A DPDP Checklist for Your Website and App

Anyone checking whether a business takes the Digital Personal Data Protection Act, 2023 (the DPDP Act) seriously will start with its website and app. That is where the Act's public-facing duties sit: the notice, the contact, the route to exercise rights and the means to withdraw consent. The main obligations commence on 13 May 2027.

What a visitor must be able to find

A notice with every consent request. Under Rule 3 of the DPDP Rules, 2025, the notice must make sense on its own, itemise the personal data and purposes, and link to ways to withdraw consent, exercise rights and complain to the Data Protection Board of India. A long privacy policy is background, not the notice. Trayambic's article on notices and consent goes further.

A named contact. Every data fiduciary, the business deciding why and how data is processed, must publish prominently on its website or app the contact details of someone who can answer data questions, and repeat them in every reply to a rights request (s.8(9); Rule 9).

A rights route. Rule 14 requires you to publish how a person can exercise her rights and what identifier you need, and to answer grievances within a published period of at most 90 days.

Cookies, SDKs and pixels

India has no cookie law; neither the Act nor the Rules mention cookies. But most cookies, software development kits (SDKs) and pixels collect identifiers and behaviour linked to a person, which is personal data. For analytics and advertising, in our view, the realistic ground is consent.

The Business Requirement Document for consent management, reported to have been issued by MeitY in June 2025, sketches a sensible model: essential cookies only by default, a first-visit banner offering accept, decline or customise, and a preferences screen for later changes. It calls itself "a guideline" and creates no legal duty.

A tool that processes data only on your instructions is your data processor: you remain responsible for it (s.8(1)) and need a contract with it (s.8(2)). A vendor that also uses the data for its own ends, as many advertising pixels do, is in our view a fiduciary alongside the site; our ad-tech study explains why. Either way, nothing should fire before consent, and withdrawing must be as easy as accepting (s.6(4)).

Children, forms, security and old accounts

Age. Anyone under 18 is a child. Processing a child's data needs verifiable parental consent (s.9(1); Rule 10), and tracking, behavioural monitoring and targeted advertising directed at children are barred (s.9(3)). The Rules allow the processing needed to confirm a user is not a child, so an age question comes first. Trayambic's article on children's data in ed-tech covers parental consent.

Forms. Consent is limited to data necessary for the purpose (s.6(1)). Every field you cannot justify is a liability.

Security and breaches. Rule 6 sets minimums: encryption or masking, access control, logs kept for at least a year, backups and security terms in processor contracts. A breach must be reported without delay to the Board and to each affected person, naming a contact for questions, with a detailed Board report within 72 hours (Rule 7), and to CERT-In within six hours under its 2022 Directions, which also require a designated Point of Contact. Trayambic's breach whitepaper sets out the clocks.

Dormant accounts. Under Rule 8 and the Third Schedule, e-commerce and social media platforms with at least two crore registered users in India, and online gaming intermediaries with at least 50 lakh, must erase a user's data after three years without engagement, warning her 48 hours before. Everyone else must erase data once its purpose is served (s.8(7)); Trayambic's retention whitepaper covers setting periods.

The checklist

1. 1.Show a standalone, itemised notice with every consent request, in English and your users' languages.
2. 2.Put the privacy contact in the footer, the app menu and every rights reply.
3. 3.Publish how to exercise each right or raise a grievance, and what identifier you need.
4. 4.Load only essential cookies and SDKs until the user opts in, and log each choice.
5. 5.Add a permanent "privacy choices" link that reopens the same options, so withdrawing takes no more steps than consenting.
6. 6.List every third-party script, SDK and pixel, note whether each vendor is your processor or a fiduciary, and sign processor contracts.
7. 7.Cut form fields to what each purpose needs and mark the rest optional.
8. 8.Keep marketing opt-ins unticked and separate from the "I agree to the terms" box.
9. 9.Ask age first; for under-18s, stop or run a verifiable parental consent flow, and switch off tracking and ad SDKs.
10. 10.Encrypt data in transit and at rest, restrict admin access and keep access logs for at least a year.
11. 11.Publish a monitored security contact and keep a breach runbook covering users, the Board and CERT-In.
12. 12.Check your user count against the Third Schedule, and set deletion periods for all account data.

Test it as a user would

Before May 2027, ask a colleague outside the project to sign up on a fresh phone, refuse everything optional, ask what data you hold on them and then withdraw consent. If asking or withdrawing takes longer than signing up did, start there. For the wider programme, Trayambic's whitepaper on DPDP compliance on a startup budget sets out the actions behind the screens.

Key takeaways

• Each consent request needs a standalone, itemised notice with links to withdraw, exercise rights and complain to the Board (Rule 3).
• Publish a privacy contact prominently and a route for rights requests, with grievances answered within at most 90 days (Rules 9 and 14).
• India has no cookie law, but analytics and advertising cookies, SDKs and pixels need consent, and the Business Requirement Document's cookie module is a guideline, not a rule.
• Ask age first: under-18s need verifiable parental consent, and tracking and targeted advertising directed at children are barred (s.9).
• Large e-commerce, social media and gaming platforms must erase data after three years of inactivity, with 48 hours' warning (Third Schedule).