DPDP Rules and your website: what Indian companies need to change before May 2027

Most of India’s new data protection law takes effect in May 2027, and your website is likely where you collect the most personal data. Every contact form, demo request, gated whitepaper, careers page, chat widget and analytics script on it collects personal data. Under the Digital Personal Data Protection (DPDP) Act and Rules, each of these will need a clear notice, proof of consent, an easy way to withdraw, and a plan for deleting the data later.

Most corporate websites in India were not built with any of this in mind. This post explains what the law is, whether it applies to you (it almost certainly does), what has to change on your website, and what to do before and after it comes into force.

What is DPDP?

DPDP is India’s first comprehensive privacy law. It governs how organisations collect, use, store and delete personal data held in digital form. It has two parts:

• The DPDP Act, 2023 sets the principles: process personal data only for a lawful purpose, with notice and consent, and only as much as the purpose needs.
• The DPDP Rules, 2025 set out how to comply in practice: what a notice must contain, how fast to report a breach, which security measures are expected, and when data must be deleted.

The law uses two terms you will see often. A Data Fiduciary is the organisation that decides why and how data is processed (your company). A Data Principal is the person the data is about (your website visitor, lead, customer or job applicant).

The Rules come into force in three phases (Treelife):

1. 14 November 2025: Rules notified. The Data Protection Board of India was set up and the penalty framework took effect.
2. 13 November 2026: Registration of Consent Managers opens. These are platforms people can use to give, manage and withdraw consent across companies.
3. 13 May 2027: Full compliance becomes mandatory. This includes notices and consent, security safeguards, breach reporting, data deletion and user rights.

The May 2027 date could move earlier. In January 2026, MeitY asked industry for views on cutting the compliance window from 18 months to 12. Officials said no final decision had been made (Storyboard18). Plan for May 2027 as the latest possible date, not the target.

Should you care?

Yes, if your website collects personal data from anyone in India. The law applies to every organisation that processes digital personal data of people in India, whatever its size or sector. It also covers foreign companies that offer goods or services to people in India.

“We’re B2B, so this doesn’t apply to us” is a common mistake. DPDP has no exemption for business contacts. A procurement head’s name, work email and phone number are personal data. So is the CV a candidate uploads to your careers page. If your site generates leads, it handles personal data.

The penalties are high. Maximum penalties per violation under the Rules (Treelife):

Violation	Maximum penalty
Failure to take reasonable security safeguards	₹250 crore
Failure to notify a breach to the Board or affected people	₹200 crore
Breach of obligations around children’s data	₹200 crore
Any other violation of the Act or Rules	₹50 crore

There’s also a commercial reason. Enterprise buyers, global clients and investors already ask about privacy in vendor questionnaires and due diligence. If your website has visible gaps, they will notice.

What changes on your website

Your website’s design and tech stack mostly stay the same. What changes is everything that touches personal data. Here are the eight areas to review.

1. Forms need their own notice and consent

Every form that collects personal data needs a clear notice at the point of collection. Under Rule 3, the notice must stand on its own: a line in your privacy policy or terms of use is not enough. It must list each piece of data you collect and why, and link to where people can withdraw consent, exercise their rights and complain to the Data Protection Board.

In practice:

• Ask for consent separately for each purpose. “Contact me about this enquiry” and “Send me marketing emails” need separate checkboxes.
• No pre-ticked boxes, and don’t bundle consent into the submit button.
• Collect only what the purpose needs. If you’re asking for a phone number, company size and job title just to send a whitepaper, cut the extra fields.
• Under the Act, people can ask to read the notice in English or any of the 22 languages in the Eighth Schedule of the Constitution. Plan for a language switch on notices.

2. You must be able to prove consent

If someone disputes consent, your company has to prove it was given. Every form submission should save a consent record: the timestamp, the exact version of the notice shown, what was agreed to, and where it was collected. Most WordPress, HubSpot and custom form setups don’t store this today.

3. Withdrawing must be as easy as consenting

If it took one click to opt in, it should take about one click to opt out. That usually means a “Manage my preferences” page linked from the footer and from every email. Withdrawal has to update the CRM and marketing tools too, not just the website database.

4. Tracking scripts need consent first

The law doesn’t mention cookies by name. It also has no broad “legitimate interest” basis like GDPR does. Most privacy lawyers therefore advise getting consent before tracking that can identify a visitor. That covers tools like Google Analytics, LinkedIn Insight Tag, Meta Pixel, HubSpot tracking, session recorders and chat widgets.

The consent banner must actually block these scripts until the visitor agrees, and it must keep a record of the choice. A banner that just displays a message while everything loads in the background won’t meet this.

5. A working route for user rights

People can ask to see, correct or delete their data, nominate someone to act for them, and raise grievances. Your site needs a clear way to make these requests, such as a form or a published contact. Behind it, you need a process that finds the person’s data across your website, CRM and inboxes. Requests must be answered within 90 days.

6. Retention rules and automatic deletion

Personal data must be erased once its purpose is served, unless another law requires you to keep it. On most websites, old enquiries pile up in the CMS database, form plugin logs, email inboxes and spreadsheets for years. Set a retention period for each type of data and automate the deletion. Rule 8 has separate deletion timelines for large e-commerce, gaming and social media platforms, but every organisation must follow the basic principle.

7. Hosting and security

Rule 6 requires reasonable security safeguards. These include encryption or masking of personal data, access controls, monitoring, backups, and logs kept for at least one year. Your site, CMS admin, form storage, staging environments and backups should be reviewed against this.

8. A breach response plan

If personal data is breached, you must inform the Data Protection Board without delay and send a detailed report within 72 hours. Affected people must also be told in plain language. For a website, that means having monitoring and alerts in place and knowing who to call when something goes wrong.

If your site collects data from children (anyone under 18), you also need verifiable parental consent. Most B2B sites don’t, but check sign-up and event forms.

How it will affect your business

The law goes beyond your website. It changes how marketing, sales, HR and your vendors handle the data your website collects.

Team	What changes
Marketing	Fewer tracked visitors at first, since some people will decline the consent banner. Attribution reports will show gaps. Email lists built without clear consent need to be reconfirmed or retired.
Sales	Leads come with a consent record and a purpose. Using a demo-request lead for an unrelated campaign needs its own consent.
HR	Careers pages and applicant tracking systems need notices, retention periods and a plan to delete unsuccessful candidates’ CVs.
IT and security	Encryption, access control, log retention and breach monitoring across the website, CMS, CRM and backups.
Legal and procurement	Data processing agreements with every vendor that touches the data: your web agency, hosting provider, CRM, analytics and form tools.

The last point is easy to miss. Your company stays responsible for personal data even when a vendor handles it. If your agency hosts your site or your form plugin stores submissions, any breach on their side is still your liability. Expect your contracts and vendor reviews to tighten.

There’s an upside too. Consented leads are more engaged. Collecting less data reduces the damage if a breach happens. And a clean privacy setup makes enterprise sales and due diligence go faster.

Next steps

Website changes take time to design, build, test and get through legal review, so start well before the deadline. Here is a practical order.

Now to February 2027: find and fix the gaps

1. Map your data. List every form, script, embed and integration on the site. Note what personal data each collects, why, where it goes and how long it stays there.
2. Remove what you don’t need. Cut unnecessary form fields, unused tracking pixels and old integrations. Data you never collect can’t be breached.
3. Rewrite notices with legal. Write a short, standalone notice for each purpose, and plan how you’ll offer it in other languages.
4. Rebuild consent. Use a consent banner that blocks scripts until the visitor agrees, separate checkboxes for each purpose, consent records, and a preference centre linked to your CRM.
5. Build the rights and retention setup. Add a request form and an internal process to handle requests, and set up automatic deletion jobs.
6. Harden hosting. Review encryption, admin access, staging environments, backups and log retention. Set up alerts for breaches.
7. Sign data processing agreements with your agency, hosting provider and SaaS tools.

March to May 2027: test and go live

• Test every form and consent flow from start to finish, including withdrawal and deletion.
• Check that analytics and pixels really stay off until consent is given. Use a fresh browser and look at the network requests.
• Run a mock breach drill against the 72-hour reporting window.
• Send a notice to people whose data you collected before the law took effect.

After the law is in force: keep it running

• Treat privacy as part of every release. Each new form, landing page, campaign tool or plugin gets a privacy check before launch.
• Version your notices. Every time a notice changes, update the consent records.
• Review quarterly. Check tracking scripts, retention jobs, open user requests and vendor access.
• Watch for updates. MeitY may still change timelines, and the Data Protection Board’s decisions will show how the law is applied in practice.

How Supercode can help

We design, build and maintain websites for B2B enterprises, and we’re adding DPDP readiness to every build and retainer. Our DPDP website audit maps every point where your site collects data and lists the gaps by risk. We then fix them: consent-logged forms, a consent banner that blocks scripts until the visitor agrees, preference centres linked to your CRM, rights-request flows, retention automation, and hardened hosting.

Want to know where your site stands? Talk to us about a DPDP readiness review before the May 2027 deadline.

This article is for general information and isn’t legal advice. Work with your legal or privacy counsel on notice wording, consent design and contracts.

Sources

• DPDP Rules, 2025: a deep dive — Treelife
• MeitY seeks industry views on fast-tracking DPDP rollout — Storyboard18