A privacy page is not compliance. Your forms, trackers, database, vendors, deletion process, backups and incident response must behave the way the page promises.
If your Indian business website collects a phone number, email address, IP address, account profile, payment detail, support ticket, analytics identifier or uploaded file, it creates legal and operational responsibilities. The owner decides why data is collected; the developer turns that decision into working software. Both sides therefore need a shared checklist.
This is not about adding eight links because a social-media post said so. Applicability depends on what the business does. A brochure site, SaaS dashboard, children’s service and online store do not have identical obligations.
First, understand the timeline
Depending on the business and data, existing IT/privacy rules, CERT-In cyber-incident directions, contracts and consumer/ecommerce rules may already apply. Security should not wait for a future date.
The November 13, 2025 notification phases provisions in. Core processing, notice, consent, rights and safeguards provisions are scheduled 18 months later—May 13, 2027. Preparation belongs in today’s roadmap.
The DPDP Act’s schedule provides a maximum penalty of ₹250 crore for failure to take reasonable security safeguards to prevent a personal-data breach. It is not an automatic fine for every missing privacy link, and the applicable amount depends on the contravention and formal process.
The practical website checklist
State the legal business or proprietor name, a usable contact route and the role responsible for privacy/grievances. Do not publish PAN, Aadhaar or other sensitive identifiers just to look official.
Explain what you collect, why, legal basis/consent where relevant, recipients, processors, retention, security, rights, withdrawal and complaint routes. The notice must match actual code and vendors.
Do not pre-tick optional choices. If optional analytics or advertising relies on consent, do not load it before acceptance. Reject should be as easy as accept, preferences should be changeable, and withdrawal should be recorded and honoured.
Offer a working route for access/correction/erasure or other applicable requests, verification, tracking, escalation and response ownership. Test that emails and forms actually reach a monitored queue.
Terms clarify service rules and risk allocation. Return, refund, cancellation, shipping, price and payment disclosures matter when you sell online; they are not a universal DPDP checkbox for a free brochure site.
Under the DPDP framework, a child is under 18. “No sexual content” does not settle the issue. Either design a defensible adult-only restriction and enforcement approach, or implement the applicable verifiable parental-consent and child-protection requirements.
Use access control, least privilege, secrets management, encryption in transit and where appropriate at rest, patching, monitoring, backups, processor contracts and an incident runbook. CERT-In directions can require specified cyber incidents to be reported within six hours and ICT logs retained securely for 180 days.
Set a purpose-based retention schedule for production records, logs, support tickets and backups. List hosting, email, analytics, payment and support processors; document contracts, locations, access and deletion behaviour.
A policy promise needs technical proof
| Promise | Evidence to verify |
|---|---|
| “We ask before analytics” | Fresh-session network log shows no optional tag request before opt-in. |
| “You can delete your account” | End-to-end test confirms deletion/anonymisation across primary data, queues and vendor workflows. |
| “Data is encrypted” | TLS configuration, database/storage settings and key-access controls—not marketing language. |
| “We retain data for 30 days” | Scheduled jobs, log rotation and documented backup expiry agree with the claim. |
| “Contact our grievance officer” | Monitored address/form, assigned owner, ticket trail and escalation procedure. |
Common mistakes
- Displaying a cookie banner while analytics and pixels already loaded.
- Copying another company’s privacy policy, entity name or vendor list.
- Calling every cookie “strictly necessary.”
- Claiming “bank-grade” or AES encryption without verifying implementation.
- Promising instant deletion while backups and third-party systems retain copies indefinitely.
- Publishing PAN/Aadhaar or unnecessary personal details in a public policy.
- Assuming a site is safe for children simply because it contains no adult content.
- Calling a website “fully DPDP compliant” without checking the phased law, data flows and business procedures.
A reliable implementation workflow
- Inventory: pages, forms, APIs, databases, cookies, SDKs, pixels, logs, uploads, payments, emails, hosts and backups.
- Classify: data, purpose, user type, recipient, location, retention and deletion path.
- Decide: operator details, grievance owner, children policy, vendors, retention periods and paid-service rules.
- Implement: notices, consent controls, rights workflow, security safeguards and incident playbook.
- Verify: inspect browser storage/network traffic, test every request workflow, scan dependencies, run tests and review production configuration.
- Maintain: re-audit when adding a form, tracker, vendor, mobile app, payment plan or new jurisdiction.
Copy this master AI prompt
Use this with a coding agent that can inspect your repository. Replace the bracketed fields. Do not paste secrets, identity documents or production customer data.
You are auditing and improving an Indian business website for privacy, security and consumer compliance. This is an evidence-based engineering review, not a request to generate generic policy text.
Business context:
- Website/app: [URL OR REPOSITORY]
- Legal operator: [LEGAL BUSINESS / PROPRIETOR NAME]
- Business type: [BROCHURE / SAAS / ECOMMERCE / MARKETPLACE / OTHER]
- Users and countries: [DETAILS]
- Paid plans: [YES / NO / PLANNED]
- Children under 18: [BLOCKED / ALLOWED / UNKNOWN]
- Hosting and service providers: [LIST]
- Grievance/privacy contact: [PUBLIC CONTACT]
Work in this order:
1. Inspect the entire codebase and deployed behaviour. Inventory every form, account field, API, database model, cookie, local-storage key, analytics/advertising tag, SDK, upload, payment flow, email provider, host, log and backup that handles personal data. Never expose secrets or customer data in your report.
2. Separate findings into:
A) obligations currently applicable,
B) DPDP provisions scheduled for May 13, 2027,
C) feature-dependent items (ecommerce, payments, children, marketing), and
D) recommended risk controls.
Do not present every recommendation as a mandatory law. Cite official Indian sources and state uncertainty.
3. Compare real behaviour with the privacy policy, terms, cookie notice, refund/cancellation pages and UI text. Flag copied names, invented entity types, inaccurate vendors, unsupported security claims, missing purposes, inconsistent retention and broken contact routes. Do not publish PAN, Aadhaar, credentials or unnecessary personal identifiers.
4. Implement safe code fixes where supported by evidence:
- block optional tracking until valid consent where consent is required;
- provide equally clear accept/reject controls and preference withdrawal;
- add accessible, unchecked consent fields where appropriate;
- add a working privacy/grievance request route;
- implement or document access, correction, export and deletion workflows;
- use secure cookies, CSRF protection, validation, rate limiting, least privilege, TLS and secure secret handling;
- remove plaintext or insecure fallbacks;
- add retention/deletion jobs only after confirming the business-approved schedule;
- add returns/refunds/cancellation disclosures only if the business model requires them;
- handle under-18 users according to the chosen, enforceable children policy.
5. Do not invent facts. Stop and mark BUSINESS CONFIRMATION REQUIRED for legal entity details, physical address, grievance owner, child-user decision, vendors, contracts, retention periods, backup expiry, cross-border arrangements or statements requiring counsel approval.
6. Verify the result. Run lint, tests and production build. In a clean browser session inspect cookies, storage and network requests before consent, after accept, after reject and after withdrawal. Test contact/grievance submissions, account export/deletion and mobile accessibility. Record what passed, failed or could not be tested.
7. Deliver:
- a prioritised findings table with severity, rule/source, evidence and fix;
- changed files and exact behaviour changed;
- a data-flow/vendor/retention table;
- remaining business and lawyer decisions;
- test results and screenshots/network evidence where possible.
Never claim “fully compliant” solely because pages were added. Compliance requires accurate business decisions, production verification, operational ownership and legal review.What AI cannot decide for the business
An agent can find trackers, inspect code, add controls and draft accurate documents. It cannot truthfully choose the registered operator, public address, grievance owner, intended child audience, lawful purpose, vendor contract terms, backup expiry or acceptable risk. Those decisions need the proprietor/company, operations/security owners and—where the risk warrants it—a qualified Indian lawyer.
Official sources
- Digital Personal Data Protection Act, 2023 — India Code
- Digital Personal Data Protection Rules, 2025 — MeitY
- DPDP commencement notification — Gazette/MeitY
- Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 — MeitY
- CERT-In Directions under section 70B — CERT-In
- Consumer Protection (E-Commerce) Rules, 2020 — Department of Consumer Affairs
Compliance is a maintained system, not a one-time page.
Make each public promise testable, assign an owner, and review it whenever the product changes.
Request a website audit →