DPDP compliance for your website and forms: a practical checklist

If your website collects a name, email address or phone number, the Digital Personal Data Protection (DPDP) Act, 2023 probably applies to you. Section 3 covers digital personal data processed in India, and processing for an individual's personal or domestic purpose is outside it. Per Rule 1 of the DPDP Rules, 2025, most duties apply 18 months after notification (13 November 2025). This checklist turns the Act and the Rules into ten tasks for your forms, with the section or rule number beside each.

Last reviewed 8 November 2026 against the sources listed at the end. This is a working checklist from the published texts, not legal advice. Have your counsel confirm how it applies to your business.

What the dates are

The DPDP Rules, 2025 were published in the Gazette of India on 13 November 2025. The Press Information Bureau reports the notification as 14 November. Rule 1 sets three start dates.

Most duties in this checklist fall in the last row. On that reading you have about six months from this review. Forms and vendor contracts take time to change, so start now.

As reported by PIB, penalties under the Act are set in three bands: the highest for failing to keep reasonable security safeguards, the next for failing to notify a breach or breaching the children's provisions, and the lowest for any other violation.

The ten-task checklist

Task 1: List every place you collect personal data

Write one row per form and tool: contact form, careers form, newsletter box, enquiry chat, event sign-up, analytics. For each, record the fields, the reason you ask, where the data goes, and which vendors touch it. Every later task starts from this list.

Task 2: Give a notice before or with each consent request

Section 5 of the Act and Rule 3 set what the notice must hold. Put it on or next to the form.

• It makes sense on its own, without reading your other pages.
• It lists the personal data you collect, item by item.
• It states each purpose and describes what the person gets in return.
• It links to your site and describes how the person can withdraw consent, use their rights and complain to the Data Protection Board.
• It can be read in English or any language in the Eighth Schedule to the Constitution.

Task 3: Ask for consent in a way you can prove

Consent must be free, specific, informed, unconditional and unambiguous, with a clear affirmative action (section 6(1)). In practice:

• Leave consent boxes unticked.
• Ask for each purpose separately. An enquiry reply and a marketing mailing are two purposes.
• Collect only what the purpose needs. The Act's own example calls a phone-contact request for a telemedicine app unnecessary.
• Keep a record: what notice version the person saw, what they ticked, and when. Section 6(10) puts the burden on you to prove that notice was given and consent obtained.

Some uses need no consent. Section 7(a) lets you use data a person volunteered for the purpose they gave it, such as replying to an enquiry, unless they have said they do not consent. Marketing sits outside that. Ask counsel where your line falls.

Task 4: Make withdrawal as easy as consent

Section 6(4) and Rule 3 say withdrawal must be as easy as giving consent. If one tick subscribed the person, one click must unsubscribe them. After withdrawal, you and your processors must stop using the data unless a law requires it (section 6(6)).

Task 5: Handle children's data with care

A child is anyone under 18 (section 2(f)). Before processing a child's data you need verifiable consent from a parent or guardian (section 9(1), Rule 10). You must not track or behaviourally monitor children, or target advertising at them (section 9(3)). Schedule 4 of the Rules lifts parts of this for clinical establishments, healthcare professionals and educational institutions, within stated limits.

If your site is not meant for under-18s, say so and add a clear declaration on forms. That is a design choice that reduces risk. It does not replace the verification Rule 10 asks for where you do serve children.

Task 6: Put safeguards on the data

Rule 6 lists the minimum: encryption, masking or tokens; access control; logs and monitoring; backups; a contract clause with each processor; and keeping logs and personal data for one year to detect and investigate unauthorised access. Check your form tool, your inbox and your CRM against this list. The highest penalty band attaches to this duty.

Task 7: Set a retention period for each form

Erase personal data when the person withdraws consent or when the purpose is no longer served (section 8(7)). Decide the period per form: for example, enquiries that go nowhere are deleted a set time after the last contact. Rule 8 fixes a three-year inactivity period for very large e-commerce, gaming and social media platforms. Other businesses set their own and document it. Keep the one-year log retention in task 6 separate from this.

Task 8: Publish a contact and a grievance route

Rule 9 requires you to publish the business contact of a Data Protection Officer, or of a person who can answer questions about your processing. Rule 14 requires you to publish how people exercise their rights and your grievance system, with a response in no more than 90 days. Section 8(10) requires an effective grievance mechanism. Put all three on your privacy page and in the footer.

Task 9: Write the breach runbook before you need it

When you become aware of a breach, Rule 7 asks for two notifications.

1. Each affected person, without delay, in plain words: what happened, likely consequences for them, what you are doing, what they can do to protect themselves, and who to contact.
2. The Data Protection Board (Rule 7(2)), without delay with a first description, then within 72 hours (or longer if the Board allows in writing) with the facts, causes, mitigation and a report on the notices sent.

CERT-In's separate Directions of 2022 ask for incident reporting within 6 hours. Name who decides, who writes and who sends, and keep their phone numbers off the system that may be down.

Last task: check your vendors

You stay responsible for processing done on your behalf (section 8(1)). Engage a processor only under a valid contract (section 8(2)). List every vendor that receives form data: hosting, email, CRM, chat, analytics. Confirm each contract carries the safeguards in task 6 and an erasure clause. Section 16 and Rule 15 let the Government restrict transfers abroad, so record the country each vendor stores data in.

What about cookies and analytics?

The Act does not mention cookies. The test is whether the tool processes personal data of an identifiable person. If your analytics or advertising tags do, treat them as processing that needs a notice and consent, with the same withdrawal rule. If a tool counts visits without identifying anyone, the Act is not engaged for that data. Say which applies in your privacy page. A tool that sets third-party advertising tags on a site with child visitors runs into section 9(3).

This is our reading. Confirm with counsel for your own tools.

Common gaps

• A single "I agree" box that covers enquiry, marketing and sharing with partners.
• A privacy page that describes the company in general terms but does not itemise the data on each form.
• No stated retention period, so enquiries from 2019 are still in the inbox.
• A newsletter tool outside India with no review of its contract.
• No written breach plan.

Where Brihat fits

Brihat Infotech designs consent, retention and erasure into the data model of the platforms it builds. See its compliance page. Start a conversation.

Sources and primary texts

1. Digital Personal Data Protection Act, 2023 (MeitY, PDF)
2. Digital Personal Data Protection Rules, 2025, Gazette of India G.S.R. 846(E) (MeitY, PDF)
3. PIB: DPDP Rules, 2025 Notified, backgrounder of 17 November 2025
4. PIB press release: Government notifies DPDP Rules, 14 November 2025
5. CERT-In Directions under section 70B(6), 28 April 2022