Why this matters for a website or app
Almost every business site collects personal data: contact forms, newsletter sign-ups, checkout details, login accounts, analytics. Under the DPDP framework, the business deciding why that data is collected carries the responsibility, even if a vendor stores it on its behalf.
A practical checklist
- Clear notice. Tell people, in simple language and separately from your terms, what you collect, why, and how to withdraw consent or complain
- Real consent. No pre-ticked boxes. Consent should be specific, and withdrawing it should be as easy as giving it
- Collect only what you need. Review every form field and ask whether you truly use it
- Security safeguards. Encryption, access controls, activity logs and backups, including for vendors that handle data for you
- Breach response. A written plan for who is told, and how quickly, if data is exposed
- Retention and deletion. Delete data once its purpose is complete, and keep logs for the period the rules require
- Children’s data. Verifiable parental consent before collecting data from minors
- A contact point. Publish a clear way for people to raise requests and complaints
A sensible timeline
- Now: map what data you collect, where it is stored and which vendors touch it
- Next few months: rewrite notices and consent screens, and fix forms that over-collect
- Before May 2027: test deletion, access and breach processes end to end
Starting early means you can make these changes as part of normal releases rather than in a last-minute rush.
Please note
This article is a general overview, not legal advice. Check your specific obligations with a qualified legal professional.
Key takeaways
- Most DPDP obligations apply from around May 2027
- Notices, consent and deletion all need changes in your actual website and app
- Audit your data and vendors first, then fix forms and flows
- Start now and spread the work across normal releases
DPDPCompliancePrivacyIndia
