Websites & apps
DPDP Compliance for Websites: Forms, Cookies and Privacy Notices
By Kaivan Tech · Published 4 November 2026 · Updated 4 November 2026 · Checked against the official Act and Rules
Short answer
To make a website DPDP-compliant, show a standalone notice listing the personal data you collect and why, collect only what each form needs, get clear opt-in consent for non-essential uses such as marketing and tracking, make withdrawal as easy as opting in, secure and log access to submissions, and publish how people can access, correct or erase their data and raise a grievance.
- Notice rules
- Rule 3: standalone, plain language, itemised data and purposes
- Consent standard
- Free, specific, informed, unconditional, unambiguous, with a clear affirmative action (Section 6(1))
- Grievances
- Answered within 90 days at most (Rule 14)
- Applies from
- 13 May 2027
Contact, enquiry and lead forms
Forms are where most websites collect personal data. For each one, ask what you collect, why, where it goes and how long you keep it.
- Remove fields you do not need: consent is limited to data necessary for the purpose (Section 6(1))
- Link a notice at the point of collection that names the data and the purpose
- Use an unticked checkbox for marketing; do not make it a condition of the enquiry
- Check where submissions go (CRM, email, sheets, WhatsApp tools) and secure each destination
- Delete enquiries that never converted once the purpose is served (Section 8(7))
Cookies, analytics and tracking pixels
The DPDP Act does not mention cookies by name, but cookies and pixels that collect identifiers to track or profile visitors process personal data. Where you rely on consent for them, it has to meet the Section 6 standard: a clear affirmative action, not a pre-ticked box or a banner that assumes acceptance by scrolling.
- Inventory every tag: analytics, ad pixels, heatmaps, chat widgets, embedded videos
- Load non-essential tags only after opt-in, and stop them when consent is withdrawn
- Offer “Reject” as prominently as “Accept”
- Keep a record of what each visitor agreed to and when
What your privacy notice must contain (Rule 3)
Rule 3 requires the notice to be understandable on its own, in clear and plain language, and to include at least:
- An itemised description of the personal data collected
- The specified purposes, and the goods, services or uses they enable
- A link to your website or app and other means to withdraw consent, as easily as it was given
- How to exercise rights under the Act
- How to make a complaint to the Data Protection Board
Rights requests and grievances
People can ask for a summary of their data and who it was shared with (Section 11), correction, completion, updating and erasure (Section 12), and grievance redressal (Section 13). Rule 14 requires you to publish how to make these requests and to respond to grievances within a period not exceeding 90 days. Build a simple request form, an identity check and an internal workflow that updates every connected system.
Need this done in your own systems?
Kaivan Tech assesses websites, apps and business systems against the DPDP Act and Rules, then implements the fixes: consent and notice flows, rights workflows, logging, retention and breach readiness.
See our DPDP compliance servicesFrequently asked questions
Does the DPDP Act apply to my website?+
Yes, if your website collects personal data of people in India, such as names, emails or phone numbers in a contact form, or identifiers through cookies and tracking, the processing is covered by the DPDP Act, 2023.
Do I need a cookie banner under the DPDP Act?+
The Act does not name cookies, but where you rely on consent for cookies or pixels that process personal data, that consent must be free, specific, informed, unconditional and given by a clear affirmative action. A consent banner with a real choice is the usual way to achieve that.
Is a privacy policy enough for DPDP compliance?+
No. A notice is required, but DPDP also needs valid consent flows, security safeguards, breach procedures, rights and grievance handling, and deletion of data that is no longer needed.
How long can I keep enquiry form data under DPDP?+
Only as long as needed for the purpose it was collected for, unless another law requires longer retention (Section 8(7)). Set a retention period and delete stale enquiries.
How quickly must I answer a DPDP grievance?+
Rule 14 requires Data Fiduciaries to respond to grievances within a reasonable period not exceeding 90 days.
Related DPDP guides
Sources
This guide explains the law in general terms and is not legal advice. Have a qualified Indian legal professional confirm how the Act and Rules apply to your organisation.