--- title: "Website Compliance Under India’s DPDP Act: 15 Key Legal Requirements for Businesses" date: 2026-08-31 author: "Dhruv Kaushal" url: https://ksandk.com/data-protection-and-data-privacy/dpdp-act-website-compliance/ --- ## Introduction For businesses operating websites, mobile applications and digital platforms in India, [privacy compliance](https://ksandk.com/practice-areas/information-technology-law-firm-in-india/data-privacy/) is moving beyond the traditional practice of publishing a privacy policy and cookie banner. The Digital Personal Data Protection Act, 2023 (“DPDP Act”), read with the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”), establishes a broader framework governing the collection and processing of digital personal data. The DPDP Rules were notified on 13 November 2025. Importantly, however, the framework has been designed with a phased commencement mechanism. Rules 1, 2 and 17 to 21 came into force upon publication, while several substantive provisions of the Act and Rules are scheduled to take effect after the prescribed transition periods. Accordingly, businesses should treat 2026 as a critical DPDP compliance-readiness period, rather than assuming that every substantive obligation is already enforceable. ### Are you a Significant Data Fiduciary? Answer 25 questions to see your DPDPA risk level and whether the DPO obligation applies to you — free, instant, with a branded PDF. [Check your compliance score →](https://ksandk.com/privacy-review/scorecard) The distinction is particularly important for websites. A website may collect personal data through contact forms, account registrations, newsletter subscriptions, recruitment portals, payment interfaces, customer-support tools, analytics software, advertising technologies and third-party integrations. Each of these touchpoints can create privacy and data-protection implications. The DPDP framework therefore requires businesses to examine not only what their privacy policy says, but also how personal data is actually collected, used, stored, shared, secured and deleted. This article sets out 15 key website compliance requirements under the DPDP Act and DPDP Rules, while also highlighting practical measures businesses should consider when preparing for India’s data protection regime. ## Identify What Personal Data the Website Collects The first step in achieving DPDP Act compliance for websites is to identify the personal data being collected and processed. Personal data may be collected directly through: - Registration and account-creation forms; - Contact-us forms; - Newsletter subscriptions; - Customer-support requests; - Job applications; - Online purchases and payment processes; - Surveys and feedback forms; and - Lead-generation forms. It may also be collected indirectly through cookies, analytics tools, advertising technologies, device identifiers and other digital technologies, depending on whether the information falls within the statutory definition of personal data. Businesses should therefore conduct a website data inventory or data-mapping exercise to identify the categories of personal data collected at each user touchpoint, the purpose for which it is processed, the systems in which it is stored and the third parties that receive it. ## 2. Apply Purpose Limitation and Avoid Unnecessary Collection The DPDP framework is built around processing personal data for lawful purposes and in accordance with the applicable grounds for processing. For website operators, this means that businesses should avoid collecting information merely because their forms or technology platforms permit them to do so. For example, a website collecting a user’s name and email address to send a newsletter may not ordinarily need to require information such as residential address, date of birth or government identification details. Accordingly, businesses should review website forms and remove fields that are not reasonably connected with the relevant purpose. This is particularly important for DPDP compliance for online forms, where excessive data collection can create unnecessary privacy and security exposure. ## 3. Provide a Clear and Standalone Privacy Notice A privacy notice under the DPDP framework should be more than a lengthy legal document buried in the footer of a website. Rule 3 of the DPDP Rules requires the notice to be presented in a manner that is understandable independently of other information and to provide a clear account of the personal data being processed and the specific purpose or purposes of such processing. It must also provide the relevant means through which the Data Principal can access the website or application and exercise applicable rights. Businesses should therefore consider providing just-in-time privacy notices at relevant collection points, rather than relying exclusively on a generic privacy policy. For example, a recruitment form, newsletter subscription form and e-commerce checkout page may each require appropriately tailored disclosures. ## 4. Obtain Valid Consent Where Consent Is the Applicable Ground Consent under the DPDP Act is not merely a technical checkbox. Where consent is the applicable basis for processing, the website should be designed so that the Data Principal can make a genuine and informed choice. The [consent mechanism](https://ksandk.com/data-protection-and-data-privacy/dpdp-consent-manager-framework-india/) should correspond with the statutory requirements and should not be embedded in a manner that makes the user’s choice unclear. Businesses should therefore review: - Pre-ticked consent boxes; - Bundled consent mechanisms; - Marketing opt-ins; - Consent language; - Separate purposes of processing; and - The records maintained to demonstrate consent. Importantly, businesses should not assume that all processing on a website requires consent. The DPDP Act recognises certain specified “legitimate uses” in addition to consent. The appropriate legal basis should therefore be determined on a processing-by-processing basis. ## 5. Make Withdrawal of Consent as Easy as Giving It Where processing is based on consent, the DPDP framework gives the Data Principal the ability to withdraw that consent. Website architecture should consequently provide a practical mechanism for withdrawal. For example, if a user subscribes to promotional communications through a website, the organisation should provide an accessible method for unsubscribing or otherwise withdrawing consent. The DPDP Rules specifically contemplate mechanisms through which a Data Principal can withdraw consent and exercise applicable rights. A business should therefore avoid a situation in which consent can be provided with one click but withdrawal requires multiple emails, telephone calls or manual intervention. ## 6. Maintain an Accurate and Operational Privacy Policy A privacy policy remains an important component of website privacy compliance under Indian law, but it should accurately reflect the organisation’s actual data practices. Depending on the organisation’s operations, the policy should address matters such as: - Categories of personal data processed; - Purposes of processing; - Applicable rights of Data Principals; - Methods for exercising those rights; - Grievance-redressal mechanisms; - Contact details of the relevant person or function; - Data retention practices; and - Relevant disclosures concerning processing and sharing. The key legal risk is not merely having an incomplete privacy policy. It is having a policy that does not correspond with the organisation’s actual practices. ## 7. Build Reasonable Security Safeguards into Website Operations Security is one of the most significant obligations under the DPDP Act. Section 8(5) requires a Data Fiduciary to protect personal data in its possession or under its control by taking reasonable security safeguards to prevent [personal data breaches](https://ksandk.com/data-protection-and-data-privacy/cross-industry-cyber-threat-liability/). This obligation also extends to processing undertaken by a Data Processor on the Data Fiduciary’s behalf. The DPDP Rules further prescribe security-related requirements. For website operators, compliance should therefore extend beyond the website’s visible interface and include the underlying technology environment. Depending on the nature and scale of processing, relevant measures may include: - Access controls and authentication mechanisms; - Encryption and appropriate data protection measures; - Logging and monitoring; - Vulnerability management; - Back-up and recovery mechanisms; - Security testing; - Incident-response procedures; and - Appropriate controls over third-party service providers. The statutory ceiling for breach of the reasonable-security-safeguards obligation is **₹250 crore**, making this one of the most consequential areas of DPDP compliance. ## 8. Establish a Personal Data Breach Response Mechanism A privacy compliance programme should assume that a security incident can occur. The DPDP Act requires a Data Fiduciary, in the event of a personal data breach, to provide intimation to the [Data Protection Board](https://ksandk.com/data-protection-and-data-privacy/dpdp-act-rules-2026-compliance-deadline/) and affected Data Principals in the prescribed manner. The DPDP Rules prescribe additional requirements concerning breach intimation and security safeguards. Businesses should therefore establish a documented DPDP data breach response procedure, identifying: 1. How an incident is detected; 2. Who is responsible for escalation; 3. How affected systems and data are assessed; 4. How legal and technical teams coordinate; 5. How required notifications are prepared; and 6. How corrective and preventive measures are documented. A website operator should not be developing its breach-response process for the first time after an incident occurs. ## 9. Review Third-Party Website Technologies and Data Processors Modern websites rarely operate in isolation. A single website may use third-party providers for: - Cloud hosting; - Website analytics; - Customer relationship management; - Payment processing; - Marketing automation; - Advertising; - Customer support; - Email distribution; - Authentication; and - Website security. Where these providers process personal data on behalf of the organisation, the business must understand its responsibilities as a Data Fiduciary and appropriately manage its relationship with Data Processors. Section 8(5), for example, expressly extends the security obligation to processing undertaken on behalf of the Data Fiduciary by a Data Processor. Consequently, DPDP compliance for third-party vendors and website processors should form part of the organisation’s broader privacy compliance programme. ## 10. Create a Process for Data Principal Rights The DPDP Act grants Data Principals specified rights, including rights relating to access to information about their personal data, correction and erasure, grievance redressal and nomination. A website operator should therefore have a functioning process through which eligible requests can be received, authenticated, assessed and addressed within the applicable statutory framework. The relevant mechanism should be operational rather than merely described in the privacy policy. Businesses should also determine: - Which team receives requests; - How the identity of the requester is verified; - Which systems must be searched; - How requests are escalated; - How responses are documented; and - How requests for correction or erasure are communicated to relevant processors, where required. ## 11. Establish an Effective Grievance-Redressal Mechanism A website should clearly identify how a Data Principal can raise a grievance concerning the processing of personal data. This information should be easy to locate and should not require users to navigate through multiple unrelated pages. An organisation should also establish an internal workflow for receiving, investigating and resolving privacy complaints. For businesses operating at scale, this should include appropriate ownership, escalation procedures, response tracking and documentation. ## 12. Implement Enhanced Controls for Children’s Personal Data Websites that are directed towards, or reasonably likely to be accessed by, children require particular attention. Section 9 of the DPDP Act contains additional obligations concerning the processing of children’s personal data. These include requirements relating to verifiable parental consent and restrictions on processing that is likely to cause a detrimental effect on the well-being of a child. The Act also restricts tracking or behavioural monitoring of children and targeted advertising directed at children, subject to prescribed exceptions. The Rules establish mechanisms concerning verifiable consent for processing children’s personal data. Accordingly, businesses operating educational platforms, gaming services, social platforms, [children’s content websites](https://ksandk.com/data-protection-and-data-privacy/dpdp-compliance-for-schools-and-edtech/) or other child-facing digital services should undertake a specific assessment of their compliance obligations. The Schedule to the DPDP Act provides for a penalty of up to **₹200 crore** for breach of the additional obligations relating to children. ## 13. Establish Data Retention and Deletion Controls A common weakness in website privacy programmes is the indefinite retention of information simply because the organisation has the technical ability to retain it. Section 8 of the DPDP Act requires erasure of personal data when the Data Principal withdraws consent or when it is reasonable to assume that the specified purpose is no longer being served, subject to retention being necessary for compliance with law. The obligation also extends to causing the relevant Data Processor to erase personal data made available for processing, where applicable. Businesses should therefore develop DPDP-compliant [data retention](https://ksandk.com/data-protection-and-data-privacy/dpdp-act-2023-record-keeping-audit-requirements/) policies that distinguish between: - Active data; - Data retained for legal or regulatory requirements; - Back-up data; - Archived information; and - Data that should be securely deleted or otherwise appropriately disposed of. ## 14. Maintain Evidence of Compliance DPDP compliance should be demonstrable. A business should be able to explain, with appropriate records, what personal data it processes, why it processes it, where the information is stored, who has access to it and which third parties process it. Depending on the organisation’s size, activities and risk profile, compliance documentation may include: - Data inventories and data-flow maps; - Records of processing activities; - Vendor and processor assessments; - Privacy impact or risk assessments, where appropriate; - Security policies; - Incident-response procedures; - Consent records; - Data retention schedules; - Employee training records; and - Internal compliance reviews. For a technology company, e-commerce business or other data-intensive organisation, these records can be particularly important in demonstrating that privacy compliance is embedded into operations rather than existing solely on paper. ## 15. Conduct Continuous Website Privacy Audits DPDP compliance is not a one-time exercise. Websites change frequently. A new analytics tool may be installed, a new payment provider may be integrated, a new marketing pixel may be deployed, or a new registration field may be added without the privacy policy being updated. Each such change can alter the organisation’s data-processing activities. Businesses should therefore conduct periodic DPDP compliance audits for websites and digital platforms, particularly when launching new products, changing technology providers or introducing new data-processing activities. A practical review should ask: - What personal data does the website currently collect? - Why is each category being collected? - Is the applicable processing ground correctly identified? - Is the privacy notice accurate? - Are consent mechanisms compliant? - Can users exercise their rights effectively? - Are third-party processors appropriately managed? - Are security safeguards adequate? - Are retention and deletion controls operational? - Is the organisation prepared to respond to a personal data breach? ## Is a Privacy Policy Alone Sufficient for DPDP Compliance? No. A privacy policy is an important component of website compliance, but it does not by itself establish compliance with the DPDP Act. The distinction is between documentary compliance and operational compliance. For example, a website may state in its privacy policy that: - users can withdraw consent; - personal data is deleted when no longer required; - appropriate security safeguards are implemented; and - users can exercise their statutory rights. If the website does not actually provide mechanisms to accomplish these things, the existence of the policy does not cure the underlying compliance gap. The DPDP framework therefore requires organisations to align their legal documentation, website design, technology infrastructure, internal processes and vendor arrangements. This is also why businesses should avoid treating DPDP compliance as a purely legal drafting exercise. ## What Should Businesses Do Now? The phased commencement of the DPDP framework gives businesses an important opportunity to prepare before the substantive obligations become applicable. The Government’s commencement notification provides for different implementation timelines, with several core provisions of the Act and Rules taking effect 18 months after publication of the relevant notification. Businesses should use this transition period to undertake a structured compliance exercise rather than waiting for the substantive provisions to become operational. A sensible roadmap would include: **Phase 1: Data Mapping:** Identify what personal data is collected through the website, applications and connected systems. **Phase 2: Legal Assessment:** Identify the applicable processing grounds, statutory obligations and potential exemptions. **Phase 3: Website Review:** Review forms, consent mechanisms, privacy notices, cookies and third-party technologies. **Phase 4: Contractual Review:** Review agreements with Data Processors, technology vendors and other third parties. **Phase 5: Security Review:** Assess technical and organisational safeguards and incident-response procedures. **Phase 6: Rights and Grievances:** Establish operational mechanisms for Data Principal requests and complaints. **Phase 7: Governance:** Allocate responsibility for privacy compliance and maintain appropriate records. **Phase 8: Periodic Audit:** Review compliance whenever the website, product or processing activities materially change. ## Conclusion The central lesson of India’s emerging data protection regime is straightforward: a DPDP-compliant website is not created by simply adding a privacy policy to the website footer. Compliance requires alignment between what an organisation tells users and what it actually does with their personal data. For businesses, this means moving from document-based privacy compliance towards an integrated framework covering data collection, purpose limitation, consent, transparency, security, breach response, third-party processing, children’s data, Data Principal rights, retention and internal governance. The notification of the **Digital Personal Data Protection Rules, 2025** on 13 November 2025 marked an important step towards operationalising India’s data protection framework. However, the substantive provisions of the DPDP Act and Rules are subject to a phased commencement framework, with several core obligations scheduled to come into force **18 months from the date of notification, that is, in May 2027**. The **May 2027 deadline should therefore be viewed as a compliance-readiness milestone, not as a reason to defer action**. Businesses should use the transition period to identify gaps in their existing privacy practices, map personal data flows, review website interfaces and consent mechanisms, assess third-party processors, strengthen security safeguards, establish grievance and Data Principal rights mechanisms, and align their contractual and internal governance frameworks with the new regime. Ultimately, organisations that begin preparing well before May 2027 will be better positioned to demonstrate meaningful compliance when the applicable provisions become operational. DPDP compliance is not a one-time website update; it is an ongoing organisational, legal and technological process. ### Explore KSK Data Privacy Hub Free compliance tools and expert guidance covering 75+ jurisdictions. [Global Regulation Finder](/privacy-review/map/)[DPDPA Scorecard](/privacy-review/scorecard/)[DPDPA Guide](/privacy-review/guides/dpdpa/)[GDPR Guide](/privacy-review/guides/gdpr/)[Cross-Border Transfers](/privacy-review/guides/cross-border/) --- ## Office Locations - [New Delhi](https://ksandk.com/locations/top-corporate-law-firm-in-delhi/) (HQ): +91-11-41318190 | info@ksandk.com - [Mumbai](https://ksandk.com/locations/top-corporate-law-firm-in-mumbai/): 3 offices (Nariman Point, Lower Parel, Andheri) | mumbai@ksandk.com - [Bangalore](https://ksandk.com/locations/top-corporate-law-firm-in-bangalore/): bangalore@ksandk.com - [Chennai](https://ksandk.com/locations/chennai/): chennai@ksandk.com - [Hyderabad](https://ksandk.com/locations/hyderabad/): hyderabad@ksandk.com - [Pune](https://ksandk.com/locations/pune/): pune@ksandk.com - [Kochi](https://ksandk.com/locations/kochi/): kochi@ksandk.com ## Contact - [Contact Page](https://ksandk.com/contact-us/) - General: info@ksandk.com | +91-11-41318190 - WhatsApp: +91-7428567444 - [Privacy Statement](https://ksandk.com/privacy-statement/) - [Terms of Use](https://ksandk.com/terms-of-use/)