Data Privacy Basics Every Indian Business Website Should Know

Most small business owners do not think of themselves as "data companies". But the moment your website has a contact form, an enquiry button or a WhatsApp chat widget, you are collecting personal data: names, phone numbers, email addresses and sometimes much more. Indian law expects you to handle that data responsibly.

This guide explains the basics in plain language. It is not legal advice, but it will help you ask the right questions.

Which laws apply?

Two sets of rules matter for most business websites in India:

• The Information Technology Act, 2000 and the SPDI Rules, 2011. These require "reasonable security practices", a published privacy policy and a grievance officer when you handle sensitive personal data.
• The Digital Personal Data Protection Act, 2023 (DPDP Act). This is India's comprehensive data protection law. Its rules are being brought into force in phases, and it applies to any business that processes digital personal data of people in India.

The five things your website should have

1. A clear privacy policy

Your privacy policy should say, in simple words, what data you collect, why, who you share it with, how long you keep it and how people can contact you about it. Copying another company's policy is risky; it may describe practices you do not follow.

2. Consent that means something

Under the DPDP Act, consent must be free, specific, informed and unambiguous. In practice, add a short consent line next to your form's submit button, such as "I agree that the company may contact me about this enquiry", with a link to your privacy policy. Do not pre-tick boxes and do not bundle unrelated purposes like marketing newsletters.

3. Only collect what you need

Ask yourself whether you really need date of birth, full address or company turnover in an enquiry form. Every extra field increases your responsibility and lowers the number of people who complete the form. Shorter forms are better for privacy and for conversions.

4. Basic security

• HTTPS on every page (a padlock in the browser).
• Admin panel protected with strong passwords and login-attempt limits.
• Regular backups stored separately from the website.
• Software, plugins and themes kept updated.
• Staff access removed when people leave.

5. A named contact for complaints

Publish a grievance officer or data contact with an email address and a promise to respond within a reasonable time. It builds trust and is expected under Indian law.

What about cookies and analytics?

Many websites load tracking scripts from third parties without telling visitors. A better approach is to use privacy-friendly, first-party analytics and show a simple cookie banner that lets visitors choose. If you use Google Analytics or advertising pixels, mention them in your cookie policy.

How long should you keep enquiry data?

Keep data only as long as you need it. An enquiry that never became a customer does not need to sit in your database forever. Decide on a period, for example 24 months, and delete or anonymise older records. Invoices and accounting records, on the other hand, must be kept for the periods required under tax and company law.

A quick self-check

1. Does every form have a consent line and a link to the privacy policy?
2. Is the whole website on HTTPS?
3. Do you know where your enquiry data is stored and who can see it?
4. Is there an email address people can write to about their data?
5. Would you be able to delete a person's data if they asked?

If you answered "no" or "not sure" to any of these, it is worth fixing now, before it becomes a problem.