Quick answer: Building a DPDP compliant website means auditing the personal data you collect, publishing an itemised, plain-language consent notice, fixing your cookie/consent banner so consent is free and specific, building working processes for user rights (access, correction, erasure, grievance redressal), appointing a Grievance Officer, securing stored data with reasonable safeguards, and having a 72-hour breach-response plan ready. Core obligations become fully enforceable on 13 May 2027, but the safer, cheaper path is getting your website ready now rather than under deadline pressure.
The Digital Personal Data Protection Act, 2023 (“DPDP Act”) is India’s first comprehensive digital privacy law, and it now applies to virtually every website that collects a name, email address, phone number, or payment detail from an Indian visitor. If your site has a contact form, a checkout page, a newsletter signup, live chat, or Google Analytics installed, this guide is for you — a practical playbook for turning any site into a DPDP compliant website in ten steps, backed by the Act, the Digital Personal Data Protection Rules, 2025 notified by the Ministry of Electronics and Information Technology (MeitY), and current implementation guidance.
Jump to a Section
- What Is the DPDP Act, 2023?
- DPDP Compliance Timeline: What’s Live Now vs What’s Coming
- Does the DPDP Act Apply to Your Website?
- Key DPDP Terms Every Website Owner Should Know
- 60-Second Self-Check: Is Your Website DPDP-Ready Today?
- The 10-Step DPDP Compliance Process
- DPDP Act Penalties for Non-Compliance
- 5 Common DPDP Mistakes Indian Websites Make
- WordPress Plugins: What They Can (and Can’t) Do
- DPDP Compliant Website Checklist
- Frequently Asked Questions
What Is the DPDP Act, 2023? (Quick Answer)
The DPDP Act is a consent-first law governing how businesses collect, store, use, and share the digital personal data of individuals in India. It received presidential assent on 11 August 2023, and its operational rulebook — the DPDP Rules, 2025 — was notified by MeitY on 13 November 2025, rolling out obligations in three phases that finish on 13 May 2027. The law is enforced by the newly constituted Data Protection Board of India, which investigates breaches and complaints and can impose financial penalties.
The Act applies to personal data collected in digital form, or collected offline and later digitised, whenever the data belongs to a person located in India — regardless of where your business is registered. A US or UK company selling to Indian customers online is just as covered as a business based in Mumbai.
DPDP Compliance Timeline: What’s Live Now vs What’s Coming
The Rules don’t switch on all at once. They roll out in three phases, and knowing which one you’re in changes what’s urgent right now:
| Phase | Effective Date | What Comes Into Force |
| Phase 1 | 13 Nov 2025 (already in force) | Rules 1, 2 & 17–21 — definitions, scope, and constitution of the Data Protection Board of India |
| Phase 2 | 13 Nov 2026 | Rule 4 — registration and obligations of Consent Managers |
| Phase 3 | 13 May 2027 (full enforcement) | Rules 3, 5–16, 22 & 23 — notices, consent, security safeguards, breach reporting, retention/erasure, children’s data, Significant Data Fiduciary duties, data principal rights, cross-border transfer, and penalties |
Full enforcement — including penalties — begins on 13 May 2027. Waiting until then to start is the single most common mistake we see. Consent flows, plain-language notices, and data-rights processes take real engineering and copywriting time; building them now, while there’s no deadline pressure, is far cheaper than retrofitting them in a rush.
Does the DPDP Act Apply to Your Website?
In practice, almost every commercial website in India falls within scope. You’re a “Data Fiduciary” under the Act the moment your site does any of the following:
- Collects names, emails, or phone numbers through a contact, enquiry, or lead-generation form
- Runs an e-commerce checkout or accepts payments online
- Offers user accounts, logins, or member dashboards
- Sends newsletters, WhatsApp updates, or SMS campaigns
- Uses analytics, retargeting pixels, or third-party cookies
- Hosts a live chat widget or a comments section
If any of these apply, responsibility for compliance sits with you, even if the actual build and hosting is handled by a website development partner. A compliant website has to be engineered for consent and data-rights handling from the ground up, not bolted on afterward as a pop-up.
Key DPDP Terms Every Website Owner Should Know
A handful of terms come up constantly during a compliance project. Here’s what they mean in plain language:
| Term | Plain-Language Meaning |
| Data Principal | The individual whose personal data is being collected — your website visitor, customer, subscriber, or job applicant. |
| Data Fiduciary | The entity that decides why and how personal data is processed. If it’s your website, that’s you or your business. |
| Data Processor | Any third party that processes data on your behalf — your hosting provider, email tool, CRM, or payment gateway. |
| Significant Data Fiduciary (SDF) | A category the government can notify for entities handling large volumes or sensitive categories of data; adds duties like a Data Protection Officer and independent audits. |
| Data Protection Officer (DPO) | An India-based person a Significant Data Fiduciary must appoint to represent it on data-protection matters and answer to the Board. |
| DPIA (Data Protection Impact Assessment) | A documented risk assessment Significant Data Fiduciaries must periodically carry out for their processing activities. |
| Consent Manager | A government-registered platform through which a Data Principal can give, manage, review, and withdraw consent across services. |
| Personal Data Breach | Any unauthorised processing, or accidental disclosure, loss, alteration, or destruction of personal data compromising its confidentiality, integrity, or availability. |
60-Second Self-Check: Is Your Website DPDP-Ready Today?
Before working through the full process, run your site through these eight questions:
| Question | Yes | No |
| Does every data-collecting form sit behind a clear, plain-language notice — not just a footer link? | ||
| Can a visitor reject non-essential cookies as easily as accepting them? | ||
| Do you have a named, published Grievance Officer? | ||
| If someone emails asking you to delete their data, does anyone actually see and act on it? | ||
| Do you know every third-party script or plugin on your site that touches personal data? | ||
| Is stored personal data encrypted, in both the live database and backups? | ||
| Do you have a written plan to notify the Data Protection Board within 72 hours of a breach? | ||
| Was your privacy notice written for GDPR and never adapted for India? |
Two or more “no”s (or a single “yes” on the last question) means real compliance gaps to close before 13 May 2027.
The 10-Step DPDP Compliance Process for Your Website
Step 1: Run a Personal-Data Audit (Data Mapping)
Before you touch a privacy notice or a cookie banner, list out exactly what personal data your website collects, where it flows (CRM, email tool, spreadsheet, payment gateway), why you collect it, and how long you retain it. This record — often called a Record of Processing Activities — is the foundation every other step depends on, because you can’t write an honest consent notice or honour a deletion request for data you haven’t mapped. Include data you collected before the Act existed: your existing newsletter list, CRM, or client database is covered too.
Step 2: Rewrite Your Privacy Notice to Rule 3 Standards
Under Rule 3, your privacy notice must stand on its own, itemise exactly what personal data is collected and why, and explain how to withdraw consent and file a grievance — vague “we may use your data to improve our services” language no longer holds up. Notices can be issued in English or any language listed in the Eighth Schedule of the Constitution (22 languages); English plus Hindi is a sensible practical minimum, with regional languages added if your audience needs them. For a live example of a notice structured this way, see Pixels Corp’s own privacy policy.
Easy to miss: if you were collecting personal data before your notice existed — an old client list, a legacy CRM — the Act expects you to notify those people too, as soon as reasonably practicable, not just new visitors going forward.
Step 3: Fix Your Consent and Cookie Banner
Most WordPress and Shopify sites in India still use cookie banners built for the old “implied consent” era. Consent must be free, specific, informed, unconditional, and unambiguous, with a clear affirmative action — which rules out pre-ticked boxes, bundled “accept everything”-only buttons, and banners with no real reject option. Practical fixes:
- Separate “Accept All,” “Reject Non-Essential,” and “Manage Preferences” into equally visible choices
- Group cookies by purpose (essential, analytics, marketing) and let visitors consent per category
- Make withdrawing consent as easy as giving it — a persistent “Cookie Settings” link, not a buried setting
- Log the timestamp, notice version, and choice made, for every visitor
Step 4: Build Workflows for Data Principal Rights
Visitors have enforceable rights to access a summary of their data, correct inaccuracies, have data erased once its purpose is served, and register a grievance. Most current guidance points to a 90-day outer ceiling for resolving such requests — but the safer, more trust-building practice is responding much sooner, and stating a clear turnaround time in your notice. Your site needs a working, monitored channel (a dedicated email address or web form) to receive and action these requests, not just a line in the privacy policy claiming the right exists.
Step 5: Appoint a Grievance Officer (and a DPO if You Qualify as an SDF)
Every Data Fiduciary must name a contact person, published on the website, who handles data-related complaints. If your business is notified as a Significant Data Fiduciary — typically for high-volume or sensitive processing — you carry heavier duties on top of this: an India-based Data Protection Officer, periodic Data Protection Impact Assessments, and independent data-protection audits.
Step 6: Add Technical and Organisational Security Safeguards
Rule 6 requires “reasonable security safeguards” to prevent breaches. The Rules don’t prescribe one exact technical standard, but the operational expectation tracks familiar frameworks like ISO 27001. For most websites this means:
- Forcing HTTPS/TLS across the entire site, not just the checkout page
- Encrypting personal data at rest in your database and backups
- Applying role-based access control so only staff who need customer data can see it
- Keeping CMS, plugins, and server software patched, and logging admin access
- Setting data-retention limits so old leads and abandoned-cart records don’t sit unused indefinitely
Step 7: Prepare a Personal Data Breach Response Plan
Rule 7 sets a two-stage, unforgiving clock: send the Data Protection Board a brief initial intimation “without delay” the moment a breach is confirmed, then follow up with a detailed report — covering nature, extent, timing, and likely impact — within 72 hours. Affected Data Principals must be told in plain language at the earliest opportunity. The clock starts from the moment you become aware, not once your investigation is complete, and it runs through weekends and holidays. Have a written plan ready before you need it: who’s notified internally within hours, how affected users are contacted, and what evidence (logs, timestamps, scope of exposure) you’ll need on hand.
Step 8: Audit Your Data Processors and Third-Party Scripts
Every plugin, analytics tag, chat widget, and marketing pixel on your website is potentially a Data Processor acting on your behalf — and you remain accountable for how it handles the data your site hands over. Review vendor contracts for data-protection clauses, remove tools you no longer use, and avoid loading third-party scripts that fire before consent is given.
Step 9: Handle Children’s Data and Age-Related Claims Correctly
If your website’s audience could reasonably include minors — an ed-tech platform, a school, or a youth-focused brand — the Act requires verifiable parental consent and bars tracking, behavioural monitoring, or targeted advertising directed at children. Self-declared age gates alone are increasingly treated as insufficient evidence of compliance.
Step 10: Document Everything and Review Regularly
Keep dated records of your data audit, consent logs, notice versions, grievance-officer appointment, vendor contracts, and security measures. The DPDP Act runs on an accountability model — you need to be able to demonstrate compliance, not just claim it. Revisit the audit whenever you add a new form, tool, or integration to the site.
DPDP Act Penalties for Non-Compliance
Penalties are imposed by the Data Protection Board of India and scale with the severity and nature of the violation:
| Nature of Non-Compliance | Maximum Penalty |
| Failure to take reasonable security safeguards, leading to a breach | Up to ₹250 crore |
| Failure to notify the Data Protection Board and affected users of a breach | Up to ₹200 crore |
| Non-fulfilment of additional obligations for children’s data | Up to ₹200 crore |
| Non-fulfilment of additional Significant Data Fiduciary obligations | Up to ₹150 crore |
| Breach of any other obligation under the Act or Rules | Up to ₹50 crore |
| Non-compliance by a Data Principal (e.g., false grievances) | Up to ₹10,000 |
Figures are statutory maximums; the Board sets the actual amount case by case, based on factors like the nature and duration of the breach and the harm caused.
5 Common DPDP Mistakes Indian Websites Make
- Treating the cookie banner as decorative — keeping an “OK” button that doesn’t actually block analytics or ad scripts until consent is given.
- Copy-pasting a generic, GDPR-only privacy policy that never mentions the Data Protection Board, India-specific rights, or a grievance-redressal process.
- Having no working process behind the “contact us to delete your data” line — requests land in an inbox nobody checks.
- Forgetting that lead-gen landing pages and WhatsApp/SMS marketing tools sit inside the same compliance scope as the main website.
- Assuming a small business is too small to matter — the Act sets no revenue or size threshold for basic obligations like notice and consent.
WordPress Plugins: What They Can (and Can’t) Do
Off-the-shelf WordPress plugins can get you a cookie/consent banner and a basic data-request form running in an afternoon, and that’s a reasonable starting point. Where most plugins fall short is exactly where the penalty exposure is highest: an itemised, purpose-by-purpose notice tailored to your actual data flows, multi-language delivery, automatic retention and erasure schedules, and consent logs that are genuinely audit-ready rather than a generic export. Treat a plugin as day-one coverage, not the finished job — pair it with a real data audit and a consent architecture configured for how your specific site actually collects and uses data.
DPDP Compliant Website Checklist
- Personal-data audit / Record of Processing Activities completed
- Privacy notice rewritten to Rule 3 standards, in plain language, itemised by purpose
- Pre-existing data (old lists, legacy CRM) covered by a retrospective notice
- Cookie/consent banner offers a real, equally visible reject option
- Data Principal rights (access, correction, erasure, grievance) have a working process
- Grievance Officer named and published on the site
- HTTPS, encryption, and access controls in place
- 72-hour personal data breach response plan documented
- Third-party scripts and data processors reviewed and contracted
- Children’s data handled with verifiable parental consent where relevant
- Compliance records dated, stored, and reviewed on a schedule
Frequently Asked Questions
Is the DPDP Act already in force?
Yes, in phases. It received assent in August 2023; the DPDP Rules, 2025, notified on 13 November 2025, bring the Board and definitions into force immediately, Consent Manager registration from 13 November 2026, and the remaining core obligations — notice, consent, security, breach reporting, and penalties — from 13 May 2027.
How long do I have to report a data breach?
Under Rule 7, you must send the Data Protection Board a brief initial intimation without delay once a breach is confirmed, then a full report within 72 hours. Affected users must be told in plain language at the earliest opportunity. The clock starts the moment you become aware, not once your investigation is finished.
Does my privacy notice need to be in Hindi or other Indian languages?
Notices can be issued in English or any of the 22 languages listed in the Eighth Schedule of the Constitution. English plus Hindi is a sensible practical minimum for most businesses, with additional regional languages recommended if a meaningful share of your audience needs them.
Does DPDP compliance apply to small businesses and freelancers’ websites?
Yes. The Act sets no size or revenue exemption. Any website collecting personal data from individuals in India is covered, though the heavier duties — DPO appointment, DPIAs, independent audits — apply only to Significant Data Fiduciaries.
Do I need consent for cookies under the DPDP Act?
The Act doesn’t name cookies specifically, but where cookies identify or profile a visitor, current guidance treats them as personal data — which means a clear cookie notice, an explicit “Accept” action, and an easy opt-out are the safer, recommended approach.
What’s the maximum penalty for a DPDP violation?
Penalties scale by violation type and can reach up to ₹250 crore for failing to implement reasonable security safeguards that leads to a breach, as set out in the Schedule to the Act.
Who enforces the DPDP Act?
The Data Protection Board of India, established under the Act, investigates complaints and breaches and has the power to impose financial penalties.
How Pixels Corp Can Help You Get DPDP Compliant
Making a website DPDP compliant touches design, copy, and code all at once — the consent banner has to work technically, the privacy notice has to read in plain language, and the whole experience still has to convert. This is the same answer-first, well-structured approach we cover in our piece on Generative Engine Optimization for Indian businesses, and it’s what we apply to compliance pages: clear, well-organised, and built to be trusted by readers, search engines, and AI answer engines alike.
At Pixels Corp, our web development and SEO & content teams handle DPDP-ready builds end to end — consent-managed cookie banners, Rule 3-compliant privacy notices, data-rights workflows, and the on-page structure that keeps compliance pages both legally sound and search-friendly. Get in touch for a free website compliance audit.
Disclaimer: This article is for general informational purposes and does not constitute legal advice. For a compliance programme specific to your business, consult a qualified data-protection professional or legal counsel.
Sources: MeitY — Data Protection Framework; PIB — DPDP Rules, 2025 notification; Digital India — DPDP Act press note