By PDS Team
The Digital Personal Data Protection Act, 2023 (DPDP Act 2023) is India’s law on how organisations collect and use people’s digital personal data. It became law in August 2023, but as of October 2024 the government has not yet notified the rules that will bring most of it into force. That gives business websites time to prepare: know what personal data your site collects, why, where it goes, and how people can exercise their rights.
This guide explains the main ideas in the Act in plain language and the practical website changes worth planning now. It is general information, not legal advice; please speak to a qualified lawyer about your business.
What is the DPDP Act 2023?
The DPDP Act is a central law that sets out how businesses and other organisations must handle digital personal data of individuals in India.
The Act received the President’s assent on 11 August 2023. It applies to personal data collected in digital form, or collected offline and later digitised. It also applies to processing outside India if it is connected with offering goods or services to people in India. Key terms in the Act include:
- Data Principal: the person the data is about, such as a customer or website visitor.
- Data Fiduciary: the business that decides why and how personal data is processed.
- Data Processor: a company that processes data on the fiduciary’s behalf, such as a hosting, email or CRM provider.
- Consent Manager: a registered entity through which people can give, manage and withdraw consent.
- Data Protection Board of India: the body that will handle complaints and impose penalties.
Is the DPDP Act in force yet?
Not fully. The Act has been notified, but most of its provisions will start only after the government publishes the rules and sets commencement dates.
The Act leaves many practical details to rules made by the central government, such as the format of notices, how consent managers work, and timelines for certain duties. As of October 2024, these rules have not been published. When they are, businesses may get a transition period. Watching for official updates from the Ministry of Electronics and Information Technology (MeitY) is the best way to stay current.
What does the DPDP Act mean for business websites?
Most websites collect personal data through forms, accounts, orders, chat tools and analytics, so most businesses will need to review how they handle it.
| Website feature | Personal data involved |
|---|---|
| Contact and enquiry forms | Name, phone, email, message |
| Online store checkout | Name, address, phone, order history |
| Newsletter sign-up | Email address, preferences |
| Customer accounts | Login details, profile, saved addresses |
| Chat and WhatsApp widgets | Phone numbers, conversation content |
| Analytics and advertising tags | Identifiers such as cookies and device information |
What does the Act say about consent and notice?
Where consent is the basis for processing, it must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and people must be given a notice explaining what data is collected and why.
- Notice: tell people what personal data you collect, the purpose, how they can exercise their rights and how to complain to the Board.
- Clear action: pre-ticked boxes and silence are unlikely to count as consent; an unticked checkbox the person chooses to tick is clearer.
- Limited to purpose: consent should cover only the data needed for the stated purpose.
- Easy withdrawal: withdrawing consent should be as easy as giving it.
- Language: the Act allows people to ask for the notice in English or in any language in the Eighth Schedule to the Constitution.
The Act also lists certain “legitimate uses” where processing can happen without consent, such as when a person voluntarily provides data for a specified purpose. How these apply to your business is a question for legal advice.
What rights do people have under the DPDP Act?
People can ask for information about their data, correction and erasure, grievance redressal and the ability to nominate someone to act for them.
- Right to access a summary of their personal data and how it is processed.
- Right to correction, completion, updating and erasure of their data.
- Right to grievance redressal by the business.
- Right to nominate another person to exercise their rights in case of death or incapacity.
Your website should make it clear how people can contact you about their data, for example through a named contact email in your privacy policy.
What other duties should businesses know about?
Businesses must protect personal data with reasonable security safeguards, report breaches, delete data when it is no longer needed and take extra care with children’s data.
- Security: take reasonable security safeguards to prevent personal data breaches. Our website security checklist covers the basics for business sites.
- Breach notification: inform the Data Protection Board and affected people in the event of a personal data breach, in the form the rules will set.
- Retention: erase data once the purpose is served and consent is withdrawn, unless the law requires you to keep it.
- Children: the Act defines a child as anyone under 18 and requires verifiable consent of a parent or lawful guardian before processing a child’s data. It also restricts tracking, behavioural monitoring and targeted advertising directed at children.
- Processors: use data processors under a valid contract.
The Act sets out financial penalties in its Schedule, going up to ₹250 crore for failing to take reasonable security safeguards to prevent a breach.
How can you prepare your website now?
Map the personal data your website collects, reduce what you do not need, update your privacy notice and forms, and choose service providers carefully.
- Make a data map: list every form, tool and tag on your site, what data each collects and where it is stored.
- Collect less: remove form fields you do not use. Fewer fields also improve enquiry rates.
- Update your privacy policy: explain in plain language what you collect, why, who you share it with and how to contact you.
- Review consent on forms: use clear, unticked checkboxes for marketing emails and messages, separate from enquiry submission.
- Check third-party tools: review analytics, chat, CRM and email providers and their data processing terms.
- Plan deletion: decide how long you keep enquiries and customer data, and remove old data you no longer need.
- Watch for the rules: follow MeitY announcements and take legal advice once the rules are published.
Our website development services can update forms, consent options and privacy pages. If you send marketing emails, our email marketing services use permission-based lists. For measuring visits without collecting more than you need, our GA4 guide explains a lean analytics set-up.
DPDP Act FAQs
When will the DPDP Act come into force?
The Act became law on 11 August 2023, but most provisions start only after the central government notifies the rules and commencement dates. As of October 2024, the rules have not been published. Follow announcements from the Ministry of Electronics and Information Technology for the official timeline.
Does the DPDP Act apply to small businesses?
The Act applies to processing of digital personal data generally, not only to large companies, so small businesses that collect customer details online are likely to be covered. The government can exempt certain classes of data fiduciaries, such as startups, from some provisions through notification. Check the final rules and take legal advice.
Do I need a cookie banner under the DPDP Act?
The Act does not specifically mention cookies. If cookies or tracking tags collect personal data and consent is your basis for processing, consent requirements may apply. The rules may add detail. Many businesses review their tracking tools now and use consent tools where appropriate, especially for advertising tags.
What happens if a business does not comply?
The Data Protection Board of India can inquire into breaches of the Act and impose financial penalties set out in the Schedule. The highest listed penalty is up to ₹250 crore for failing to take reasonable security safeguards to prevent a personal data breach. Other breaches carry separate maximum penalties.
Is a privacy policy mandatory for Indian websites?
Under the existing IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, bodies corporate handling such information are expected to publish a privacy policy. The DPDP Act adds notice requirements. In practice, any website collecting personal data should have a clear, accurate privacy policy.
Does the DPDP Act cover offline data?
It covers personal data collected in digital form, and data collected in non-digital form that is later digitised. Paper records that are never digitised fall outside its scope. For most businesses, customer data ends up in digital systems, such as spreadsheets, CRMs or email, so it is likely to be covered.
Need your website ready for India’s data protection law?
We help businesses in Noida, Delhi NCR and across India update forms, privacy pages and tracking set-ups. See our website development services or contact us. For legal interpretation, consult a qualified lawyer.
