What DPDP Act Compliance Means for a Website
The Act governs digital personal data. A data fiduciary decides why and how that data is processed; a data processor handles it on the fiduciary's instructions. Your site is the fiduciary for its own forms, and WebJi® is the processor for site data stored on your plan.
Compliance is a sequence of duties rather than a certificate: publish the notice, record consent, answer rights requests, secure the data, and report a breach.
When Does the DPDP Act Apply to Your Website?
There is no turnover or headcount threshold. A three-page site with one enquiry form is in scope the same way a marketplace is, because the trigger is processing personal data, not the size of the business.
Personal and domestic use is carved out, and so is data an individual has made public themselves. A business site can claim neither.
DPDP Act Compliance Deadline: 13 May 2027
The DPDP Rules were notified on 13 November 2025 and set an 18-month runway. That puts the core duties — notices, rights handling, security safeguards and breach reporting — into force on 13 May 2027.
One milestone lands earlier: the consent-manager framework opens on 13 November 2026. The Act itself received assent in 2023, so the duties were already law while the Rules were being written.
What a Website Must Change for DPDP Compliance
The work sits in three places: the form, the policy page and the admin. A small business site can usually finish it in one pass.
- A notice at each collection point naming the data taken, the purpose, and how to withdraw consent.
- Consent that is opt-in, purpose-specific and as easy to withdraw as to give — no pre-ticked boxes.
- A cookie layer that lets a visitor refuse non-essential cookies and still use the site.
- A privacy policy listing purposes, retention periods and every processor you share data with.
- A rights channel with a named owner and a logged reply.
- Security safeguards: HTTPS, least-privilege admin access, unique logins and tested backups.
- A breach runbook that reaches the Data Protection Board and affected users quickly.
Data Principal Rights and How to Request Them
A data principal can ask for a copy of their data, correction, completion and erasure, and can nominate someone to exercise those rights. They can raise a grievance with you first and with the Data Protection Board after.
Ask through the client area or a support ticket, as our privacy policy sets out. Deletion covers what statutory retention does not require; billing records that tax law mandates are kept. For anything unclear, contact us first.
Penalties Under the DPDP Act
Penalties sit in the Act's schedule and are imposed by the Data Protection Board after an inquiry, so no fine is automatic. The highest cap is ₹250 crore for failing to take reasonable security safeguards.
- ₹250 crore — failure to take reasonable security safeguards.
- ₹200 crore — failure to notify a breach, or breach of children's-data duties.
- ₹150 crore — breach of the extra duties on a Significant Data Fiduciary.
- ₹50 crore — any other breach of the Act.
Does DPDP Compliance Require Data to Stay in India?
No. The Act permits personal data to be transferred outside India except to countries the Central Government restricts by notification, so it sets no local-storage mandate of its own.
Sector regulators can still impose their own localisation rules. Check yours before you pick a server region.
What WebJi® Does With Client Data
Webji Hosting Pvt. Ltd. is the data fiduciary for account, billing and support records, and a data processor for website data held on your plan. The registered office is Shop #27, Ajmer Road, Tagore Nagar, Jaipur, Rajasthan 302021.
Billing records are kept for the period tax law requires and hosting data is removed at service end. The contract layer is in our terms of service.
Frequently Asked Questions
What is DPDP Act compliance for websites?
A site is compliant when it collects personal data only after an itemised notice and free, specific consent, answers access, correction and erasure requests, keeps reasonable security safeguards, and reports a breach to the Data Protection Board.
Does my small website need to comply with the DPDP Act?
Yes, if it collects personal data from people in India through a form, newsletter, checkout or analytics cookie. The Act sets no size threshold; only personal and domestic use is exempt.
What website changes does the DPDP Act require?
A notice at every collection point, consent that can be refused as easily as given, a cookie layer that works without non-essential cookies, a privacy policy naming purposes and retention, a rights-request route and working security controls.
Who is a data fiduciary under the DPDP Act?
The person or company that decides why and how personal data is processed. A website owner is the fiduciary for its own forms; a hosting provider such as WebJi® is a data processor acting on that owner's instructions.
What are the penalties for DPDP non-compliance?
The Act's schedule caps penalties at ₹250 crore for failing to take reasonable security safeguards, ₹200 crore for not reporting a breach or for children's data, ₹150 crore for Significant Data Fiduciary duties and ₹50 crore for other breaches.
Does the DPDP Act force data to stay in India?
No. The Act allows transfer outside India except to countries the Central Government restricts by notification. Some sector regulators add their own localisation rules, so check yours before choosing a server region.
Is WebJi® an Indian company?
Yes. Webji Hosting Pvt. Ltd. is registered at Shop #27, Ajmer Road, Tagore Nagar, Jaipur, Rajasthan 302021, and has traded since 2005.
Do you provide GST invoices?
Yes. Every invoice carries our GSTIN, and hosting prices are quoted before 18% GST.