In this article · 10 sections
- 1. Know what data you collect
- 2. Collect only what you need
- 3. Give clear notice and take consent
- 4. Publish a plain privacy policy
- 5. Secure the data
- 6. Handle requests
- 7. Be careful with WhatsApp and SMS marketing
- 8. Breaches
- Frequently Asked Questions
- Does DPDP apply to small businesses?
- Do I need a cookie banner?
- Is a privacy policy enough?
- Get your website compliant
The Digital Personal Data Protection (DPDP) Act, 2023 is India's main law for personal data. If your website collects names, phone numbers, emails, addresses or any other personal details — through enquiry forms, bookings, chat widgets or newsletters — it applies to you. The rules implementing the Act are being phased in, so the exact obligations and timelines should be checked with a legal professional. Meanwhile, these practical steps put any small business on the right track.
This is general information, not legal advice.
1. Know what data you collect
List every place your website collects personal data: contact forms, booking forms, chat widgets, newsletter sign-ups, payment pages, job applications, analytics cookies. Note where that data goes: email inbox, database, CRM, Google Sheets.
2. Collect only what you need
A taxi enquiry needs name, phone, pickup, drop and date — not date of birth or address proof. Fewer fields also mean more enquiries.
3. Give clear notice and take consent
- Near each form, explain briefly why you collect the data ("to reply to your enquiry and send a quote").
- For marketing messages (WhatsApp offers, newsletters), take separate, unticked opt-in consent.
- Link to your privacy policy.
4. Publish a plain privacy policy
Explain what you collect, why, who you share it with (hosting, payment gateway, email provider), how long you keep it, and how people can contact you to access, correct or delete their data.
5. Secure the data
- HTTPS across the whole site.
- Password-protected admin panels with strong passwords.
- No lead exports or backups left in public folders.
- Limit staff access to what they need.
- Delete old data you no longer need.
6. Handle requests
Provide an email or contact method for data requests and respond within a reasonable time. Keep a simple log of requests and actions.
7. Be careful with WhatsApp and SMS marketing
Message only people who opted in, offer an easy way to stop, and don't buy contact lists. Platform policies (WhatsApp Business) also require opt-in.
8. Breaches
If personal data is exposed (e.g., hacked database), the Act and its rules include duties to notify. Have a basic plan: who to call, how to secure the site, and how to inform affected people.
Frequently Asked Questions
Does DPDP apply to small businesses?
Yes, it applies to digital personal data processing generally, though some obligations and exemptions may vary by category. Check the latest rules.
Do I need a cookie banner?
Consent requirements apply to processing personal data. If you use tracking for marketing, a clear notice and consent approach is good practice.
Is a privacy policy enough?
No — you also need to follow it in practice: minimal data, consent, security and handling requests.
Get your website compliant
Joboo Web adds privacy notices, consent checkboxes and secure form handling. See our own privacy policy as an example or contact us.