DPDP Act Compliance Checklist for Small Business Websites in India 2026 What to Do Before May 2027

If your business has a website contact form, a WhatsApp customer list, a billing system, a school or clinic software, or even a simple sheet of customer phone numbers, you are handling personal data. And India now has a law that says how that data must be treated.

The Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025 and are being applied in phases. The next phase begins around 13 November 2026, and the main duties for most businesses begin on 13 May 2027. That sounds far away, but changes to websites, forms, software and daily habits take time. This guide gives you a simple checklist to start now.

This is general information, not legal advice. For your specific case, speak to a qualified lawyer.

The DPDP Timeline in Simple Words

• 13 November 2025: The Rules were notified and the Data Protection Board came into existence.
• Around 13 November 2026: The framework for Consent Managers begins. Most small businesses do not need to become a Consent Manager, so this date mainly matters to specialized companies.
• 13 May 2027: The main duties for businesses begin, including notice, consent, security safeguards, breach reporting, handling of rights requests and rules for children data.

The law provides for heavy penalties for serious failures, such as not keeping reasonable security safeguards. Starting early is the safest and cheapest approach.

Does This Apply to My Small Business

The law covers digital personal data, which means any information that can identify a person, such as a name, phone number, email address, photo, address, student record or patient record, when it is collected and used in digital form. It applies to businesses of all sizes that decide why and how personal data is used. Schools, clinics, coaching centers, gyms, shops, agencies and online sellers all handle such data.

Step 1 Find Out What Personal Data You Collect

You cannot protect what you do not know about. Make a simple list of every place where customer, student, patient or employee data enters or lives in your business.

• Website contact forms, booking forms and newsletter signups
• WhatsApp contact lists and broadcast lists
• Billing and ERP software, CRM and enquiry sheets
• School, hospital, lab, gym or exam software
• Google Forms and spreadsheets
• Cameras, biometric and attendance systems
• Ad lead forms from Facebook, Instagram or Google
• Job application forms and employee records

For each one, note what data you collect, why, where it is stored, who can see it and how long you keep it.

Step 2 Collect Only What You Need

Ask whether each field is really necessary. If you only need a phone number to reply to an enquiry, do not ask for an address, date of birth and ID number. Less data means less risk.

Step 3 Write a Clear Privacy Notice

Tell people, in plain language, what data you collect, why you collect it, how they can withdraw consent or complain and who to contact. Put the notice where people can see it before they give data, such as next to a form and on a Privacy Policy page of your website. Keep the language simple, and consider offering it in Hindi as well as English if your customers prefer it.

Step 4 Get Clear Consent

• Ask for permission clearly, for a specific purpose.
• Do not use pre ticked boxes.
• Keep marketing consent separate from consent needed to deliver a service.
• Make it as easy to withdraw consent as it was to give it.
• Keep a record of when and how consent was given.

If you send offers on WhatsApp, SMS or email, only message people who agreed. See our guides on WhatsApp Business app for small businesses and WhatsApp marketing versus SMS marketing, and our email marketing service.

Step 5 Update Your Website

• Add a Privacy Policy page and link it in the footer and next to every form.
• Add a consent checkbox with a short line on every form that collects personal data.
• Add a clear contact for questions and complaints about data.
• Review your analytics, ad pixels and chat widgets, and mention them in your notice.
• Use HTTPS, and remove old forms and plugins that you no longer use.

If you need a new website or want to fix an old one, see our website development service and our guide on how to create a website for your business.

Step 6 Protect Data with Reasonable Security

The law expects reasonable security safeguards. In practice, this means basic habits and good software.

• Use strong, unique passwords and turn on two step login where possible.
• Give staff access only to the data they need, with separate logins for each person.
• Keep software, plugins and the website updated.
• Take regular backups and test that they work.
• Protect computers, phones and Wi-Fi.
• Do not share data through random WhatsApp groups or personal emails.
• Remove access immediately when an employee leaves.

Read our guide on how to protect your business website from cyber attacks. For software that stores student, patient or customer records, such as school management software, hospital management software, pathology lab software, gym management software, online exam software and CRM software, ask the provider how access control, backups and activity records work.

Step 7 Prepare a Breach Plan

A data breach means personal data is lost, stolen or seen by someone who should not see it. Prepare in advance.

• Decide who in your team handles a breach.
• Write down the steps: find the cause, stop it, check what data was affected and inform the right people.
• Keep contact details of your software provider and your IT support.
• Practise once, so that nobody panics on the day.

Step 8 Be Ready to Handle Requests from People

People have rights over their data. They can ask what data you hold, ask for corrections, ask you to delete it where appropriate and raise a complaint. Decide who will receive such requests, how you will verify the person and how quickly you will respond. A simple email address for data queries and a clear process are a good start.

Step 9 Be Careful with Children Data

The rules require verifiable consent from a parent or guardian before processing the data of children under 18, with some exceptions. If you run a school, coaching center, tuition, kids activity class, gym with junior members or an exam platform, plan this carefully. Collect only what is necessary and avoid using children data for tracking or targeted ads.

Step 10 Check Your Vendors and Tools

Many businesses share data with outside companies, such as software providers, SMS and WhatsApp platforms, payment gateways, cloud storage, ad platforms and agencies. Ask each vendor how they protect data, where it is stored and what happens if you stop the service. Keep agreements in writing. If you are choosing a new provider, read our guide on how to choose a software development company and our comparison of cloud software versus on premise software.

Step 11 Decide How Long You Keep Data

Do not keep personal data forever. Decide how long you need each type of data, and delete or anonymize it when the purpose is over, unless the law requires you to keep it. Old enquiry sheets, expired leads and unused accounts are good places to start cleaning.

Step 12 Train Your Team

Most data problems come from small human mistakes. Teach your staff to avoid sharing customer data casually, to use only approved tools, to recognize fake links and to report problems quickly.

Simple 90 Day Plan

• Days 1 to 30: List all personal data you collect, remove what you do not need and choose a person responsible for data questions.
• Days 31 to 60: Update your Privacy Policy, forms and consent text. Tighten passwords, access and backups.
• Days 61 to 90: Prepare your breach plan and request handling process, check vendors and train your team.
• Then: Review everything every few months and before May 2027.

Quick Checklist

• Data map of where personal data is collected and stored.
• Only necessary fields in forms.
• Clear privacy notice on the website and near forms.
• Clear, unticked consent with a record.
• Marketing messages only to people who agreed.
• Strong passwords, separate logins and updated software.
• Regular tested backups.
• A written breach plan and a named person in charge.
• A simple process for data requests.
• Parent or guardian consent process for children data.
• Vendors checked and agreements in writing.
• A data retention and deletion habit.
• Team training done.

Common Mistakes to Avoid

• Thinking the law applies only to big companies.
• Copying a privacy policy from another website without checking if it matches your business.
• Using pre ticked consent boxes.
• Buying phone number lists and sending bulk messages.
• Sharing one login among all staff.
• Storing customer data in personal phones and random chat groups.
• Waiting until the last month to start.
• Assuming your software provider will handle everything for you.

Get Technical Help from Agho IT Solutions

At Agho IT Solutions in Lucknow, we help businesses with the technical side of data protection, such as website forms, privacy pages, access control, backups and business software setup, along with digital marketing services that respect customer consent. For the legal interpretation of the law, please consult a qualified lawyer. You can also read our earlier guide on India data protection rules for businesses.

Call us on +91-9194046587 or visit us at L-III/77, Sector-D, Aliganj, Lucknow, Uttar Pradesh 226024. You can also contact us online for a free consultation.

Frequently Asked Questions

When do the main DPDP duties start for businesses?

The main duties, including notice, consent, security safeguards, breach reporting and rights handling, begin on 13 May 2027, which is 18 months after the Rules were notified in November 2025.

What happens on 13 November 2026?

The framework for Consent Managers begins. Most small businesses do not need to become a Consent Manager, so the date mainly matters to specialized companies, but it is a good reminder to start preparing.

Does the DPDP Act apply to a small shop or clinic?

It applies to businesses that handle digital personal data, whatever their size. A clinic, school, gym or shop that stores customer details digitally should prepare.

Do I need a privacy policy on my website?

Yes, if you collect personal data through your website. It should explain in plain language what you collect, why, how people can withdraw consent or complain and who to contact.

Can I keep sending WhatsApp offers to my old customers?

Only to people who agreed to receive them. If you are unsure, ask for fresh consent and give an easy way to stop messages.

What should I do first?

Make a list of where you collect and store personal data, remove what you do not need, then update your privacy notice and consent forms, and tighten your security.