India's DPDP Rules: what a small business should fix on its website before May 2027.

If your website collects names, phone numbers or emails from people in India, India's Digital Personal Data Protection (DPDP) Rules will apply to you. Most of the duties start on 13 May 2027. The practical work is on your site: a clear consent notice on every form, a way to withdraw consent, safe storage, and a plan for a data breach. You have about six months of useful planning time left.

When do the DPDP Rules start applying?

The Rules were notified in November 2025 and roll out in three steps. Here is the commencement schedule as reported by SCC Online.

India Briefing also expects the government to move from a soft approach to active supervision around the end of 2026. Treat that as an expectation, not a fixed date. The firm dates are the ones in the Rules.

Does this apply to a small business?

The sources I read do not mention any general exemption for small businesses or startups. The Rules talk about Data Fiduciaries, meaning whoever decides why and how personal data is processed. If you run a contact form, a booking form, a newsletter or an online shop, that is you. Larger duties, such as an independent audit and an India-based Data Protection Officer, are for Significant Data Fiduciaries. The government notifies those. Indicative thresholds mentioned by India Briefing include 5 million users or very large turnover, so most small firms will not be in that group.

This is a practical summary, not legal advice. Penalties can reach ₹250 crore for failing to keep reasonable security safeguards and ₹200 crore for failing to report a breach. Ask a qualified lawyer how the Rules apply to your business.

What should be on every form on my website?

Rule 3 asks for a notice that is clear, independent and easy to reach. It must say which personal data you collect and why. It must also explain how to withdraw consent, use their rights and make a complaint.

• A short notice next to each form, in plain words, not buried in a 10-page policy.
• An unticked consent box for anything beyond the core purpose, such as marketing messages.
• The exact purpose: "to reply to your enquiry" is a purpose, "for business use" is not.
• A visible email or form for withdrawing consent and raising a complaint.
• A privacy page that matches what the forms say. The Fisher Phillips guide adds that notices should be available in English or the official Indian languages.

Check every place data enters: contact forms, WhatsApp click-to-chat buttons that log leads, popup newsletter forms, checkout pages and job application forms.

What security does a small website need?

Rule 6 lists the safeguards. You should be able to show each of these.

• Encryption, masking or tokenisation of personal data.
• Access controls, so only the people who need the data can open it.
• Logging and monitoring to spot unauthorised access.
• Backups so the service keeps running after an incident.
• Logs and the data they relate to kept for at least one year.
• Contracts with processors, such as hosting, CRM and email tools, that require the same safeguards.

For a small site this usually means HTTPS everywhere, strong admin passwords with two-step login, no leads sitting in a shared spreadsheet, and a hosting plan that keeps logs and backups. Plugin updates matter too, since an outdated plugin is a common way in.

What happens if there is a data breach?

You must tell the affected people promptly, with details and the steps they can take. You must also give the Data Protection Board an initial description, then a detailed report within 72 hours. That is hard to do if nobody knows who is in charge. Write a one-page plan now: who checks the logs, who calls the host, who writes to customers.

What about deleting data and children's data?

Personal data must be erased once its purpose is finished, unless the law requires you to keep it. Customers must get 48 hours' notice before erasure. The one-year log rule still applies. For children, you need verifiable parental consent before processing their data, with limited exemptions listed in the Rules. If your site serves under-18s, such as a tuition centre or a toy shop, get specific advice.

What should I do first?

Do these in order. Each is small, and together they cover most of a typical small-business site.

• List every form, tool and vendor that touches customer data.
• Write down the purpose for each piece of data you collect, and delete fields you do not need.
• Add a plain notice and consent wording to each form.
• Set up a way to withdraw consent and receive complaints.
• Tighten access, backups and logging, and update your plugins.
• Draft the breach plan and agree who owns it.
• Review processor contracts with your host and tool vendors.

Collecting less data is the cheapest fix. Every field you remove is one fewer thing to protect, explain and delete.

How we can help

I build and maintain small-business sites, and these changes sit naturally inside a web project: consent wording on forms, safer hosting, cleaner data flows. If leads move through spreadsheets and chat tools, workflow automation can route them to one protected place, and custom software fits when you need consent records and erasure requests tracked properly. If you are planning a new site, our guide on how to make a website for your business is a good start. To talk it through, get in touch.