India's DPDP Deadline Is May 2027: What Your Website, CRM and Apps Need to Change Now

13 May 2027 is a little over six months away. Most Indian businesses know a data protection law exists. Far fewer have opened their own contact form lately to see what it collects, and why.

This is a practical read of the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 for people who run websites, CRMs and apps. We build those things for a living, so that is the angle. We are not a law firm and nothing here is legal advice, so have your counsel read the Rules for your sector.

The dates

The Rules were notified on 13 November 2025 and published in the Gazette the next day. A few provisions started straight away, mainly the ones that set up the Data Protection Board. The duties that touch everyday business (notice, security safeguards, breach reporting, retention, children’s data and the rights people can exercise) come into force on 13 May 2027. The rules on consent managers arrive earlier, this November, and most businesses won’t deal with those directly.

Penalties are caps, not fixed amounts: up to ₹250 crore for failing to keep reasonable security safeguards and up to ₹200 crore for failing to report a breach. The Board is meant to weigh severity, duration, the kind of data involved and how you responded. Nobody knows yet how hard it will enforce in its first year, and we wouldn’t build a plan around finding out.

Your website

Open your contact form and count the fields. For each one, ask whether you need it to answer the message. The law ties consent to the data that is necessary for the stated purpose, so a “Contact us” form that also asks for date of birth, full address and company size is hard to defend.

Then the notice. At or before the point of collection, people need a plain-language notice that says what you collect, what you use it for, how to withdraw consent, how to exercise their rights and how to complain to the Board. The Act says it should be available in English or any of the 22 languages in the Eighth Schedule. A Gujarati or Hindi version of your notice is a real option and, for plenty of audiences, a better one.

Consent boxes need work too. No pre-ticked boxes. One purpose per consent, so “I agree to be contacted about my enquiry” and “send me your newsletter” are two separate things. Withdrawing has to be as easy as agreeing, which rules out a form that takes one click to join and an email to a support address to leave.

Then the trackers. The Act doesn’t mention cookies by name, but a pixel that ties a visit to an identifiable person is processing personal data, and for marketing that usually means you need consent first. List every script on your site: analytics, Meta Pixel, heatmaps, chat widgets, embedded forms. Decide which ones really need to be there. Whatever stays should load only after consent wherever consent is your basis.

Finally, publish a contact point, a person’s name or title and an email address, for people who have questions about their data.

Your CRM

Export the last 500 rows and read the column headers out loud. For each one, can you say what it is for? Anything with no answer is a candidate for deletion.

After that, three things usually need rebuilding.

Consent records. A tick in a form isn’t a record. You want to be able to show who agreed, when, to which version of the notice, for which purpose and through which channel. Add those as fields and fill them automatically at capture.

Withdrawal that travels. If someone withdraws on the website, that has to reach your email tool, your WhatsApp broadcast list, your ad audiences and the spreadsheet a sales rep keeps on the side. This is where most setups break, and it is an automation job more than a legal one.

Retention. Decide how long a cold lead is worth keeping and delete on a schedule instead of by good intentions. Separately, the Rules expect security logs and related data to be kept for at least a year, so retention isn’t only about deleting.

On security more broadly, the Rules name the safeguards: encryption or masking, access control, logging and monitoring, and backups. In practice that means no shared logins, two-factor on anything holding customer data, role-based access, and a sales team that can’t export the whole database with one button.

Vendors and data leaving India

You stay responsible for data your vendors handle. Your CRM, SMS gateway, email tool, website host, voice AI platform and the agency that built your site all count. Get written agreements in place and know where each one stores data.

Moving data outside India is allowed by default under the Act, except to countries the government restricts. The detailed cross-border rule isn’t in force yet either, and existing sector rules (for banks and payment data, for instance) still apply in the meantime, so don’t treat DPDP as though it has already replaced them.

Your apps

Check the permission prompts and the SDKs. Every analytics, crash reporting and ad SDK inside your app is a vendor handling your users’ data. Give people a way to delete their account and their data from inside the app.

Children are the big trap. Anyone under 18 counts as a child, which is higher than many teams assume. You need verifiable consent from a parent or guardian, and you can’t track children or aim targeted ads at them. There are carve-outs for some healthcare and educational uses, but they are narrow, so check before you assume you qualify. A school app or a paediatric clinic app is the obvious place this bites.

Breaches

Write down, before anything happens, who decides that an incident is a breach, who tells the Board and the people affected, and who speaks to them. The Rules ask for notice to the Board without delay and a detailed report within 72 hours. Run one drill. It will be embarrassing and also the most useful hour of the whole project.

A sensible order of work

1. List every place you collect personal data: forms, apps, WhatsApp, call recordings, even the paper register someone types up later.
2. For each, write down the purpose, who sees it, where it is stored and how long you keep it.
3. Rewrite the notices and fix the consent boxes.
4. Build the consent record and the withdrawal flow into the CRM.
5. List your vendors and sort out the paperwork.
6. Write the breach plan and rehearse it once.

If you finish by February, you leave three months to test and fix things. If you start in April, you won’t.

None of this is exotic engineering. Mostly it is tidying, and tidying gets slower the longer you have been collecting. If you’d like a second pair of eyes on your forms, CRM and apps, that is the kind of review we do at Datavonix.

Further reading: Mondaq on the 2026 DPDP milestones and Konfirmity’s rule-by-rule summary.