DPDP Act for small businesses: a plain-language checklist for your website and WhatsApp

Your website has a contact form. Your WhatsApp has hundreds of customer numbers. Your billing software has names, addresses and phone numbers. That makes you a Data Fiduciary under India's Digital Personal Data Protection Act, 2023 (DPDP Act), even if you are a two-person shop.

Most small businesses haven't started, because the articles about it are written for lawyers. Here is the plain-language version: what the law asks, by when, and a 10-point checklist for your website and WhatsApp.

This is a practical guide, not legal advice. For your exact situation, talk to a lawyer or CA.

The timeline: why now

• 13 November 2025: the government notified the DPDP Rules, 2025, and the Data Protection Board was set up.
• Around November 2026: registration of consent managers opens.
• Around May 2027: the main duties for businesses apply. These include clear notices and consent, security safeguards, reporting data breaches, and deleting data you no longer need.

Some lawyers read parts of the notice and consent rules as starting earlier, so the safe plan is to be ready before the end of 2026. Most of the work is one-time: a few pages, a few forms, and some settings.

Who has to follow it?

Any business that collects digital personal data about people in India. That includes data typed into your website or app, sent on WhatsApp, or entered into software. It covers names, phone numbers, emails, addresses, photos, payment screenshots and chat messages.

There is no small-business exemption for the basic duties. Clinics, coaching centres, shops, D2C brands, agencies, CAs and real-estate brokers all count.

What the law asks, in simple words

1. Tell people clearly what data you collect and why, before you collect it. The notice must stand on its own, be easy to read, and list the data and the purpose.
2. Get real consent. A clear "I agree", not a pre-ticked box, and only for the purpose you stated.
3. Make withdrawing consent as easy as giving it.
4. Respect people's rights: they can ask what you hold, correct it, or delete it, and they can complain to you and then to the Data Protection Board.
5. Keep data safe: access control, encryption or masking where sensible, backups, and logs of who accessed what (kept for at least a year).
6. Report breaches. If data leaks, tell the affected people without delay. The Board gets a first notice without delay and a detailed report within 72 hours.
7. Delete data when the purpose is over, unless another law (such as tax law) says to keep it.
8. Take extra care with children's data: verifiable consent from a parent for anyone under 18.
9. Be responsible for your vendors. If your hosting, CRM, chatbot or AI provider handles the data for you, you are still responsible for it.

Penalties are serious. Under the Act's schedule, fines go up to ₹250 crore for failing to keep data secure, up to ₹200 crore for not reporting a breach or for breaking the children's-data rules, and up to ₹50 crore for other breaches. The Board decides the actual amount based on the case, but "we are small" is not a defence.

The 10-point checklist for your website and WhatsApp

Website

• 1. A privacy policy in plain language. List what you collect (contact form, chat, orders, analytics), why, who you share it with (hosting, payment gateway, courier, AI provider), how long you keep it, and how people can use their rights. Make it available in Hindi too if your customers speak Hindi.
• 2. A short notice on every form, right above the submit button. For example: "We'll use your name and number to reply to this enquiry. [Privacy Policy]". Add a consent checkbox that is not pre-ticked.
• 3. A "Delete my data / Withdraw consent" option: a simple form or a WhatsApp number, plus a named person who handles it.
• 4. Only the cookies and trackers you really need. If you use advertising pixels, ask first.
• 5. Security basics: HTTPS, strong admin passwords, two-factor login where possible, no customer data in Google Sheets shared "with anyone with the link", and regular backups.

WhatsApp and chatbots

• 6. Get opt-in before marketing. Broadcasting offers to every number in your phone is risky under DPDP, and it is also against WhatsApp's own rules. Ask customers to opt in, for example with "Reply YES to get offers", and save that record.
• 7. Disclose your AI chatbot. Say that an AI assistant may reply, which AI provider receives the messages, and how to reach a human.
• 8. Keep chats and screenshots private. Payment screenshots, prescriptions and ID photos sent on WhatsApp are personal data. Don't forward them to staff groups, and delete them when the job is done.

Behind the scenes

• 9. A simple data map. One page that lists what data you have, where it lives (website database, WhatsApp, Excel, billing software), who can access it, and when it gets deleted.
• 10. A breach plan. One page that says who decides, how you tell customers, how you notify the Board within 72 hours, and how you fix the hole.

Where AI and automation actually help

Compliance sounds like paperwork, but a good setup does most of it for you:

• Automatic deletion: old enquiries and chats are deleted after the period you choose.
• Consent records: every "Reply YES" or ticked box is saved with the date and time.
• Rights requests: "Delete my data" requests arrive in one admin inbox with a deadline reminder.
• Private storage: payment screenshots and documents are visible only to the people who need them, not saved in a public link.
• AI chatbots that show a notice at the start and hand over to a human on request.

We are building these into every website and WhatsApp bot we make at Aimerger. You can see our own Privacy Policy as a working example.

The short version

The DPDP Act asks small businesses to do five things:

1. Tell people what you collect and why.
2. Ask before you collect it or send marketing.
3. Protect the data.
4. Delete it when you no longer need it.
5. Report it if something leaks.

Start with your website forms and your WhatsApp, because that's where most of your customer data comes in.

Want your website or WhatsApp bot to be DPDP-ready? Message us on WhatsApp or send us a message. We'll review your current setup for free and tell you what needs fixing.