DPDP Act Compliance & Data Protection
DPDP Act compliance means collecting personal data only after a clear notice and free consent, honouring access, correction and erasure requests, keeping reasonable security safeguards, and reporting breaches to the Data Protection Board. The Rules were notified on 13 November 2025, with core duties applying from 13 May 2027.
For Indian website owners who collect names, emails, phone numbers or payments and need to know what the Act and Rules require, and by when.
Jaipur · IN
- In business
- 21+ yrs
- Reply time
- <60 min
- Clients
- 12K+
- Billing
- INR + GST
Last editorial update: 14 November 2026. Prices follow the dated sources on this page; checkout confirms current charges.
What DPDP Act compliance means for a website
DPDP Act compliance is a sequence of duties rather than a certificate: publish the notice, record consent, answer rights requests, secure the data, and report a breach. The Digital Personal Data Protection Act governs digital personal data, and it assigns those duties according to who decides what happens to the data.
- Data fiduciary: The person or company that decides why and how personal data is processed. Your site is the fiduciary for its own forms.
- Data processor: A party that handles personal data on the fiduciary’s instructions. WebJi® is the processor for site data stored on your plan.
- Data principal: The individual the data is about — the visitor who filled in your form or placed an order.
When does the DPDP Act apply to your website?
The DPDP Act applies as soon as a website processes personal data, and there is no turnover or headcount threshold. A three-page site with one enquiry form is in scope the same way a marketplace is, because the trigger is processing personal data, not the size of the business.
Two carve-outs exist: personal and domestic use, and data an individual has made public themselves. A business site can claim neither, so a contact form, newsletter sign-up, checkout or analytics cookie that identifies a person in India brings the site under the Act.
DPDP compliance deadline: 13 May 2027
The core duties — notices, rights handling, security safeguards and breach reporting — come into force on 13 May 2027, 18 months after the DPDP Rules were notified on 13 November 2025. The Act itself received assent in 2023, so the duties were already law while the Rules were being written.
| Date | Milestone |
|---|---|
| 2023 | The Digital Personal Data Protection Act receives assent |
| 13 November 2025 | DPDP Rules notified, starting an 18-month runway |
| 13 November 2026 | Consent-manager framework opens |
| 13 May 2027 | Core duties in force: notices, rights handling, security safeguards, breach reporting |
What a website must change for DPDP compliance
The DPDP work on a website sits in three places — the form, the policy page and the admin — and a small business site can usually finish it in one pass. Each item below maps to a duty in the Act.
- Notice: at each collection point, name the data taken, the purpose, and how to withdraw consent.
- Consent: opt-in, purpose-specific and as easy to withdraw as to give — no pre-ticked boxes.
- Cookies: a cookie layer that lets a visitor refuse non-essential cookies and still use the site.
- Privacy policy: list purposes, retention periods and every processor you share data with.
- Rights channel: a named owner and a logged reply for every request.
- Security safeguards: HTTPS, least-privilege admin access, unique logins and tested backups.
- Breach runbook: a plan that reaches the Data Protection Board and affected users quickly.
HTTPS is part of the safeguard duty; every WebJi® hosting plan includes a free certificate, and paid options are on SSL certificates. For an outside review of logins, plugins and malware exposure, see website security services.
Data principal rights and how to request them from WebJi®
A data principal can ask for a copy of their data, correction, completion and erasure, and can nominate someone to exercise those rights. They can raise a grievance with the fiduciary first and with the Data Protection Board after.
To exercise these rights with WebJi®, ask through the client area or a support ticket, as the privacy policy sets out. Deletion covers what statutory retention does not require; billing records that tax law mandates are kept. For anything unclear, contact us first.
Penalties under the DPDP Act
DPDP penalties sit in the Act’s schedule and are imposed by the Data Protection Board after an inquiry, so no fine is automatic; the highest cap is ₹250 crore.
| Breach | Cap |
|---|---|
| Failure to take reasonable security safeguards | ₹250 crore |
| Failure to notify a breach, or breach of children’s-data duties | ₹200 crore |
| Breach of the extra duties on a Significant Data Fiduciary | ₹150 crore |
| Any other breach of the Act | ₹50 crore |
Does DPDP compliance require data to stay in India?
No. The DPDP Act permits personal data to be transferred outside India except to countries the Central Government restricts by notification, so it sets no local-storage mandate of its own. Sector regulators can still impose their own localisation rules, so check yours before you pick a server region. The wider rules are covered in data localisation rules for Indian websites.
What WebJi® does with client data
Webji Hosting Pvt. Ltd. is the data fiduciary for account, billing and support records, and a data processor for website data held on your plan. The registered office is Shop #27, Ajmer Road, Tagore Nagar, Jaipur, Rajasthan 302021.
Billing records are kept for the period tax law requires, and hosting data is removed at service end. The contract layer is in the terms of service.
Frequently asked questions
Does my small website need to comply with the DPDP Act?
Yes, if it collects personal data from people in India through a form, newsletter, checkout or analytics cookie. The Act sets no size threshold; only personal and domestic use is exempt, along with data a person has made public themselves.
Is my hosting provider responsible for my website’s DPDP compliance?
No. The website owner is the data fiduciary for its own forms and carries the notice, consent and rights duties. A hosting provider such as WebJi® is a data processor acting on that owner’s instructions for site data stored on the plan.
Is a cookie banner enough for DPDP compliance?
No. A cookie layer that lets visitors refuse non-essential cookies is one item. A site also needs a notice at every collection point, withdrawable consent, a privacy policy naming purposes and retention, a rights-request route, security controls and a breach runbook.
Who decides DPDP penalties?
The Data Protection Board imposes penalties after an inquiry, within the caps in the Act’s schedule, so no fine is automatic. The highest cap, ₹250 crore, applies to failing to take reasonable security safeguards.
Can WebJi® delete all my data when I close my account?
Hosting data is removed at service end, and erasure requests cover everything statutory retention does not require. Billing records that tax law mandates are kept for the required period. Raise the request through the client area or a support ticket.
Last editorial update: 14 November 2026. Prices follow the dated sources on this page; checkout confirms current charges. This page is general information, not legal advice.
Ready to get started with WebJi®?
Join 12,000+ businesses across India and overseas. Free migration* (subject to terms & approval), INR pricing and 24/7 email support in Hindi & English — average first reply under 60 minutes.