The DPDP Act Is Coming for Your Website — Here's What Actually Changes

The Digital Personal Data Protection Act doesn't have a small-business carve-out. It applies to any entity processing the personal data of individuals in India, whether that data is digital or gets digitised later — a 5-person company collecting names and phone numbers through a contact form is in scope, same as a bank.

Here's where enforcement actually stands, and what it concretely means for a typical SME website.

The real timeline — not vague "it's coming someday"

The DPDP Rules were notified on 14 November 2025, kicking off a phased rollout:

• Phase 1 (from Nov 2025): definitions, the Data Protection Board of India's establishment, and rule-making powers came into effect.
• Phase 2 (through 2026): the Consent Manager framework is being operationalized, and November 2026 — a month from when we're writing this — marks the end of the initial "soft enforcement" period, after which the Data Protection Board is expected to shift from awareness-building toward active supervision.
• Phase 3 (14 May 2027): the substantive provisions of the Act and Rules come fully into force, 18 months after the Rules were notified.

"We have time" is technically true. It's also a worse bet than it sounds — building compliant consent flows into a site from the start is a fraction of the cost of retrofitting them under deadline pressure in early 2027, when every agency in the country is trying to do the same thing for every client at once.

What a compliant consent flow actually looks like

This is the part that catches most existing SME sites off guard — a privacy policy page alone does not satisfy the Act's consent requirement. The two are legally distinct:

• The consent notice must be clear, itemised by specific purpose, and separate from other terms and conditions — not bundled into a signup checkbox that also covers marketing emails and T&Cs in one tick.
• Consent must be an affirmative action. A pre-checked box is explicitly non-compliant; the person has to actively check it or click "I agree."
• It has to be available in English plus any of the 22 scheduled languages, at the user's choice — not just English, if your audience includes non-English speakers.
• A privacy policy is a separate, living document that has to be updated whenever processing activities or third parties change, with users re-notified of material changes — not a page written once at launch and forgotten.

For most SME sites we look at, the actual gap isn't malicious data handling — it's a contact form or newsletter signup built two years ago with a single unchecked "I agree to terms" box that technically covers nothing specific.

Breach notification: the part with a hard clock

If a breach happens, the Data Protection Board must be notified immediately, and every affected individual — regardless of how minor the breach looks — has to be notified within 72 hours. There's no "it was small enough not to matter" exception in the text. If your site stores any personal data (names, emails, phone numbers, payment details) and you don't currently have a plan for who does what in the first 72 hours after a breach, that plan needs to exist before enforcement tightens, not after.

What data principal rights mean for your database, not just your UI

Beyond consent, individuals get the right to access their data, correct it, withdraw consent as easily as they gave it, and request erasure. That's not only a legal text — it's a real requirement on how your database and backend are structured. If deleting a user's data means manually hunting through six different tables and a marketing tool's separate database, that's a gap that shows up the first time someone actually exercises the right, not before.

What to actually do now, in order

1. Audit every form on your site that collects personal data, and check whether consent for each specific purpose is separate and affirmative.
2. Split your privacy policy from your consent notice if they're currently the same block of text.
3. Write down an actual breach response plan — who gets notified, in what order, within what time — even a one-page version is better than nothing.
4. Confirm you can actually delete a specific person's data across every system that holds it, not just your primary database.

None of this requires an enterprise compliance team for a typical SME site. It requires doing it deliberately once, which is cheaper than doing it under pressure in 2027. If you want an honest read on where your own site actually stands, tell us what you're running and we'll walk through the gaps with you.