Summary: India's Digital Personal Data Protection Act changes expectations for how websites collect and use personal data. Here are the practical basics.
The Digital Personal Data Protection Act is India's main personal data law, with its rules being implemented in phases. This is general information, not legal advice.
Core expectations
- Collect personal data for a clear purpose with appropriate notice and consent
- Collect only what you need
- Protect data with reasonable security safeguards
- Respect requests to access, correct or erase data
- Have a way to handle grievances
Website actions
Add clear notices to forms, update your privacy policy and review the tools that process visitor data.
Vendors
Ensure agencies and software providers handling data on your behalf have appropriate agreements.
FAQs
Does it apply to small businesses?
It applies broadly to organisations processing digital personal data.
Do we need consent for analytics?
Review your tracking setup with your adviser as rules are implemented.
Can data be stored outside India?
Cross-border transfers are generally permitted except to restricted countries; sector rules may differ.
