DPDP Act compliance guide for small businesses and e-commerce

The Digital Personal Data Protection Act, 2023 becomes law. Most of it waits for the Rules.

Definitions and the Data Protection Board come into force. The countdown starts.

Consent Managers can register with the Board. Your users may start giving or withdrawing consent through them.

Notices, security safeguards, breach reporting, data retention and erasure, children's data, user rights and grievance handling all become enforceable.

List every form, checkout field, cookie, plugin and third-party app on your site. For each one, write down what data it collects, why, where it is stored, who it is shared with and when it is deleted. If you don’t need a field, stop collecting it.

Before or when you ask for consent, show a short notice that stands on its own — not just a link to a long privacy policy. It must list the data you collect and the purpose of each, and tell people how to withdraw consent, how to use their rights and how to complain to the Data Protection Board. People can ask for it in English or any of the 22 languages in the Eighth Schedule of the Constitution.

• One unticked checkbox per purpose — for example, “send me offers” separate from “process my order”.
• No “by using this site you agree” and no pre-ticked boxes.
• Your store must still work if someone says no to marketing.
• Keep a record of who agreed to what, and when. If challenged, you must prove it.

Analytics, ad pixels and marketing tags usually rely on consent. Use a consent banner that keeps them switched off until the visitor agrees.

If it took one click to sign up, it should take one click to opt out. After someone withdraws, stop processing their data and make your vendors stop too.

Rule 6 sets a minimum: encryption or masking of personal data, access control, logs and monitoring of who accessed data, backups, and security terms in your contracts with vendors. Keep those logs for at least one year.

Any leak, loss or unauthorised access to personal data is a breach, however small. You must tell every affected customer without delay, send the Board a first report without delay, and a detailed report within 72 hours of finding out. Decide now who does what.

Erase personal data once its purpose is served or consent is withdrawn, unless another law makes you keep it (tax and accounting records, for example). But keep order records and processing logs for at least one year, even if the customer deletes their account. Very large platforms (e-commerce with 2 crore or more registered users) must also delete data of users inactive for three years, with 48 hours’ notice.

Customers can ask to see a summary of their data, correct or update it, erase it, nominate someone to act for them, and raise a grievance. Publish how to make a request and who to contact, and reply within your published time limit — no more than 90 days.

Anyone under 18 is a child under the Act. You need verifiable consent from a parent before processing a child’s data, and you must not track children or show them targeted ads. If you sell to young people, add an age check.

Your website builder, host, payment gateway, courier, email and analytics tools all handle your customers’ data. Make sure each contract covers security, breach reporting and deletion.

Start with a free scan at dpdp-audit.in. It shows the trackers, forms and notices on your site that need attention.

We list every place your site collects personal data — forms, checkout, cookies, plugins, payment and email tools — and match each one to what the law requires.

We add a consent banner that keeps analytics and marketing tags off until visitors agree, clear notices on every form, unticked per-purpose checkboxes, and a consent log you can show the Board. Wix sites can use our DPDP Banner app.

We build simple flows for customers to see, correct or delete their data, withdraw consent and raise a complaint, with a tracker so no request passes the 90-day limit.

HTTPS everywhere, encryption, strong admin access with two-factor login, access logs kept for a year, tested backups, and no personal data leaking into logs or URLs.

Automatic clean-up jobs that delete data when it is no longer needed (while keeping the one-year records the Rules ask for), plus a breach plan and ready-to-send notices for the 72-hour window.

The Digital Personal Data Protection Act, 2023 (DPDP Act or DPDPA) is India's data protection law. It sets rules for how businesses collect, use, store and delete digital personal data, and gives people rights over their data. The DPDP Rules, 2025, notified on 13 November 2025, explain how to comply.

In phases. The DPDP Rules were notified on 13 November 2025, the Consent Manager rules apply from 13 November 2026, and most compliance duties — notice, consent, security, breach reporting, data retention, children's data and user rights — apply from 13 May 2027.

Yes. There is no general exemption based on size. If your website or online store collects personal data such as names, emails, phone numbers or addresses from people in India, the DPDP Act applies. The government may exempt some startups from some duties in future, but no such exemption has been notified.

The Data Protection Board can impose penalties of up to ₹250 crore for failing to take reasonable security safeguards, up to ₹200 crore for not reporting a personal data breach or breaking the rules on children's data, and up to ₹50 crore for other breaches of the Act or Rules.

The Act does not mention cookies by name, but analytics and marketing cookies, pixels and trackers that collect personal data generally need consent. A consent banner that keeps them switched off until the visitor agrees is the practical way to comply.

Without delay to each affected person and to the Data Protection Board, followed by a detailed report to the Board within 72 hours of becoming aware of the breach. There is no minimum size — every personal data breach must be reported.

Both protect personal data, but the DPDP Act covers only digital personal data, has no separate 'sensitive data' category, relies on consent plus a short list of 'legitimate uses' instead of GDPR's broader legal bases such as legitimate interests, and sets fixed penalty caps (up to ₹250 crore) instead of a percentage of turnover.

The business or person that decides why and how personal data is processed — the equivalent of a 'data controller' under GDPR. If you run a website or online store, you are the Data Fiduciary for your customers' data.