and easy to understand and states the specific purpose for collecting data. People can ask to access, correct, update or erase their data, and the same document says fiduciaries must respond within a maximum of ninety days.

WordPress gives you three tools that map onto parts of this. Settings > Privacy helps you create a privacy policy page. Tools > Export Personal Data builds a file of what WordPress holds about one person. Tools > Erase Personal Data deletes that person's data from the WordPress database.

The dates, without the panic

Many posts treat 13 November 2026 as the big deadline. It is not.

The official Gazette text of the DPDP Rules, 2025, published by MeitY and dated 13 November 2025, says in Rule 1 that Rules 1, 2 and 17 to 21 start on publication. It says "Rule 4 shall come into force one year after the date of publication", and "Rules 3, 5 to 16, 22 and 23 shall come into force eighteen months after the date of publication". The PIB document says the Government issued the Rules on 14 November 2025 and that they introduce "an eighteen-month period for phased compliance".

Rule 4 covers consent managers, which are registered companies that help people manage their permissions. Law firm Khaitan and Co dates the one-year step to 13 November 2026 and the 18-month step to 13 May 2027. An October 2026 analysis by The Privacy Labs says ordinary businesses get no new legal duties on 13 November 2026.

What about the rumour that the period will be cut to 12 months? Business Standard reported on 22 January 2026 that the government might shorten the timeline for certain provisions from 18 months to 12, citing unnamed sources. That is an unnotified proposal, not law. At the time of writing (27 October 2026), the tracker at dpdprules.org says no amending instrument had been found as of its 12 October 2026 review, and a Lok Sabha answer on 12 August 2026 still described an eighteen-month transition. Keep an eye on official notices, but plan around the 18-month date unless the Gazette changes.

Why this matters: the penalties are large. The PIB document lists fines under the Act of up to Rs 250 crore for failing to keep reasonable security safeguards, up to Rs 200 crore for failing to report a breach or for violations involving children's data, and up to Rs 50 crore for other violations. That alone is a good reason to start early.

Before you start

This is a low-risk job if you follow the order below. The only step that cannot be undone is the erase test, and you will run it on a test user.

• Administrator login to your WordPress dashboard. On a normal single site, Administrators have the privacy capabilities by default.
• Access to your hosting control panel, such as cPanel, for backups.
• A fresh full backup of files and database, made today.
• Two email inboxes you can read: yours, and one for a test user.
• A list of every plugin and outside service that touches visitor data: contact forms, newsletter, analytics, chat, payment, comments.
• About 60 to 90 minutes.
• Optional: WP-CLI (the WordPress command line tool) if your host provides SSH.

Quick tip: if you do not have a WordPress site yet and want a test copy to practise on, our guide to installing WordPress in cPanel with Softaculous gets you a throwaway site in a few minutes. Practising there is the safest option of all.

Part 1: Set up the privacy notice page

Step 1: Take a full backup

Make a backup with your host's backup tool or your usual plugin, and download a copy to your own computer.

Step 2: Open the Privacy settings screen

Go to Settings > Privacy in the WordPress dashboard. You will see a drop down box of existing pages and a Create New Page button.

If you already have a privacy page, choose it in the drop down box and click Use This Page. If you do not, click Create New Page. WordPress opens a template page titled Privacy Policy with suggested headings and help text.

What you should see afterwards: the editor opens the template page. The settings screen also has a link called "Check out our guide" with recommendations on what to include.

Step 3: Rewrite the starter text for India

Heads up: the WordPress documentation says the default prompts and headers "are based on the expectations of Europe's GDPR". GDPR is the European Union's data law, so rewrite the text for an Indian audience.

The official Rule 3 text says the notice must be "presented and be understandable independently of any other information". It must also "give, in clear and plain language, a fair account of the details necessary" for a person to give informed consent. So do not bury it inside your terms of service.

Rule 3 also asks for a link and other means through which a person can withdraw consent, "with the ease of doing so being comparable to that with which such consent was given". The same clause covers how they can exercise their rights and how they can complain to the Data Protection Board. The Khaitan summary adds that the notice should include an itemised description of the personal data collected and the specific purposes.

Here is a plain outline to adapt. It is a skeleton, not legal text, so replace every bracket with your real details.

Privacy notice for example.com

Who we are: [Business name], [city], India. Contact for privacy questions: privacy@example.com

What we collect, item by item:
- Name and email address, when you fill in the contact form
- Email address, when you join the newsletter
- Comment text, name and email, when you leave a comment
- [Order details, if you sell anything]

Why we collect each item:
- Contact form: to reply to your message
- Newsletter: to send the updates you asked for
- Comments: to show your comment and fight spam

Who else handles it: [newsletter provider], [analytics provider], [payment provider], our hosting provider

How to withdraw consent: [unsubscribe link in every email] or email privacy@example.com

Your rights: you can ask to access, correct, update or erase your data by emailing privacy@example.com. We will confirm your identity first.

How to complain: you can complain to the Data Protection Board of India.

Last updated: [date]

Why this matters: the tools only help if people know how to ask, and the "Your rights" line tells them where.

Step 4: Publish the page and link it from every page

Click Publish in the editor. Many themes then show a footer link automatically, using the WordPress function the_privacy_policy_link(). If yours does not, add the page to your footer menu by hand; the screen and its label depend on your theme.

Quick tip: your privacy page should load over HTTPS like the rest of the site. If it does not, fix that first with our guide to redirecting HTTP to HTTPS using .htaccess.

Part 2: Test the Export Personal Data tool

Made-up example: Priya runs a cooking class site from Pune. A past student asks, "What do you have about me?" Priya has never used the export tool, the confirmation email lands in spam, and a week passes. One calm test run avoids that.

Step 5: Create a test user

Go to the Users screen and add a new user with a low role such as Subscriber, using an email inbox you can open. Leave one test comment on a post while logged in as that user, so there is something to export.

Step 6: Send the export request

Go to Tools > Export Personal Data. Enter the test user's username or email address and click Send Request.

What you should see afterwards: the request appears in the table with the status Pending. The test inbox receives an email with a subject like [Your Site] Confirm Action: Extract Personal Data and a confirmation link.

Step 7: Confirm as the user, then email the data

Click the confirmation link in the test inbox, then refresh the dashboard. The status changes to Confirmed and an Email Data button appears under Next Steps.

Click Email Data. The test user gets an email with the subject [Your Site] Personal Data Export and a download link. The WordPress documentation says this link is available for only 48 hours.

Step 8: Open the file and read it

Download the .zip file from the email and open it. Inside is an index.html file you can open in any browser.

What you should see: sections such as About WordPress site, User Information, Comments and Media. Check that the test comment is there. Then note what is missing, such as newsletter sign ups or contact form entries. That missing list is your homework for Part 4.

When you are done, click Remove request to clear the row. The documentation notes there is no Trash for these requests.

Part 3: Test the Erase Personal Data tool

Heads up: the WordPress documentation says deleted data "is permanently removed from the database" and erasure requests "cannot be reversed after they have been confirmed". Run this only on your test user.

Step 9: Send the erase request

Go to Tools > Erase Personal Data. Enter the same test user's username or email address and click Send Request.

What you should see: a new row with the status Pending, and an email in the test inbox with a subject like [Your Site] Confirm Action: Erase Personal Data.

Step 10: Confirm, then erase

Click the confirmation link in the test inbox. Refresh the dashboard and the status shows Confirmed, with an Erase Personal Data button under Next Steps.

Click Erase Personal Data. There is no "are you sure" prompt: the documentation says clicking the button means erasing the data. The status changes to Completed, and you can click Remove request.

Step 11: Delete the account if needed

The erase tool does not delete registered users or their profile data. If the person wants their account gone too, delete it separately from the Users screen.

A hover link called Force Erase Personal Data skips the confirmation step. Use it with care, because you lose the proof that the real person asked.

Part 4: Cover the gaps WordPress cannot see

This is where most of the real work is.

Outside services

The export tool covers WordPress and participating plugins. The documentation says it likely does not include data collected by an analytics provider, newsletter service, ad affiliate partner or embedded media. For each outside service on your list, write down how to export and delete one person's data in its own dashboard.

Backups

The erase tool "does not remove the data from backups or archive files". If you restore an older backup, the documentation says your earlier erasure requests should be respected. Keep a simple private log of completed erasures, with the date and the email, so you can repeat them after a restore.

Consent

The WordPress documentation says WordPress.org does not yet have consent tools built and points you to plugins for that, so check what your own version offers. Check each form on your site: does it say what the data is for, and is it as easy to stop as it was to start? A newsletter with a one click unsubscribe is a good model.

Security

According to the Khaitan summary, the security rules include encryption, access controls, and monitoring and logging. On a WordPress site, the simple wins are HTTPS everywhere, strong unique passwords, fewer admin accounts and two-factor login. Our guide to two-factor authentication in cPanel, Plesk and DirectAdmin covers the hosting account side.

Breach plan

The PIB document says that after a breach, affected people must be told without delay, in plain language, what happened, the likely impact, the steps taken, and who to contact. The Khaitan summary says a detailed report to the Board is due within 72 hours of becoming aware. Write down now who you would call first: your host, your developer, and the person who would send the notice.

How to check it worked

1. Open your site in a private browser window and find the privacy link in the footer or menu. Expected: the link is visible on every page and opens your published notice.
2. Check the page responds over HTTPS. Expected: a 200 status line near the top of the output.
3. Look at Tools > Export Personal Data and Tools > Erase Personal Data. Expected: your test rows are either Completed or removed, with nothing stuck at Pending.
4. Run a new export for the test user and compare it with the first file. Expected: the personal data you erased no longer appears.
5. Optional, with WP-CLI: confirm WordPress knows which page is your privacy page. Expected: a page ID number that matches the page you published.

This command fetches only the headers of your privacy page, so you can see the status code without the full page.

curl -I https://example.com/privacy-policy/

This WP-CLI command prints the ID of the page WordPress has set as your privacy page, which is stored in the wp_page_for_privacy_policy option.

wp option get wp_page_for_privacy_policy

This WP-CLI command lists your Administrators, which helps you see who can run the export and erase tools on a single site.

wp user list --role=administrator --fields=display_name,user_email

Troubleshooting

The confirmation email never arrives

Symptom: the request sits at Pending and the test inbox is empty. Likely cause: your site's outgoing email is going to spam or not being sent at all. Fix: check the spam folder first, then resend by ticking the request, choosing Resend email from Bulk Actions and clicking Apply. If mail still fails, ask your host how WordPress email is sent on your plan.

The request shows Failed

Symptom: the status column says Failed. Likely cause: the user did not confirm. The erase documentation says an unconfirmed request becomes Failed and can be resent. Fix: use Resend email from Bulk Actions, and tell the person to look for the email.

The Export or Erase menu is missing

Symptom: you cannot see Tools > Export Personal Data or Tools > Erase Personal Data. Likely cause: your account lacks the export_others_personal_data or erase_others_personal_data capability. The Settings > Privacy menu needs manage_privacy_options. Fix: log in as an Administrator, or ask whoever manages roles on the site. On multisite networks the rules can differ, so ask your network admin.

The download link has expired

Symptom: the person says the export link does not work. Likely cause: the documentation says the link is available only 48 hours. Fix: start a fresh export request, or use the Download Personal Data hover link and send the file by a secure route you trust.

The export is missing newsletter or form data

Symptom: the index.html file shows comments but no newsletter or form entries. Likely cause: the plugin or outside service does not take part in the WordPress export system. Fix: export that data from the service itself and send it along with the WordPress file.

An erased person's data came back

Symptom: after a restore, the erased test user's comment is back. Likely cause: backups are not touched by the erase tool. Fix: repeat the erasure from your private log, as the documentation advises.

When to ask a lawyer, host or developer

Ask a lawyer who works on Indian data protection if you handle children's data or run a very large platform, because the Rules add extra duties there that this guide does not cover. Ask your host about mail delivery and backup retention. Ask a developer if a plugin stores personal data but does not take part in the WordPress export and erase system, because that data will be skipped silently.

The one message worth forwarding

Copy this and send it to whoever helps you run the site.

Hi, I am preparing our WordPress site for India's DPDP Rules. The main duties are scheduled 18 months after the Rules were published (law firm summaries say 13 May 2027). This is not legal advice, just prep. Can you help me with three things this month: (1) list every plugin and outside service that stores visitor data, and how to export and delete one person's data in each; (2) confirm our site emails are delivered, because the WordPress export and erase tools rely on confirmation emails; (3) tell me how long our backups are kept, since the erase tool does not clean backups. I have already published the privacy page under Settings > Privacy and tested Tools > Export Personal Data and Tools > Erase Personal Data on a test user.

The takeaway: publish a clear privacy page and rehearse one export and one erase today, so that a real request in 2027 is a ten minute task and not a scramble.