DPDP Rules for Small Business Websites in India: What to Prepare Before 2027

A simple contact form, a newsletter sign-up, or a checkout page is enough to put personal data on your website. In India, the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 set out how that data should be handled. Most day-to-day duties start later, which gives small business owners time to prepare.

This guide explains the timeline in plain language and gives a practical preparation plan for a small business website. It is educational information, not legal advice.

What the DPDP Rules Are and When They Apply

The Digital Personal Data Protection Act, 2023 was enacted by Parliament on 11 August 2023, but it comes into force in stages by government notification (Section 1(2)). Notification G.S.R. 843(E), dated 13 November 2025, switched on the Act's definitions and Data Protection Board provisions at Gazette publication, Section 6(9) one year later. Sections 3 to 17, except Section 6(9), take effect eighteen months after Gazette publication; these are the main fiduciary duties. The DPDP Rules, 2025 were notified separately as G.S.R. 846(E), also dated 13 November 2025.

The Rules do not all start on the same day:

• Rules 1, 2 and 17 to 21 took effect on the date of publication.
• Rule 4 takes effect one year after publication.
• Rules 3, 5 to 16, 22 and 23 take effect eighteen months after publication.

Both notifications appear in the Gazette of India (Extraordinary) dated 13 November 2025, and the periods run from Gazette publication, not from the day a copy was posted on a government website. They state the periods relative to publication rather than as a calendar date, so counting from the Gazette date points only to around May 2027. Other laws that already apply to your business keep applying in the meantime. Rule 3 covers notices, so the notice duty for a typical website falls in the 18-month group.

Does This Affect Your Website?

If your site collects information about identifiable individuals, such as a name, email address, phone number, delivery address or payment details, you are handling personal data. The Act calls the person or business that decides why and how that data is used a Data Fiduciary. Most small business sites with forms or online orders fit that description.

The government has said the framework includes a facilitative compliance regime for startups and smaller enterprises. Do not assume your business is exempt, though. Check the official text or ask a qualified professional about your situation.

Common places where personal data enters a small business site include:

• contact, quote and booking forms
• newsletter and promotion sign-ups
• checkout, order and invoice pages
• WordPress comments and customer accounts
• analytics and advertising tools, which may collect identifiers about visitors

Notice and Consent: What to Show Visitors

Under Rule 3, the notice you give before collecting personal data must be understandable on its own, written in clear and plain language, and detailed enough for informed consent. It should include at least:

• an itemised description of the personal data you collect
• the specific purpose and the goods, services or uses it enables
• a link to your website or app where people can manage their choices
• how to withdraw consent, use their rights and complain to the Data Protection Board

Rule 9 also requires you to publish, prominently on your website or app, the business contact details of a person who can answer questions about how you process personal data. That can be a privacy contact. A formal Data Protection Officer is required only for a Significant Data Fiduciary that the government has notified under Section 10 of the Act.

In practice, avoid hiding consent inside a long terms page. Place a short, specific notice next to each form, explain why you need each field, and drop fields you do not really need.

Security Safeguards for Your Website

Rule 6 requires reasonable security safeguards. The Rules list minimum measures that include encryption or masking, access controls, logging and monitoring, backups that keep processing going after an incident, and contracts with the companies that process data for you.

For a small business site, that translates into everyday habits:

• Serve every page over HTTPS.
• Keep WordPress, themes and plugins updated.
• Use strong, unique admin passwords and limit the number of admin accounts.
• Keep tested backups of your site and database.
• Delete old form entries and unused plugins that still store visitor data, unless a legal retention requirement applies.
• Review the terms of your hosting, email and form tools, since they process data for you.

Retention rules matter here too. Rule 6 expects logs and related personal data to be kept for one year to help detect and review unauthorised access, unless other law requires longer. Rule 8(3) separately requires certain data, traffic data and logs to be kept for at least one year for specified purposes, then erased unless law requires otherwise. These are specific requirements, not one period for every record, and they do not mean keeping everything indefinitely.

Hosting choices can support these habits but cannot replace them. For example, Z.com's US storefront lists a free SSL certificate on its paid web hosting plans, from Single to Thrive. Check the plan page for current terms. SSL protects data in transit between your visitor and your site. It does not replace access control, updates or a proper notice. Hosting on Z.com US also does not make a website locally hosted or compliant by itself.

Breaches, User Requests and Children's Data

Rule 7 expects you to tell each affected person about a breach without delay, in clear and plain language. The message should cover what happened, its extent and timing, likely consequences, what you are doing about it, steps the person can take, and a contact person. You must also notify the Data Protection Board without delay, and give it detailed information within 72 hours of becoming aware of the breach, or a longer period the Board allows on written request (Rule 7(1) and 7(2)). Decide now who on your team handles that message and who contacts your hosting provider.

Individuals will also be able to ask to access, correct, update or erase their data. Do not treat 90 days as a deadline for every request. Rule 14(3) requires you to prominently publish your grievance redressal mechanism and the period within which you respond to grievances, which must be reasonable and not exceed 90 days. That is a separate matter from handling access, correction and erasure requests promptly. A shared inbox and a short internal procedure are enough to start with.

The Act treats anyone under 18 as a child (Section 2(f)), and this is not limited to child-directed sites. Before processing a child's personal data, you generally need verifiable parental consent (Section 9 and Rule 10), and Section 9(3) bars tracking, behavioural monitoring and targeted advertising directed at children, subject to statutory exceptions. Exceptions apply only to the specific classes of fiduciary and purposes, with conditions, listed in Rule 12 and the Fourth Schedule, such as clinical establishments for health services or educational institutions for monitoring limited to educational activities or safety. Working in education or healthcare is not a general exemption, so check whether you fall within a listed class and condition.

A Practical Preparation Checklist

• List every form, plugin and tool on your site that collects personal data.
• Write a short, specific notice for each collection point.
• Name a contact person for privacy questions and publish their details (Rule 9).
• Turn on HTTPS, update software and tighten admin access.
• Set up tested backups and delete data you no longer need, unless a legal retention requirement applies.
• Write a one-page plan for breach messages and user requests.
• Review the terms of every provider that processes data for you.

Common Mistakes to Avoid

Frequently Asked Questions

For the official text, read the government announcement of the DPDP Rules, 2025 and the Digital Personal Data Protection Rules, 2025 (PDF) published by the Ministry of Electronics and Information Technology. For the Act itself and its staged commencement, see the Digital Personal Data Protection Act, 2023 (PDF) and the Act commencement notification, G.S.R. 843(E) (PDF).