India's DPDP Act: what your website's forms and cookies need to get right

India's Digital Personal Data Protection Act, 2023 (DPDP Act) governs how businesses collect and use personal data — and a website contact form is one of the most common places that happens. The DPDP Rules were notified in November 2025, with most obligations phasing in over the following months. If you run a business website, now is the time to get the basics right.

This is a practical overview, not legal advice. For your specific situation, speak to a lawyer.

Collect less

The simplest way to reduce risk is to ask for less. Does your enquiry form really need date of birth, full address and company size? Ask only for what you need to respond — usually name, email or phone, and the message.

Give a clear notice at the point of collection

Near every form, explain in plain language what you collect, why, and how long you keep it. Link to a privacy notice that also explains how people can access, correct or delete their data and whom to contact.

Get consent that means something

• Use an unticked checkbox for consent; do not pre-tick it.
• Keep consent specific: agreeing to be contacted about an enquiry is not the same as agreeing to marketing.
• Record when consent was given, so you can show it later.
• Make withdrawing consent as easy as giving it.

Be careful with cookies and trackers

Analytics, ad pixels and session-recording tools collect personal data too. List what runs on your site, remove what you do not use, and avoid loading marketing trackers before the visitor has had a chance to choose.

Keep data only as long as you need it

Decide how long enquiries, call recordings and booking details are kept — for example, delete unconverted leads after a set period — and actually delete them.

Protect what you hold

The Act expects reasonable security safeguards, and penalties for failing to prevent a breach can be very large. In practice: HTTPS everywhere, strong admin passwords with two-factor login, limited access for staff, encrypted backups, and a plan for what to do if something goes wrong — including notifying affected people and the Data Protection Board when required.

Check your vendors

Your CRM, email tool, chatbot and hosting provider process data for you. Choose reputable providers and know where your data goes.

Good privacy practice is also good marketing. A short, honest form with a clear promise ("we'll only use this to reply to you") builds trust — and trusted forms get filled in.