DPDP Act: what your website's forms and notice need

India's Digital Personal Data Protection Act, 2023 and the DPDP Rules 2025 apply to any website that collects personal data such as names, phone numbers and email addresses through forms, chat or tracking.

Forms

• Show a short notice next to the form: what you collect, why, and how to withdraw consent or complain.
• Ask for consent with a clear, unticked checkbox. Don't bundle marketing consent into a form someone needs for a service.
• Collect only what you need for the purpose. A callback form doesn't need a date of birth.

The privacy notice

• List the personal data you collect and the purpose for each.
• Explain how people withdraw consent, and make it as easy as giving it.
• Describe people's rights (access, correction, erasure, grievance redressal, nomination) and how to use them.
• Give the contact details of the person who answers questions about personal data, and say how to complain to the Data Protection Board.
• Replace references to the old SPDI Rules with the DPDP Act.

Trackers and marketing

• Don't load analytics and ad pixels until the visitor agrees, if you rely on consent for them.
• Keep proof of each consent (when, how, what was shown) so you can show it later.
• Email and WhatsApp marketing need consent; let people withdraw it in one step.

The main obligations apply from 2027 under the Rules' phased timeline. This guide is a summary, not legal advice.