What the DPDP Act means for your website

Most articles about the Digital Personal Data Protection Act are written for companies with a legal department. This one is written for a business in Thane with about nine pages, a contact form, and nobody whose job is compliance.

The short version: the law already applies to you, the enforcement machinery is being switched on in stages, and the work involved for a small site is genuinely small. It is a weekend, not a project.

What is actually happening, and when

The Act was passed in 2023. The Rules that make it operable have been notified with a phased timetable, which is why nothing appeared to happen for a long time and then everything started appearing at once.

Two dates matter.

13 November 2026 is when the Consent Manager framework under Rule 4 comes into force. 13 May 2027 is the date most people treat as hard enforcement, when the substantive obligations are fully live.

That leaves 2026 as the build and test year. Enforcement through this period is expected to look like guidance and warnings rather than penalties. If you fix your site this quarter you are early. If you fix it in April 2027 you are scrambling with everyone else and paying whatever the rate is by then.

About the 250 crore number

You will see it in every headline, so it is worth being straight about it.

The 250 crore rupee figure is a ceiling, and it attaches specifically to a failure to take reasonable security safeguards that results in a personal data breach. It is the number for a large company losing a large amount of customer data. The Board is required to weigh the nature, gravity and duration of the breach when it decides anything.

A dental clinic in Thane whose contact form has no privacy notice is not going to be fined 250 crore rupees. Anyone who tells you otherwise is selling something.

The realistic risk is duller and more likely. A customer, or a corporate client running vendor checks, asks what you do with the details people submit through your website. Under this law they are entitled to ask, and to have it deleted. If your answer is that you are not sure, you have lost the deal and you have not broken any law at all. That is the version of this that will actually happen to you.

The thing almost nobody can answer

Ask a business owner where their contact form sends its data and the answer is usually a shrug. It goes somewhere. An email arrives, most of the time.

This matters now, because the whole law is built on that question. Before you can write a privacy notice you have to know what is true. Here is how to find out on your own site in about ten minutes.

Fill in your own contact form with your own name and phone number, then follow it. Which inbox does it land in? Is that inbox on your own domain or on a free account somebody set up years ago? Does the form also post to a third party such as a form service or a plugin vendor? Does a copy sit in a database on your hosting that nobody has looked at since launch?

Then open your homepage and look at what else loads with it. Analytics, a chat widget, a Facebook pixel, an embedded map, a font from someone else’s server. Each of those sees your visitor’s IP address, and some set cookies. You do not have to remove them. You do have to know they are there, because you are the one answering for them.

The four things a small site actually needs

A privacy notice in plain language. What you collect, why you collect it, who else sees it, how long you keep it, and how someone asks you to delete it. Not a template full of clauses about jurisdictions you do not operate in. One useful detail: the Act lets a person read the notice in English or any language in the Eighth Schedule, which includes Marathi and Hindi. If your site is already trilingual, that requirement is already met, which is a small reward for having bothered.

Consent before non essential tracking. Analytics is not essential to delivering your website. Under the design most people now use, nothing is stored on the visitor’s device until they agree. Google’s Consent Mode handles this properly: with storage denied it still receives a cookieless signal, so your visitor counts survive and nobody is tracked without saying yes.

A way to change their mind. Withdrawing consent has to be as easy as giving it. In practice this means a visible link in the footer that reopens the choice, not an email address that nobody monitors.

A retention answer. How long do enquiries sit in your inbox? “Until I need them for the conversation and for GST records, then they go” is a perfectly good answer. Having no answer is the problem.

What you can ignore

Consent Manager registration is for organisations that want to offer consent management as a service to others. It is not a thing your bakery has to sign up for, and you will see this misread in a lot of marketing over the next year.

You are also almost certainly not a Significant Data Fiduciary. That designation comes with Data Protection Officers and audits, and it is aimed at scale you do not have.

What we did on our own site

We shipped this on mhatreinnovations.com before writing about it, which felt like the right order.

Everything starts denied. Analytics loads, but with all four consent signals set to denied, so the first page view sets no cookie and passes no identifier. The banner offers exactly two choices and neither is disguised. Accepting switches storage on; choosing essential only leaves it off and the visitor is still counted, cookielessly. There is a “Cookie choices” link in the footer of every page that reopens the decision, because the law asks that withdrawal be as easy as consent and a buried email address is not that. The privacy page says where an enquiry actually travels, which is our own AWS account in the Mumbai region and then our own inbox.

We verified it rather than assuming it. Before accepting: no cookies at all. After accepting: the analytics cookie appears. That distinction is the entire point, and it is worth checking on your own site rather than trusting the banner plugin’s marketing copy.

If your site is slow as well as non compliant, those two problems share a cause more often than you would expect, and it is usually the pile of third party scripts. That is covered in why your website is slow, in the order worth checking.

Where to start

Find out where your form data goes. Write the privacy notice from what you find, not from a template. Add a consent banner that tells the truth. Put a withdrawal link in the footer.

None of that requires a lawyer, though a lawyer is worth an hour of your time if you handle health records, children’s data or anything financial. If you would rather it was simply done, it is part of what we look after on the cloud, hosting and DevOps side, and it is a small job on a small site.

Do it while it is still early and cheap.