India's data privacy law is getting real. If you run a small business with a website, the DPDP Act affects you, even if you only have a contact form. The date that matters for most owners is not this Friday. It is about May 2027. This guide explains the DPDP Act for a small business website in plain words, and what to do now.
DPDP means Digital Personal Data Protection. It is the Indian law on how businesses collect, use and keep personal data, like names, phone numbers, emails and addresses.
What starts on 13 November 2026, and what does not
The government published the DPDP Rules in November 2025. It did not switch everything on at once. It set dates in steps.
About 13 November 2026: the rule for "consent managers" starts (Rule 4). A consent manager is a separate company, registered in India, that helps people give and take back consent in one place. If you are an ordinary business, this rule is not for you.
About 13 May 2027: the main duties start, 18 months after the Rules were published. This covers privacy notices, consent, security, data breaches, children's data and people's rights. This is the date to plan for.
The government also discussed shortening the 18 months, mainly for very large companies. I found no notice that this was made final. The official government release still says 18 months. Keep an eye on it.
Does the DPDP Act apply to a small business website?
Probably yes. The law applies when you collect personal data in digital form. A contact form, a booking form, an online order, a newsletter sign-up or a login all count.
In the law, you are a "Data Fiduciary". This only means: the business that decides why and how personal data is used. The customer is the "Data Principal".
I did not find a general exemption for small businesses in the Rules. The government has said the long timeline is there to give small businesses and startups time to prepare. So plan as if it applies to you.
What the law asks from your website
Here is what the Rules say, in simple terms.
1. A clear notice before you collect data
Each form needs a notice that is easy to understand. It must list what data you collect and why. It must explain how a person can take back consent, use their rights and complain to the Data Protection Board (Rule 3).
A long privacy policy at the bottom of the page is not enough on its own. The notice should be where the person gives the data.
2. Real consent
Consent must be clear and informed. Do not use a pre-ticked box. Do not hide consent inside "I agree to everything". A person must be able to say no, and to withdraw consent later.
3. Basic security
The Rules name some safeguards (Rule 6): encryption or masking of data, access controls, logging and monitoring to spot unauthorised access, backups, and keeping logs for one year. In simple words: strong passwords for your admin panel, only the right people can see customer data, the site is kept updated, and you keep records of who did what.
4. A plan for data breaches
If customer data leaks, you must tell each affected person quickly, in simple language. You must also tell the Data Protection Board.
5. Delete data you no longer need
Data should be erased when the reason for collecting it is over, unless another law says you must keep it (Rule 8). Old enquiry forms and old customer lists are a risk.
6. Extra care for children
If your site collects data of children, you need verifiable consent from a parent or guardian (Rule 10). There are exceptions for areas like healthcare, education and safety. Schools, coaching centres and kids' shops should look at this early.
7. People's rights and a contact person
Customers can ask to see, correct, update or delete their data. You must answer within a maximum of 90 days. You must also publish contact details of a person who can answer questions about their data.
Not sure what your website collects?
Tell us which forms, tools and plugins your website uses. We will tell you which changes it needs before the new rules start.
Tell us about your projectHow big are the fines under the DPDP Act?
The Act sets maximum fines, not fixed fines. The Data Protection Board decides case by case. The maximums are:
Up to ₹250 crore for failing to keep reasonable security safeguards.
Up to ₹200 crore for failing to report a data breach, or for failing on children's data duties.
Up to ₹50 crore for other breaches of the Act or Rules.
These are upper limits. A small shop will not usually face the top number. But a data leak with no notice and no safeguards is exactly the case the law is written for. Treat it as a real risk.
A simple DPDP checklist for your website
You do not need a big project. Start with this list.
Make a list of your data. Write down every form, tool and system that holds customer data: website forms, WhatsApp, email tool, payment gateway, CRM, spreadsheet.
Remove what you do not need. If a form asks for a date of birth and you never use it, delete the field.
Add a short notice near each form. Say what you collect, why, and how to withdraw consent.
Fix your consent boxes. No pre-ticked boxes. Keep a record of when and how each person agreed.
Check security. Update your website and plugins, use strong admin passwords, turn on two-step login, and keep backups. Remove old admin users.
Check your vendors. Hosting, email and payment tools also handle your customers' data. Ask them how they protect it and where it is stored.
Write a one-page breach plan. Who finds out first, who tells customers, who contacts the Board.
Name a contact person and publish an email address for privacy requests.
Set a deletion routine. For example, review and delete old enquiries every year.
If your website needs changes for these steps, such as consent boxes, a privacy notice page, or a way to delete user data, that is normal development work. See our website and app services for what we build and maintain.
What to do this week
Do not panic about 13 November. For most small businesses, nothing changes that day. Use the next six months well: finish steps 1 to 3 this month, and the rest by early 2027. Then you are not rushing in May.
This post is general information, not legal advice. For a big or sensitive business such as health, finance or education, ask a lawyer who knows Indian data law.
Does the DPDP Act apply to my small business website?
Probably yes, if your site collects personal data like names, phone numbers or emails through forms, orders or logins. We found no general exemption for small businesses in the Rules.
When do the DPDP rules start for my business?
The main duties start about 18 months after the Rules were published in November 2025, which is about 13 May 2027. Check the date again before it arrives, because the government can change it.
Do I need to become a consent manager?
No. Consent managers are separate companies registered in India that help people manage consent. An ordinary business only needs to follow its own duties.
Do I need a privacy policy on my website?
Yes, plan for one. The Rules ask for a clear notice that says what data you collect, why, and how people can use their rights. Put the notice near each form, not only in the footer.
What is the maximum fine under the DPDP Act?
Up to ₹250 crore for failing to keep reasonable security safeguards. The Board decides each case, so most small businesses will not see the top number, but a leak with no safeguards is a serious risk.
Do I need a Data Protection Officer?
Not every business. The extra duties, like a Data Protection Officer and independent audits, are for "Significant Data Fiduciaries", which are large or high-risk businesses chosen by the government. All businesses must still publish a contact person for privacy questions.
How long do I have to answer a customer who asks for their data?
A maximum of 90 days. Answer much faster if you can.
