A customer asks how you store their details. Or a client’s legal team sends a questionnaire with a line about “DPDP compliance”. Or you read that India now has a data protection law and wonder whether your contact form and WhatsApp button are affected. For most small business websites, the honest answer is yes, in modest and manageable ways.
This post explains what India’s Digital Personal Data Protection Act, 2023 means for an ordinary business website: the main terms, what your site actually collects, and a practical checklist. It is general information, not legal advice. For decisions about your own business, speak to a lawyer who works in this area.
The Act in plain terms
The Digital Personal Data Protection Act, 2023, usually shortened to the DPDP Act, governs how digital personal data is handled. Personal data here means data about an individual who can be identified by it or in relation to it. A name and phone number on an enquiry form clearly counts.
The Act applies to digital personal data processed in India. It can also apply to processing outside India when it is connected with offering goods or services to people in India. So a business based abroad that sells to Indian customers should not assume it is out of scope.
The detail of how the Act works in practice is set out in rules made under it, and those rules bring different parts into effect in phases. We are not going to list dates here, because a blog post is the wrong place to rely on for them. Check the current position with your adviser or the official notifications.
Four words worth knowing
Data fiduciary. The person or organisation that decides why and how personal data is processed. If your business runs the website and decides what to do with enquiries, you are the data fiduciary for that data.
Data principal. The individual the data is about: your visitor, customer or subscriber. For a child, the term includes the parent or lawful guardian.
Data processor. Someone who processes data on your behalf. Your web developer, hosting company, email marketing service or CRM provider will often be in this position. Using them does not move your responsibility to them.
Data Protection Board of India. The body set up under the Act to deal with complaints and breaches.
Consent, notice and purpose
The core idea is simple. You should collect personal data for a clear purpose, tell people what that purpose is, and use the data for that purpose rather than anything you think of later.
Where you rely on consent, the Act expects it to be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the data needed for the stated purpose. A pre-ticked box or a line buried in the footer does not fit that description well. People must also be able to withdraw consent, and withdrawing should be about as easy as giving it.
Consent comes with a notice. In broad terms, the notice tells people what personal data you are collecting and why, how they can exercise their rights and withdraw consent, and how they can complain to the Board. The Act also gives people the option of reading the notice in English or in a language listed in the Eighth Schedule of the Constitution.
Consent is not the only basis. The Act also lists certain “legitimate uses”, including, broadly, situations where someone voluntarily gives you their data for a specific purpose. Whether a particular form on your site falls under that is exactly the sort of question to put to an adviser. How to set up consent on the forms themselves is covered in our companion post on consent on website forms.
What a typical business website collects
Most owners underestimate this. Walk through your own site and you will usually find several of these.
Forms
Contact forms, quote requests, booking forms, job applications and newsletter sign-ups. Many WordPress form plugins store every submission in the database as well as emailing it to you, so the data sits in two places.
Accounts and orders
A WooCommerce store keeps customer names, addresses, phone numbers, emails and order histories. This is usually the largest store of personal data on a small business site.
Analytics and advertising tags
Analytics tools and advertising pixels set cookies or similar identifiers and record how a device uses the site. On their own these may not name anyone, but once they can be linked to a person they are personal data like anything else.
Cookies from embedded services
Embedded maps, videos, fonts, chat widgets and review badges load from other companies and can set their own cookies.
A click-to-chat button on your site opens a conversation in WhatsApp. From that point the customer’s phone number and messages sit on your business phone or in your WhatsApp Business account, not on the website. That is still personal data your business holds, and it belongs in the same thinking: why you keep it, who on your team can see it, and when you clear it out.
What people can ask you for
The Act gives data principals rights that include getting information about the processing of their data, correction and erasure, grievance redressal, and nominating someone to act for them in certain circumstances. In practice, the request a small business is most likely to receive is “please delete my details”. We have a separate guide to handling a customer’s request to delete their data, including where that data tends to hide on a WordPress site.
The Act also expects businesses to protect personal data with reasonable security safeguards and to inform the Board and affected people if a personal data breach happens. What that looks like after an incident is covered in our post on who to tell after a website breach, so we will not repeat it here.
One more point that catches some sites out: children. The Act treats anyone under 18 as a child, requires verifiable consent from a parent or guardian before processing a child’s data, and restricts tracking, behavioural monitoring and targeted advertising directed at children. If your site serves schools, coaching or anything aimed at young people, raise this with your adviser early.
A practical checklist for your website
- List every place data enters the site. Forms, checkout, account sign-up, chat, newsletter, analytics, pixels and embeds.
- Write down the purpose of each. “To reply to your enquiry” is a purpose. “Marketing and other purposes” is not much of one.
- Remove fields you do not need. If a contact form asks for date of birth and you never use it, take the field out. Less data is less to protect.
- Put a short notice at each collection point. One or two lines next to the form, linked to your full policy, beats a long policy nobody reaches.
- Separate marketing from the main purpose. Someone asking for a quote has not agreed to a newsletter.
- Bring your privacy policy up to date. It should describe what the site does today. Our post on keeping a website privacy policy current in India walks through that review.
- Decide how long you keep things. Old form entries and inactive accounts are the data most likely to be exposed and least likely to be useful.
- Name a contact. Give people a working email address for privacy questions, and make sure someone reads it.
- Check who else touches the data. Hosting, email tools, CRM, payment gateway, your developer. Know who they are and what they can see.
None of this requires rebuilding the site. Most of it is a careful afternoon of looking at what is already there.
Where to start
If you do one thing this week, do the first item on the list. Until you know what your site collects and where it goes, every other decision is guesswork.
We do not sell a DPDP compliance package, and we are not lawyers. What we can do is the technical side: map what your WordPress site collects, adjust forms and consent checkboxes, set retention options and tidy up old data, working alongside whatever your adviser recommends. If that would help, tell us what you need and we will tell you honestly whether it is something we can do.
Next in this series: Consent on Website Forms Under India's Data Law
