DPDP Act 2023: A Website Compliance Checklist

The Digital Personal Data Protection Act, 2023 establishes how organisations in India must handle digital personal data. Websites are often the first point where personal data is collected, through enquiry forms, newsletters, accounts and analytics. This checklist helps you review your site. It is general guidance, not legal advice, and the detailed rules should be checked with your legal adviser.

Notice and consent

• Explain in clear language what personal data you collect, why, and how people can exercise their rights.
• Collect consent that is free, specific, informed and unambiguous, with a clear affirmative action.
• Avoid pre-ticked boxes and bundled consent for unrelated purposes.
• Make withdrawing consent as easy as giving it.

Purpose and minimisation

• Ask only for the data you need for the stated purpose.
• Remove optional form fields that you do not use.
• Do not reuse data for unrelated purposes without fresh consent.

Cookies and tracking

• Load non-essential analytics and advertising scripts only after consent.
• Offer a clear choice to accept or decline non-essential cookies.
• Document which tools receive visitor data.

Security and retention

• Use HTTPS throughout, strong admin authentication and regular updates.
• Limit who can access enquiry and customer data.
• Delete data when the purpose is fulfilled, with a defined retention period.
• Prepare a breach response process, including notification steps.

Rights and grievances

• Provide a contact for privacy requests and grievances.
• Have a process to respond to access, correction and erasure requests.

Vendors

Hosting providers, email platforms, CRMs and analytics tools process data on your behalf. Review their terms and security, and keep a register of who processes what.

Compliance is easiest when privacy is designed into the website from the start rather than added after launch.