DPDP compliance for a website means five concrete things: a plain-language privacy notice, consent captured before you collect data, a way to withdraw consent, security and access logs, and a plan for breach reporting. Most of these duties start on 13 May 2027,not on 13 November 2026. For a typical Indian business site, the changes are small changes to forms, cookies and storage, not a rebuild.
This post is for owners and founders who run a website or app that collects names, phone numbers or emails. After reading it you will know which dates matter, what to ask your developer to change, and what you can safely leave alone.
What happened with the DPDP Rules, and why is everyone talking about 13 November 2026?
India’s Digital Personal Data Protection (DPDP) Rules were finalised on 13 November 2025.Some parts took effect immediately, such as the setting up of the Data Protection Board. The rest was phased in over 12 and 18 months, according to IAPP’s report from 14 November 2025.
The 12-month mark falls on 13 November 2026. On that date the rules for registering Consent Managers start to apply. A Consent Manager is a registered company that lets a person give, review and withdraw consent across many businesses from one place.
A 3 October 2026 explainer from JK Tech Hub says most Indian businesses do not need to a Consent Manager and have no direct duty on that date. A 21 September 2026 note from MatrixGard says the same: the date opens registration, and it does not force
ordinary companies to route consent through anyone.
The date that binds ordinary businesses is 13 May 2027, the end of the 18-month window. That is about seven months from today.
Is DPDP compliance for a website mandatory for my business?
If your website, app, WhatsApp channel or spreadsheet holds personal data of people in india, yes. The law calls you a Data Fiduciary, which just means the business that decides why and how personal data is collected.
A contact form that stores a name and phone number counts. So does a booking system, a login, a newsletter box, a payment page or a Google Analytics setup that identifies a person.
Size does not exempt you. A small clinic and a large retailer both fall under the rules. What changes is how much effort you need. A five-page business site needs far fewer changes than an app with logins and a database.
I am a developer, not a lawyer. Treat this post as a technical to-do list and have a lawyer confirm what applies to your sector.
What will I need to change on my website before May 2027?
The rules are written in legal language, but the work for a developer comes down to a short list. Here it is in plain terms.
Duty (from the rules) | What it means on your site or app | Typical change |
Notice | Tell people what data you collect, why, and how to withdraw consent | Rewrite the privacy notice in plain language and show it next to every form |
Consent | Ask clearly before collecting; no pre-ticked boxes | Add an unticked consent checkbox and store who agreed, when, and to which notice version |
Withdrawal | Withdrawing must be as easy as agreeing | Add a “withdraw consent” link or form that actually deletes or stops using the data |
Security safeguards | Protect data with access control, encryption and logs | Check hosting, passwords, admin access, and log who views personal data |
Breach reporting | Report a breach to the Board and to affected people | Keep a simple checklist and know where your data lives so you can say who was affected |
Erasure and retention | Delete data when it is no longer needed | Decide how long you keep leads, bookings and logs, and delete on schedule |
Children’s data | Extra care for under-18 users | Add age checks if your product serves children |
The CyberAube playbook dated 19 August 2026 notes a 72-hour window for telling the Board about a breach, and a one-year minimum for keeping certain logs. Check these numbers with your lawyer, since they affect how long you must store records.
Want a fixed number for your project? Send 3–4 lines on WhatsApp and get a written quote within 48 hours.
How do I find out what personal data my business actually holds?
Start with a data map. It is a simple sheet with one row per place where personal data enters or sits. You do not need software for this.
List every form on your website, every app sign-up, every WhatsApp chat where customers send details, your CRM, your billing tool, your HR files and any Excel sheet that holds phone numbers. For each row, write what data it holds, why you collect it, who can see it, and how long you keep it.
Most owners are surprised by two things. First, the same customer’s phone number sits in five places. Second, old leads from years ago are still stored with no reason to keep them.
This sheet becomes the base for your privacy notice, your retention rules and your breach plan. It is also the first thing a developer will ask for when quoting the work.
How do I add consent and a privacy notice that actually work?
A privacy notice should be short, in plain language, and available in the language your customers use. Hindi or a regional language is worth considering if your customers read it more easily.
Consent should be a separate, unticked checkbox with a sentence that says what you will do with the data. “I agree to be contacted on WhatsApp about my enquiry” is clearer than “I accept the terms”
On the technical side, store a record for every consent: the person, the time, the exact notice text they saw, and the channel. The burden of proof sits with you, so this record matters if anyone asks later.
Keep consent records in their own table, not mixed into the main customer table. That makes it easy to update a record when someone withdraws, and easy to connect to a Consent Manager later if you choose.
What does DPDP mean for apps, WhatsApp and AI tools?
Apps follow the same logic as websites, with a few extra points. The permissions your app asks for (contacts, location, camera) should match what you say in the notice. Ask only when the feature needs it.
WhatsApp is a data channel too. If you collect details in chats, you need a way to record consent and to delete the chat data when asked. If you use a chatbot, check where its messages are stored and who at the vendor can read them.
AI tools add one more question: does customer data go to a third-party model, and is it kept for training? Read the vendor’s terms and write the answer into your notice. If this applies to you, an AI and ML development team can keep the data on infrastructure you control.
How much will DPDP changes cost for a small business?
Ureka does not have a fixed price list for DPDP work, because it depends on how many places hold data.DPDP readiness add-on price or range.
What I can give you is the base cost of the work around it. A business website starts from ₹4,999. A web application starts from ₹9,999. A mobile app for Android and iOS starts from ₹14,999. A complete app system runs ₹2.5–10 lakh.
For a small brochure site, the DPDP changes are usually part of normal edits: a new notice page, a consent checkbox on the form, and a delete routine. For an app with accounts and a database, the work grows with the number of screens and data stores.
Our website cost guide explains what drives the price, so you can judge any quote you receive.
What should I do between now and May 2027?
You have time, but not so much that you can leave it. A simple order of work looks like this.
1. By December 2026: build your data map and find every place that holds personal data.
2. January to March 2027: rewrite the privacy notice, add consent and withdrawal to forms, and set retention periods.
3. April 2027: run a test. Ask a colleague to request deletion of their data, and check it actually disappears. Practise a breach drill.
4. Ongoing: keep one named person responsible for data questions, and keep a list of vendors that touch customer data.
This timeline follows the schedule suggested in the JK Tech Hub explainer above. If your site is old, built on a cheap template, or hosted on a shared plan with no access logs, moving it first makes the rest easier.
If you want a developer to check what your site collects today, start with our website development page, or tell us about the site on WhatsApp.
Frequently asked questions
Is DPDP compliance mandatory for small websites in India?
Yes, if the site collects personal data of people in India, even through one contact form.Size does not exempt you, though a small site needs far fewer changes than a large app.The main duties apply from 13 May 2027.
What happens on 13 November 2026 under the DPDP Rules?
The rules for registering Consent Managers start to apply. Most businesses have no direct duty on that date. It matters mainly to companies planning to become Consent Managers, so you can ignore it unless that is your plan. The binding date for ordinary businesses is 13 May 2027.
What is a Consent Manager under the DPDP Act?
A Consent Manager is a registered company that lets a person give, review and withdraw consent across many businesses from one dashboard. You do not need to use one. If you design consent records cleanly now, connecting to one later is easier.
What is the penalty for not following the DPDP Act?
Sources quote very large penalties for security failures and breaches, in the range of hundreds of crores of rupees. check the exact penalty figures against the official Act schedule before publishing.Penalties apply after the full rules start in May 2027.
Do I need a lawyer or a developer for DPDP compliance?
You need both. A lawyer tells you which duties apply to your sector and writes the notice wording. A developer changes forms, storage, logs and deletion routines so the notice matches what the system does. Doing only one of the two leaves a gap between what you promise and what your website actually does.
Ready to check your website against the DPDP Rules?
Send us your website link and a line on what data you collect. We will tell you what to change and quote it as a fixed price.
Get a website quote on WhatsApp
Reply within a few hours on WhatsApp. Fixed written quote within 48 hours.