This article is general information, not legal advice. Please check how the DPDP Act and Rules apply to your business with your legal adviser.
If you run a manufacturing unit, a hospital, a school or a real estate firm, your website probably collects personal data every day: names, mobile numbers, email addresses and CVs.
Under the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025, how your website handles that data matters. Most of the work is practical, and the same fixes that reduce compliance risk also help you capture more leads and earn more trust.
Where things stand today
The DPDP Rules, 2025 were notified on 13 November 2025, as the Rules as notified show (also listed on the MeitY website). Most of the main obligations, including notice and consent, apply eighteen months after that date. A study reported by Times Now on 17 October 2026 puts that date at 13 May 2027. The same report notes the government has discussed bringing some deadlines forward, so check for updates.
The same study scanned the public websites of 1,680 Indian companies. It found that 73.7% had no consent banner detected and 19.8% had no privacy notice link at all. The report notes this was an automated external scan, not an audit or a random sample. Even so, it signals that many company websites still have basic gaps.
Why this is about more than compliance
Careless data handling rarely comes alone. A form with no clear notice tends to have no clear owner. Tracking scripts that load before consent often slow pages down. An old privacy policy usually sits next to contact details nobody checks.
Visitors notice. A patient, parent, buyer or job applicant who sees a clear notice and a working contact route is more likely to trust you with their details. Fixing DPDP gaps and fixing lead leaks are often the same job.
Six website gaps to look for
1. Forms that collect personal data with no notice or consent wording
Rule 3 of the DPDP Rules sets out what a notice should contain. The Rules require it to be clear, in plain language, and understandable on its own. At a minimum it should give an itemised description of the personal data collected and the specified purpose for which it is processed.
Look at your enquiry, appointment, admission and careers forms. Does each say, near the submit button, what you collect and why? Does it link to your privacy notice? Careers forms that take CVs with no explanation are a common gap.
2. No consent banner, with tracking scripts firing before consent
Many sites load analytics, advertising pixels and chat widgets as soon as a page opens. If these tools process personal data, businesses should check with their legal adviser whether consent is needed before they run.
Rule 3 also says the notice should tell people how to withdraw consent, with the ease of doing so comparable to the ease with which they gave it. In practice, a simple way to change or withdraw a choice later, and a banner where declining is as clear as accepting, are sensible steps to discuss with your legal adviser. A banner that loads scripts only after consent can also make pages faster.
3. An outdated or missing privacy policy, and no grievance or contact route
A privacy policy written years ago by an agency, or copied from a template, may not reflect the Act. The Rules require businesses to prominently publish on their website the business contact information of a person who can answer questions about how personal data is processed (Rule 9). They also require businesses to publish how people can exercise their rights, and the period for responding to grievances (Rule 14).
Check that your privacy notice is easy to find, describes what you actually do today, and gives a contact route someone monitors.
4. Form data sitting in inboxes and spreadsheets with no owner
Where does an enquiry go after someone clicks submit? Often it lands in a shared inbox or a spreadsheet on someone’s laptop, and nobody knows who can see it or when it is deleted.
This is a data protection question and a sales question, because enquiries with no owner get answered late or not at all. Decide who owns form data, where it is stored, who can access it, and how long you keep it.
5. Broken forms and links silently losing enquiries
A form that stopped sending email after a plugin update, or a captcha that blocks real users, fails silently. The visitor gives up, and you never know the enquiry existed. Regular testing catches this, along with broken links to your privacy notice.
6. Nobody in house owns the website since the agency left
This is often the root cause. The agency contract ended, and now nobody is responsible for updates, forms or policies. Assign one person inside the company as the website owner, even if technical work is outsourced. Ongoing secure website maintenance keeps the site, its forms and its security updates under watch.
The 15 minute owner checklist
No technical skills needed. Open your website and go through these steps.
Minutes 1 to 3: Forms
1. Open every form on the site: enquiry, contact, careers, appointment, admission, brochure download.
2. Check whether each form says what data it collects and why, and links to a privacy notice.
Minutes 4 to 6: Consent banner
3. Open the site in a private browser window. Is there a consent banner?
4. Is declining as clear as accepting? Can you find a simple way to change or withdraw your choice later?
Minutes 7 to 9: Privacy notice and contact
5. Find the privacy notice link in the footer. Does it open?
6. Is the contact person or email still current, and does someone check it?
Minutes 10 to 12: Test the forms
7. Submit a test enquiry and a test job application.
8. Time how long the right person takes to receive and respond.
Minutes 13 to 15: Ownership
9. Ask your team: who stores form data, who can see it, and when is it deleted?
10. Write down who owns the website today. If you cannot, that is your first action.
List the gaps, then speak to your legal adviser about policy and your technical partner about fixes.
Fixing the gaps the right way
Some fixes are quick, such as adding notice wording to forms. Others need deeper work, such as a properly configured consent banner and secure form handling. For older sites, a website modernisation project can rebuild forms and tracking the right way. Website security hardening protects the personal data your forms collect. For a wider security framework, ISO 27001 consulting and readiness helps put the right controls in place.
Operating in the Gulf too? Our post on WordPress website development and GDPR compliance in the UAE covers related ground.
How Hyrrokkin can help
We are not a typical web design company. Hyrrokkin works on both technology and marketing to help serious businesses grow, with offices in India and the UAE. Our full website audit checks 400+ parameters across lead capture, security hardening, content and performance. We also offer a complimentary report with the top 5 findings on your site, ranked by business impact.
Request a complimentary website audit summary. Fill in the form on our contact page or email us at [email protected]. We will then set up a meeting on Microsoft Teams to walk you through the findings.
Frequently asked questions
When do the DPDP obligations for websites apply?
The DPDP Rules, 2025 were notified on 13 November 2025. Rule 3 on notice, along with most other main obligations, comes into force eighteen months after that, which the study reported by Times Now places on 13 May 2027. Please confirm the dates that apply to you with your legal adviser.
Does my business website need a consent banner under the DPDP Act?
If your website runs analytics or advertising scripts that process visitors’ personal data, you may need consent before they run. The Rules also say withdrawing consent should be comparable in ease to giving it. Businesses should check their specific setup with their legal adviser.
Is a privacy policy on the website enough?
Usually not on its own. The Rules require a clear, specific notice, published contact details for questions, and a way to exercise rights and raise grievances. Your forms, banner and internal data handling should also match what the policy says.
We are a B2B manufacturer. Does this apply to us?
B2B websites still collect personal data, such as a buyer contact’s name and number, and CVs from applicants. How the Act applies to you is a question for your legal adviser, but reviewing your forms is sensible either way.
