DPDP Act: What Your Business Website Must Change
India's Digital Personal Data Protection Act changes how websites collect and use personal data. A practical checklist for business owners.
The Digital Personal Data Protection Act, 2023 (DPDP Act) is India's first comprehensive data protection law. It applies to any organisation that processes digital personal data of individuals in India, which includes almost every business website with a form. Its rules are being implemented in phases, giving businesses time to prepare. Preparing now is far easier than rushing later.
This article is general information, not legal advice. For your specific situation, consult a qualified lawyer.
Key ideas in plain language
- Data Principal: the person whose data it is, such as your website visitor or customer.
- Data Fiduciary: the business that decides why and how data is processed, which is you.
- Data Processor: a vendor that processes data on your behalf, such as your hosting, CRM or email provider.
- Consent: must be free, specific, informed, unconditional and unambiguous, with a clear affirmative action.
What to change on your website
1. Consent on every form
Add a consent statement and checkbox (not pre-ticked) explaining what you will do with the data, with a link to your privacy notice. If you want to send marketing messages, ask for that separately.
2. A clear privacy notice
Your notice should explain what data you collect, the purpose, how people can withdraw consent, how to exercise their rights and how to complain, including to the Data Protection Board of India.
3. Easy withdrawal of consent
Withdrawing consent should be as easy as giving it. Provide an email address and honour "STOP" replies on WhatsApp and SMS.
4. Collect only what you need
Data minimisation is good practice and reduces risk. Remove unnecessary form fields.
5. Retention and deletion
Do not keep personal data longer than needed for the purpose. Set retention periods for enquiries and delete or anonymise old data.
6. Security safeguards
Use HTTPS, strong admin passwords, access controls, regular updates and backups. Choose vendors who protect data properly and have written agreements with them.
7. Breach response plan
Know what you will do if data is exposed: contain it, assess it, and inform affected people and the Data Protection Board as required.
8. Children's data
If you process data of children under 18, such as schools and coaching institutes do, you need verifiable parental consent and must avoid tracking or targeted advertising directed at children.
9. A contact for data questions
Publish contact details of a person who can answer questions about data processing and handle grievances.
Cookies and tracking
Third-party tracking pixels and analytics can involve personal data. Use a cookie banner that lets visitors choose, load optional trackers only after consent, and consider privacy-friendly first-party analytics.
Penalties
The DPDP Act provides for significant financial penalties for failures such as not taking reasonable security safeguards or not notifying breaches. Small businesses are not exempt simply because they are small.
A practical action plan
- List every place your website collects personal data.
- Update forms with consent statements.
- Rewrite your privacy policy in plain language.
- Review vendors who handle your data.
- Set retention rules and a deletion process.
- Strengthen website and admin security.
SSPL's new websites include consent-ready forms, privacy-friendly analytics and policy pages drafted with the IT Act and the DPDP Act in mind. We can also audit your existing website.
