DPDP Act Compliance for Websites and Apps: 2026 Checklist

DPDP Act compliance for websites and apps comes down to five things: a clear consent notice before you collect, use limited to the purpose you stated, working correction and deletion, a published grievance contact, and database evidence that all four happened.

The Digital Personal Data Protection Act, 2023 carries penalties in crores. Its Rules are being operationalised on a phased timeline, so confirm the current gazette notification and the commencement date for your business.

This is the checklist DevXAI engineering teams work through for clients in Hyderabad and across India. This is not legal or tax advice.

The short answer

Question	Direct answer
Does it apply to me?	If you process digital personal data of people in India, assume yes. A contact form counts.
Your role	You are the Data Fiduciary, your user the Data Principal, your vendors Data Processors.
What a user gets	Notice before consent, access, correction, erasure, grievance, nomination.
Hardest to build	Erasure reaching replicas, backups, indexes, caches and logs. A deleted_at is not it.
Cheapest real fix	Strip personal data out of application logs and the error tracker.
What it costs	Small site or app: we quote ₹80,000–₹2,50,000. Legacy 40-plus-table platform: ₹4,00,000–₹12,00,000.
Downside risk	The Schedule tops out at ₹250 crore for failing to take reasonable security safeguards.

Who is who: Data Principal, Data Fiduciary, Data Processor

Three words decide every downstream call, and teams get them wrong:

• Data Principal: the individual the data is about. For a child, the parent or lawful guardian.
• Data Fiduciary: whoever determines the purpose and means of processing. If you decided why the data is collected, this is you.
• Data Processor: anyone processing on your behalf, from your cloud provider to a support team in Chennai working your tickets.

Accountability does not travel down. If your CRM vendor leaks the list, the Fiduciary obligation was still yours.

Government may also notify a class of Significant Data Fiduciaries, who then need a Data Protection Officer in India and periodic audits. Most Gachibowli startups will not be.

Consent and the notice on the screen

Consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the data necessary for the stated purpose. The notice beside it must say what data you want, what for, how to withdraw, and how to complain to the Data Protection Board.

One requirement gets missed: the notice must be available in English or any language in the Eighth Schedule to the Constitution. If a third of your users sit in Vijayawada and Visakhapatnam and read Telugu, English-only is a weak position.

The pre-ticked box is the failure we find most often

A box already ticked is not a clear affirmative action. Neither is one checkbox covering account creation, marketing and partner sharing. Consent is a record you can produce later. Store an append-only row:

• data_principal_id and purpose_key, one row per purpose rather than one per user
• notice_version plus a hash of the exact text shown
• granted_at in UTC, method (web form, app onboarding, OTP), ip, withdrawn_at

Never UPDATE a consent row; insert a new one. Reword a purpose and that is a new version, with old consent not carrying across. An OTP through MSG91 verifies control of a phone number, not consent. Withdrawal must be as easy as granting: a toggle the user can reach in two taps. On web platform builds that lands with account settings.

Cookies, analytics, and the banner nobody reads

Most consent management platforms are shaped for GDPR and IAB TCF, and are the wrong tool for a typical Indian site. The CMP bundles we have audited add 60–120KB of render-blocking JavaScript before first paint. On a ₹9,000 Android phone on patchy 4G in Kondapur, that is a second you did not need to spend. If you run three trackers, write forty lines yourself: a consent object in localStorage defaulting to denied, a gate around the tag loader, and a footer link to reopen it. Buy a CMP only if you sell ad inventory or serve real EU traffic.

Purpose limitation, retention, and deletion that actually deletes

Purpose limitation quietly breaks most Indian growth playbooks. You collected a phone number for order updates. A Diwali offer on WhatsApp is a different purpose, and either you captured marketing consent separately or you did not.

You cannot write a retention policy for tables you never listed. Script over information_schema.columns, tag each column personal, sensitive or neither, then have a product owner sign the sheet. For thirty Postgres tables, half a day.

Where the deleted row is still alive

Teams set deleted_at, hide the row, and close the request. The data is still here:

• Read replicas, automated RDS backups kept up to 35 days, manual snapshots
• S3 object versions, Glacier copies, OpenSearch indexes, Redis caches
• BigQuery, Metabase, Zoho or HubSpot, and their own backups
• Sentry breadcrumbs, CloudWatch log groups, WhatsApp Business API history
• The CSV a salesperson exported to a laptop in Banjara Hills last quarter

Nobody removes one person from an immutable backup within an hour. What is defensible is a written policy: stores, caches, indexes and SaaS tools purged inside a stated window, backups aged out on a named rotation, and a suppression list so restores re-apply deletions. Thirty days is the window to aim for.

What Indian law forces you to keep

Erasure does not override statutory retention, and India has several such duties. A checklist written for American law misleads you here.

Obligation	Roughly how long	Effect on your delete endpoint
Books of account, Companies Act 2013	Eight financial years	Invoices carrying a customer name are not deletable on request
GST records, CGST Act	About 72 months from the annual return due date	Billing is a separate class from marketing data
KYC, regulated entities	Typically five years after the relationship ends	Fintech cannot treat KYC like profile data
CERT-In directions, ICT logs	Commonly cited as 180 days, held in India	Security rules set log retention, not your erasure policy

So erasure must separate a marketing profile, which goes, from a statutory record, which stays in a restricted store. Say that in the notice rather than promising total deletion. CERT-In also requires incident reporting on a six-hour clock, separate from DPDP.

Rights, grievance redressal, and the higher bar for children

Four rights shape the build, and each is a feature ticket:

• Access: what you hold, a summary of processing, and who else received it.
• Correction, completion and updating, without emailing support.
• Erasure, subject to the statutory carve-outs above.
• Grievance redressal, plus the right to nominate someone to act on death or incapacity. That has no GDPR equivalent and almost no Indian product ships it.

Grievance is cheapest to get right and most visible when wrong. Publish a named contact with a monitored mailbox in the footer, app and policy. A form routing to an unread alias is worse than none. We build for seven working days on access, thirty on erasure.

Children are a genuinely higher bar in India

A child here is anyone under eighteen. Processing a child's data needs verifiable consent from a parent or lawful guardian, and tracking, behavioural monitoring and targeted advertising at children are off the table.

The advice for edtech founders in Madhapur and HITEC City is blunter than they expect. Age-gating is hard and a segmentation bug at scale is expensive. It is cheaper and safer to switch behavioural analytics off for the whole product and never collect a date of birth. Decide that during discovery on a mobile product build.

The engineering checklist for DPDP Act compliance for websites and apps

Every row has an owner. These programmes stall when compliance belongs to everyone and so nobody.

Item	What done looks like	Owner
Data inventory	Every table, bucket and SaaS tool listed, PII columns tagged	Founder, backend lead
Consent capture	Append-only rows with purpose key, notice version, UTC timestamp	Backend lead
Consent notice	Plain language, shown before collection, versioned in the repo	Founder
Withdrawal path	A settings toggle as easy to reach as the grant was	Frontend lead
Analytics gate	Tags denied by default; GA4 and pixels load only after a click	Frontend lead
Purpose limitation	One purpose per collection point; marketing consent stored apart	Product owner
Retention policy	Data class, period, statutory override and deletion trigger	Founder, legal
Erasure	Clears store, replicas, indexes, caches and CRM, plus a suppression list	Backend lead
Encryption	TLS 1.2 or higher with HSTS, encrypted at rest, secrets out of the repo	DevOps
Access control	Named accounts, MFA on cloud and database consoles, reviewed quarterly	DevOps
Audit logs	Who read or exported personal data, when and why, kept apart	Backend lead
PII out of logs	Error-tracker scrubbing on, request bodies denied, clean URLs	Backend lead
Processor contracts	A written DPA with every vendor touching personal data	Founder, legal
Cross-border position	A map of which data sits in which region	DevOps, founder
Breach readiness	Named responder, rehearsed runbook, logs long enough to scope it	Security owner
Grievance contact	Named officer and monitored email, published on site and in app	Founder

PII in logs is where the real problem lives

Consent is visible so it gets attention. Logging does not. Recurring patterns:

• logger.info("OTP sent to " + phone), putting every phone number in CloudWatch for months
• Request-logging middleware dumping the whole body, so signup fields land in plaintext
• Email addresses in GET query strings, which reach access logs and referrer headers
• Error trackers on default PII capture, and session replay recording unmasked inputs

Add a beforeSend hook that strips known fields. Build redaction on an allowlist of fields you will log, not a denylist you will forget. Add a CI check that fails the build when a diff logs a user object.

Vendors, cross-border transfer, and breach readiness

Count your processors honestly. In the Indian SaaS products we audit the count runs fifteen to thirty, each needing a DPA and carrying subprocessors:

• Razorpay or Cashfree, and cloud (AWS, GCP, Azure)
• SMS and WhatsApp Business API partners, email delivery
• CRM, helpdesk, analytics, error tracking, payroll

A signed DPA from a vendor nobody audits buys you paperwork. Cutting the count is worth more: deleting two analytics tools nobody opened in six months beats three more signatures, because a removed tool is a flow you no longer breach-notify about.

On transfer, the Act's mechanism is a restriction power: Government may notify countries to which transfer is restricted. That is a blocklist, not the EU's adequacy whitelist. Sectoral rules bite earlier anyway, since the RBI already requires payment data storage in India. See UPI and payment gateway integration.

Pick an Indian region and remove a category of argument. AWS has Mumbai (ap-south-1) and Hyderabad (ap-south-2); Azure has Central India in Pune and South India in Chennai. The premium is a few percent. Migration is API and cloud work: one sprint young, far longer after drift.

Breach readiness is a capability. You need four answers within hours: which categories of data, how many Data Principals, over what window, and what the intruder touched. That needs log retention and immutable audit trails, decided months earlier. Build for a 72-hour clock.

Where you should not spend money on this

If you are four people in Hyderabad with a marketing site, a contact form and GA4, do not buy a compliance audit. The findings are generic. One engineer for three days gets you a consent record, redacted logs, an Indian region, a retention note and a grievance contact. Then pay a lawyer to read it.

Three more things not to buy:

• A "DPDP certified" badge. There is no statutory certification for a general business.
• A Data Protection Officer because an article said so. That duty attaches to Significant Data Fiduciaries; a published grievance contact applies broadly.
• A Consent Manager integration, until you have an actual reason.

Outside help earns its fee on a legacy platform with forty-plus tables and no data map, in fintech, health or ecommerce, on edtech with minors, or where an existing user base has no consent records. That is forensic work, in the ₹4,00,000–₹12,00,000 band above, and where the questions in choosing a development company in Hyderabad matter, alongside the storefront specifics in ecommerce development in India.

This never fully ends: a pixel goes up because marketing had an idea on a Friday. Quarterly access reviews are how care plans work. Putting the data map in discovery beats retrofitting it.

Frequently asked questions

Does the DPDP Act apply to a small business website in India?

In most cases, yes. The Act covers digital personal data processed in India, and a contact form storing a name, email and phone number is personal data. Size does not exempt you; it only changes the volume of work. A five-page site is a few days.

What is the difference between a Data Fiduciary and a Data Processor?

The Data Fiduciary decides why and how personal data is processed. The Processor only acts on the Fiduciary's instructions. If you run the website you are the Fiduciary, and your host, payment gateway and CRM are Processors. Accountability stays with you regardless.

Do I need a cookie consent banner under the DPDP Act?

If your cookies or analytics tags collect personal data, you need consent given by a clear affirmative action, which in practice means a banner. You do not need an expensive platform: a denied-by-default flag, a gate around your tag loader and a footer link to change it.

How do I handle a deletion request when GST law makes me keep the invoice?

Split the data. Delete the marketing profile, behavioural data, support history and account record. Retain statutory records such as invoices, books of account and KYC in a restricted store, because retention required by law is treated differently. Say that in your notice.

What does DPDP Act compliance for websites and apps cost in India?

For a small site or single app we quote ₹80,000–₹2,50,000 for the engineering: consent records, log redaction, erasure, retention policy and hosting region. A large platform with legacy data and no data map runs ₹4,00,000–₹12,00,000, roughly USD 5,000 to 15,000. Legal review of the notice is billed separately.

What to do this week

Do not start with the privacy policy. Start with the truth about your data.

1. Run the inventory script and list every SaaS tool with a login.
2. Search your error tracker and log groups for an email and a phone number.
3. Unbundle anything pre-ticked on your signup form; start writing consent rows.
4. Publish a named grievance contact with a mailbox somebody reads.
5. Write down your retention periods, statutory ones included, then have a lawyer read the notice.

That is a week of work for most small products in Hyderabad, Bengaluru, Chennai or Pune. If you would rather have it done and evidenced, send the stack over for a verdict on all sixteen rows.