DPDP Act Compliance: The Engineering Checklist for Your Website and App Before the 2026 Deadline
India's DPDP Rules roll out in phases. The Consent Manager framework becomes operational on 13 November 2026, and substantive obligations covering notice, consent, security safeguards, breach reporting and individual rights become enforceable on 13 May 2027. Penalties reach ₹250 crore per violation. There is no turnover threshold and no exemption for small businesses. If you collect a name, phone number or email through any digital channel from someone in India, you are a Data Fiduciary, and most of the work required is engineering work rather than legal work.
Plenty of law firms have explained the DPDP Act. Very few people have explained what it means for your codebase. That gap is the reason so many Indian businesses believe they are compliant when their systems say otherwise.
This guide is written for the person who actually has to build it. The developer, the CTO, the founder who owns the website. It covers exactly what changes in your forms, your database, your CRM, your logs and your vendor contracts, with a sequence you can start this week and finish comfortably before the deadline.
Quick Stat (2026): The DPDP Act carries penalties of up to ₹250 crore per violation, with no minimum turnover, no employee count exemption and no carve-out for small businesses. A single contact form on your website makes you a Data Fiduciary.
1. The DPDP Timeline: What Is Live and What Is Coming
The Digital Personal Data Protection Rules, 2025 were notified by MeitY on 13 November 2025, with a phased rollout across three dates.
| Date | What happens |
|---|---|
| 13 November 2025 | Data Protection Board constituted. Digital complaint filing goes live. |
| 13 November 2026 | Rule 4, the Consent Manager framework, becomes operational. Registration requires Indian incorporation and a minimum net worth of ₹2 crore. |
| 13 May 2027 | Substantive compliance: notice, consent, security safeguards, breach reporting, retention limits, individual rights and children's data. Full penalty regime. |
The mistake almost everybody is making: most businesses are treating May 2027 as the deadline and pushing the work into next year, which is a sequencing error. Consent flows, vendor contracts, data mapping and deletion workflows take months to build and test, 2026 is the build year, 2027 is when it gets inspected. If your systems cannot represent consent as a proper record by November 2026, you have roughly six months to build something that normally takes twelve.
2. Does This Apply to Your Business?
There is no minimum turnover, no employee count exemption and no small business carve-out. Any organisation that digitally processes the personal data of people in India is a Data Fiduciary, that includes startups, SMEs, MNCs, NGOs and government bodies alike. You are in scope if your website or app does any of the following:
- Has a contact form, enquiry form or newsletter signup
- Runs a login, account or user profile system
- Stores customer records in a CRM
- Sends marketing emails, SMS or WhatsApp messages
- Uses analytics, advertising pixels or session recording
- Collects data for KYC, billing or onboarding
- Serves users in India from servers located outside India
That last point matters more than people expect, the Act applies beyond India's borders wherever goods or services are offered to individuals in India. If you run a services business with a contact form and a CRM, which describes most companies reading this, you are a Data Fiduciary and these obligations are yours.
3. Consent: What Your Forms Have to Look Like Now
This is where the most visible engineering work sits. Under the Rules, consent must be free, specific, informed, unconditional and unambiguous, given through a clear affirmative action.
What is no longer acceptable:
- Pre-ticked checkboxes
- Bundled consent covering several purposes at once
- Consent buried inside terms and conditions
- 'By submitting this form you agree to our terms' as the only consent statement
- A prominent Accept button with a hidden or hard-to-find Reject
- Consent walls that deny service for refusing optional data
- Withdrawal that is harder than granting
A non-compliant consent statement, the kind currently sitting on thousands of Indian business websites, reads simply 'By submitting this form, you agree to our terms and conditions.' A compliant one instead names the purpose directly, for example explaining that the email address will be used to send project updates and a monthly newsletter, with an easy way to unsubscribe at any time. The difference is purpose specificity: if you want to respond to an enquiry, send a newsletter, and share the lead with a partner, that is three consents, not one.
What this means for your build:
- Separate checkboxes per purpose, all unticked by default
- Notice text rendered next to the form rather than linked away, available in English plus the relevant regional language where your user base requires it
- No dark patterns, so Accept and Reject carry equal visual weight
- One-click withdrawal, reachable from account settings or an unsubscribe link, that actually stops processing rather than just flagging a preference
Most Indian business websites fail on the first and last points. Fixing the front end is a day of work, fixing the back end is a week, and the back end is the part everyone underestimates.
4. Why Your Database Design Has to Change
This is the section that gets skipped, and it is the one that decides whether you are actually compliant or merely look compliant. Consent is not a yes-or-no field, it is a record with a lifecycle. At minimum you need to store, for each person and each purpose, the fields below.
| Field | Why you need it |
|---|---|
| Purpose ID | Consent is purpose specific, so one row per purpose |
| Consent status | Granted or withdrawn |
| Timestamp granted | Proof of when it was given |
| Timestamp withdrawn | Proof of when processing stopped |
| Notice version ID | Which version of the notice the person actually saw |
| Notice language | Which language it was served in |
| Collection method | Web form, app, phone or offline |
| Device or IP reference | Evidence that an affirmative action took place |
Consent records need to be retained for seven years, a data architecture decision, not a policy statement, that affects your retention strategy, your backup policy and your storage cost.
Two realities most teams discover late: notice versioning, since a changed privacy notice means existing consents were granted against the old version, so notices become versioned records too; and purpose linkage on every action, because proving purpose limitation means answering 'under which consent was this email sent?', which requires the purpose reference to travel with the processing event into your logs. If your customer data currently lives across a website database, a CRM, a couple of spreadsheets and a marketing tool with no shared identity between them, this work is genuinely hard, it is a data engineering problem before it is a compliance problem, and the single strongest reason to start now rather than in January.
5. Deletion and Retention: The Requirement Nobody Has Built
You must delete personal data once the purpose is fulfilled or consent is withdrawn. In practice, almost no Indian business system can actually do this today, because personal data leaks sideways into places nobody tracks:
- Production database
- Read replicas
- Nightly backups, and how long are those retained
- Data warehouse and BI tools
- CRM and marketing automation
- Support ticket system
- Application logs
- Third-party analytics
- Email archives and exported spreadsheets on somebody's laptop
A deletion request that removes the row from your primary database and leaves the customer's phone number sitting in six other systems is not compliance, it is a false sense of it. What you actually need to build:
- A canonical customer identifier that maps across every system you run
- An automated deletion workflow that reaches each system and confirms completion
- A documented retention schedule per data category
- A defined backup expiry policy so deleted data does not come back on restore
- An audit log proving deletion happened, retained after the data itself is gone
This is where clean cloud architecture and disciplined DevOps practice stop being nice to have. A business with well-defined data flows can build this in weeks, a business with data scattered across ad hoc systems cannot build it at all until the underlying mess is fixed first.
6. Breach Reporting in 72 Hours: What That Really Needs
You must detect and report personal data breaches to the Data Protection Board and to affected individuals within 72 hours. That sounds generous until you work backwards from it, to report within 72 hours you first have to detect the breach, which means you need:
- Logging and monitoring across application, database and infrastructure layers
- Alerting that fires on unusual access patterns, not just on system downtime
- A defined incident owner who can be reached outside business hours
- A pre-written notification template so drafting does not eat the clock
- Contact records you can actually use to notify affected individuals
- The ability to determine scope, which records, which individuals and what categories of data
Most SMBs have none of these and discover breaches when a customer complains, typically weeks late. The honest test is this: if you cannot currently answer 'who accessed the customer table last Tuesday?', you are not in a position to meet a 72-hour reporting obligation. Closing that gap is cyber security work, and it takes considerably longer to build than consent checkboxes.
7. The Five Rights You Must Build Into Your Product
Individuals get enforceable rights under the Act. Each one is a feature you have to ship, not a paragraph you have to write.
| Right | What you have to build |
|---|---|
| Access | An export of all personal data you hold about the individual, across all systems, in a readable format |
| Correction | A route for the individual to correct inaccurate data, which then propagates to downstream systems |
| Erasure | The deletion workflow above, triggerable by the individual themselves |
| Grievance redressal | A published, working contact route with defined response timelines and a ticket trail |
| Nomination | The ability for an individual to nominate someone to exercise their rights in the event of death or incapacity |
Nomination is the one nearly everybody forgets, it has no equivalent in GDPR, so imported compliance templates miss it entirely. In practice these become authenticated self-service features in your account area, all backed by the same cross-system identity map that deletion requires. Build the identity map once and it powers access, correction, erasure and nomination together.
8. How SoftTech Cloud Technologies Helps You Prepare
We help growing businesses in Pune and across India turn DPDP from a legal worry into a finished build. We start with data mapping, finding every point where personal data enters, is stored, moves and is shared, including the backups, logs and third-party tools that most audits miss, then rebuild the consent layer properly, covering the front-end forms, the versioned notice system, the consent record schema and a withdrawal flow that genuinely halts processing.
From there we build the parts that take longest: automated cross-system deletion backed by solid data engineering, the five individual rights features inside your website or mobile app, and the detection and logging layer through our cyber security and DevOps services so a 72-hour reporting obligation is realistic rather than theoretical. Where your customer records live in a CRM, we make sure CRM and Salesforce systems carry consent and purpose alongside the data, hosted on secure, well-governed cloud services.
Explore our full range of technology services, see our recent work, or talk to our experts for a free DPDP readiness assessment of your website, app and CRM.
9. Vendors and Contracts You Probably Forgot About
Every third party that touches your customers' personal data is a Data Processor, and your contract with them has to reflect DPDP obligations covering data security, breach reporting, processor accountability and restrictions on passing data further down the chain. Make a list, it is longer than you think.
- Cloud hosting provider
- CRM and marketing automation platform
- WhatsApp business solution provider
- Payment gateway
- Analytics and advertising platforms
- Email service provider
- Support desk software
- Any freelancer or agency with database access
For each one, ask three questions: is there a data processing agreement in place, does it require them to notify you of a breach fast enough for you to meet your own 72-hour obligation, and does it restrict them from passing data to further sub-processors without your knowledge?
Pro tip: Start the vendor conversations now, not next year. Vendor legal teams move slowly at the best of times, and in early 2027 they will be handling this identical request from every Indian customer they have, simultaneously.
10. Children's Data and the Rules Most Edtech Sites Break
Processing a child's personal data requires verifiable parental consent. Tracking, behavioural monitoring and targeted advertising directed at children are restricted. If your platform serves users under 18, edtech, gaming, coaching institutes and any consumer app with young users, you need four things:
- Age determination at signup that is more robust than a self-declared date of birth
- A verifiable parental consent flow with an auditable record linking parent to child
- Advertising and analytics tooling that can be switched off per account for child users
- A separate retention and deletion policy for children's data
This is a substantial build, considerably bigger than fixing your contact form. If it applies to you, start here rather than anywhere else.
11. The Complete DPDP Engineering Checklist
Discovery:
- Map every place personal data enters your systems, including forms, APIs, imports and offline collection
- Map every place it is stored, including backups, logs and third-party tools
- Classify by data category and processing purpose
- Document the legal basis for each processing activity
Consent:
- Rebuild forms with separate, unticked, purpose-specific consent
- Write plain-language notices and add regional languages where needed
- Version your notices and link every consent to a notice version
- Build one-click withdrawal that genuinely halts processing
- Remove every dark pattern from consent interfaces
- Build the consent record schema with seven-year retention
Data lifecycle:
- Define a retention schedule per data category
- Build automated cross-system deletion with completion confirmation
- Set backup expiry so deleted data does not resurrect on restore
- Create a canonical customer identifier across all systems
Individual rights:
- Ship access, correction, erasure, grievance and nomination features
- Publish a grievance contact with defined response timelines
Security and breach readiness:
- Deploy logging and monitoring across application, database and infrastructure
- Configure anomaly alerting with a named on-call owner
- Write and rehearse the 72-hour breach notification runbook
- Implement encryption at rest and in transit, plus least-privilege access
Vendors:
- Inventory every processor
- Update data processing agreements
- Confirm upstream breach notification timelines
If applicable:
- Children's data: age determination and verifiable parental consent
- Significant Data Fiduciary status: appoint a DPO, run impact assessments, plan audits
12. A Realistic 12-Week Plan
- Weeks 1 to 3, discovery, data mapping and inventory. Unglamorous, and everything else depends on it, do not skip ahead to building consent forms, or you will build the wrong ones.
- Weeks 4 to 6, consent architecture, schema, notice versioning, form rebuild and withdrawal flow, front end and back end together.
- Weeks 7 to 9, lifecycle and rights, canonical identity map, deletion workflow, retention schedule and the five rights features.
- Weeks 10 to 11, security and breach readiness, logging, alerting, the runbook, and one rehearsed incident drill.
- Week 12, vendors and documentation, contract updates, processor register and an evidence pack you could hand to the Board.
Twelve weeks from today lands you comfortably before the May 2027 obligations, with room left for Consent Manager integration testing. Do not sequence this in the opposite order, businesses that start with the visible front-end consent banner and leave data mapping for later almost always end up rebuilding the consent layer twice.
13. Mistakes That Will Cost You Money
- Treating this as a legal task, your lawyer can tell you what is required, only your engineering team can make your systems do it.
- Copying a GDPR template, DPDP has requirements GDPR does not, most obviously nomination, and the phased Indian timeline is different.
- Adding a cookie banner and calling it done, a banner without a consent record, a withdrawal flow and a deletion workflow is decoration.
- Skipping data mapping, every downstream decision is wrong if the map is wrong.
- Assuming your size protects you, there is no small business exemption in the Act.
- Ignoring backups, data you deleted on Monday comes back on Friday if your restore policy is undefined.
- Leaving vendor contracts until 2027, you will be queuing behind every other Indian customer they have.
- Building consent without logging, if you cannot produce evidence of consent, you do not have consent.
14. Final Thoughts: This Is a Build Project, Not a Policy Document
The temptation with any regulation is to write a policy, publish a privacy page and move on. DPDP does not work that way, almost every obligation in it resolves to something your systems either can or cannot do. Can you produce the consent record for a specific customer and purpose? Can you delete their data everywhere within a defined time? Can you tell who accessed your database last week?
Those are engineering answers, and engineering takes months. The businesses that treat 2026 as the build year will spend it doing ordinary, manageable work. The ones that wait for 2027 will be doing the same work under deadline pressure, at higher cost, with less room to get it right. Start with data mapping this month, everything else follows from knowing where your data actually is.
15. Frequently Asked Questions
Any organisation that digitally processes the personal data of individuals in India, including startups, SMEs, MNCs, NGOs and government bodies. There is no turnover threshold or employee count exemption. It also applies to foreign companies offering goods or services to people in India.
This article explains the engineering implications of the DPDP Act and is not legal advice. Confirm your specific obligations with qualified counsel.
Prakash Bangar
Content & Strategy
More From The Team
A few related posts, picked from the same beat.
