DPDP Act 2023: What Indian Websites Need to Do Right Now

What is the DPDP Act?

India's Digital Personal Data Protection (DPDP) Act 2023 is a law that protects how companies collect, store, and use personal data. If your website collects any customer information—names, emails, phone numbers, browsing behaviour—you are covered.

This law applies to most Indian websites and apps. It's not just for large tech companies; even small e-commerce stores and service websites need to comply.

What Counts as Personal Data?

Personal data is any information that identifies or could identify a real person. This includes:

• Name, email address, phone number, address
• Payment and banking details
• IP address and device ID
• Browsing history and cookies
• Social media profile links
• Any other unique identifier

Even anonymised data that can be linked back to a person counts. If you're unsure whether something is personal data, treat it as such.

The Consent Rule: Get Permission First

You cannot collect or use personal data without explicit, informed consent. This means:

• Tell the user exactly what data you're collecting and why
• Make consent easy to give and easy to withdraw
• Don't use sneaky pre-ticked boxes or dark patterns
• Keep proof that they consented

Consent must be specific. A blanket "I agree to everything" checkbox is not enough. If you collect email for newsletters and phone for support, ask for both separately.

Privacy Notice: Tell Them Upfront

Before you ask for data, provide a clear privacy notice. It should cover:

• What personal data you collect
• Why you collect it (purpose)
• How long you keep it
• Who has access to it
• Rights of the person (access, correction, deletion)
• How to contact you with questions

Write it in plain language. Avoid legal jargon. If someone on your team struggles to read it, rewrite it.

Practical Steps to Comply Today

1. Audit your data collection

List every form, pop-up, and tracking tool on your website. What data does each one collect? Write it down.

2. Draft a clear privacy policy

Use simple language. Explain your data practices. Display it prominently (not hidden in footer links).

3. Set up consent workflows

Add consent checkboxes or toggles before collecting data. Make withdrawal easy (don't hide an unsubscribe link).

4. Review third-party tools

If you use analytics, email marketing, or ad platforms, check their privacy policies. You're responsible for their handling too.

5. Document everything

Keep records of what you collect, when, and proof of consent. If someone requests their data, you need to respond in 30 days.

6. Train your team

Everyone handling data should know the basics: don't share unnecessarily, secure passwords, report breaches.

What Happens If You Don't Comply?

Violations can lead to notices to fix the problem, and in serious cases, penalties. More importantly, non-compliance erodes customer trust. A privacy-first website builds credibility.

A well-built website with privacy by design—consent built in from the start, clean data workflows, audit trails—saves you headaches later.

Next Steps

Start small. Review your forms. Write or update your privacy notice. Test your consent checkboxes. Get your team on the same page.

This is general information, not legal advice. For your specific situation, consult a data protection lawyer or compliance expert.

India's data protection law isn't meant to block business. It's meant to build trust. Do it right, and your customers will notice.

This article is general information, not legal advice. For your specific situation, please consult a qualified professional.