India's DPDP Rules are rolling out in phases. Here is what small businesses should do now to make their website and app privacy-ready before May 2027.
If your website has a contact form or your app asks for a phone number, India's data protection law applies to you, and the main compliance date is 13 May 2027.
Think about a boutique in Lucknow that collects names and phone numbers through a website form, then sends offers on WhatsApp. It feels like normal business. Under the Digital Personal Data Protection (DPDP) Act, that is "processing personal data", and there are now rules about how it should be done. The good news: you have time, and most of the work is common sense.
Where things stand today
The DPDP Rules were notified in November 2025 and are being rolled out in phases:
|
Date |
What starts |
|---|---|
|
November 2025 |
Rules come into force; the Data Protection Board and basic provisions begin |
|
13 November 2026 |
Rule 4 starts: the registration framework for "Consent Managers" |
|
13 May 2027 |
The core obligations apply: notice, consent, security safeguards, breach reporting and more |
That November 2026 date is only days away, but it mainly concerns companies that want to operate as Consent Managers. For most startups and small businesses it is not the general deadline. May 2027 is, and the sensible move is to start preparing now instead of in April.
What this means for your website and app
In simple terms, the law asks you to treat people's data with respect. In practice, that usually looks like this:
- Tell people what you collect and why. A clear privacy notice, written in plain language. Hindi and English is a good idea for local audiences.
- Ask for consent properly. No pre-ticked boxes, no bundling "agree to everything" into one click. Consent should be for a specific purpose.
- Make withdrawing consent easy. If signing up takes one click, opting out should not take ten.
- Collect only what you need. If you do not need someone's address or date of birth, do not ask for it.
- Keep data secure. HTTPS, strong access controls, encrypted storage and regular backups are the basics.
- Be ready for a breach. The rules expect breaches to be reported, including to the Data Protection Board within 72 hours, so you need a plan before something goes wrong.
- Take extra care with children's data. Apps and sites aimed at minors face stricter rules, including parental consent.
- Check your vendors. Hosting providers, analytics tools, payment gateways and CRM software all handle data on your behalf. Know who they are and what they do with it.
A simple starter checklist
- List every place you collect data: forms, sign-ups, checkout, chat, analytics, WhatsApp lists
- Write down why you collect each item and how long you keep it
- Update your privacy policy in plain words
- Add clear, unticked consent checkboxes where needed
- Add a simple way for users to withdraw consent or request deletion
- Review your website and app security (HTTPS, passwords, admin access, backups)
- Write a one-page breach response plan with a named person responsible
- Ask your developers and vendors how they handle personal data
Why it is worth doing early
Penalties under the Act can be heavy for serious failures, but the bigger reason is trust. Customers are more careful about who they share their phone number with. A business that explains clearly what it does with data stands out.
Building privacy into an app or website from the start is also far cheaper than rebuilding it later.
This article is general information, not legal advice. For your specific situation, speak to a qualified legal professional.
Want a privacy-ready website or app? The Progix Technologies team can review your current setup and build consent flows, secure storage and clear notices into your next project.
Leave a Comment