DPDP Act: A November 2026 Compliance Checklist for Websites and Apps

India's Digital Personal Data Protection (DPDP) Act is working through a phased timeline, and businesses that collect personal data through websites, apps, forms and WhatsApp need to be ready. Below is a plain-language checklist based on published timelines.

Not legal advice: several dates below are described as expected or indicative in commentary we reviewed (India Briefing). Confirm them with a qualified lawyer and the official notifications.

The timeline, as reported

• 14 November 2025: DPDP Rules notified, starting an 18-month phased implementation window.
• Around 13 to 14 November 2026: a deadline reported for revalidating legacy consent and notice records. Commentary also expects "soft enforcement" to end around this time.
• Early 2027: first audit cycle for Significant Data Fiduciaries, the biggest or highest-risk data handlers.
• Around 13 to 14 May 2027: full enforcement, when the Data Protection Board gains its full powers. Penalties of up to ₹250 crore (INR 2.5 billion) for major violations have been reported.

What this means for a typical business

You collect personal data whenever you take a name, phone number or email, run a contact form, accept an order, track visitors or send marketing messages.

A practical checklist

1. Map your data List what personal data you collect, why, where it is stored, who can access it and who you share it with, including analytics, CRM, email, payment and WhatsApp providers.

2. Review your notices Give people a clear notice at the point of collection explaining what you collect and why. Commentary notes that notices should be available in English or any of the 22 scheduled languages when a user requests it, so plan accurate translations for key languages instead of relying on auto-translation.

3. Fix consent

• Use clear, specific, opt-in consent. No pre-ticked boxes.
• Keep auditable records of who agreed to what, and when.
• Make withdrawing consent as easy as giving it.
• Review old data collected under earlier consent, because legacy records are expected to be revalidated.

4. Collect less Do not ask for data you do not need. Delete what you no longer need.

5. Set retention and deletion rules Decide how long you keep each type of data and automate deletion where possible.

6. Protect the data Use encryption, access controls, backups, logging and regular updates. Limit who can export customer lists.

7. Plan for breaches Write an incident plan: who investigates, who informs affected people and authorities, and how you document what happened. Check current reporting obligations, including CERT-In's rules.

8. Handle children's data carefully If your service may involve children, verifiable parental consent and age checks are expected.

9. Name a grievance contact Publish who people can contact with questions, requests or complaints.

10. Check your vendors Make sure processors who handle data for you have proper safeguards and agreements.

Website and app tasks for developers

• Cookie and tracking banners that actually respect choices
• Consent checkboxes on every form, with logging
• A privacy notice linked from every page and form
• An easy way for users to request access, correction or erasure
• Server logs and databases that avoid storing unneeded personal data

Don't leave it until May 2027

Rebuilding consent systems, notices and data flows takes time. Starting now spreads the work and the cost.

KalzTech builds consent-aware websites, apps and Odoo setups, and can review your current data flows. Contact us.