India's data protection law: what your website's contact form needs

If your website has a contact or enquiry form, India’s Digital Personal Data Protection Act, 2023 applies to the details people type into it. Most of the duties for ordinary businesses start in mid-May 2027, 18 months after the Rules were published, so you have time to prepare. You do not need a large project: a clear notice, a shorter form, a retention plan and a named contact person cover most of it.

This is general information, checked against the Act, the Rules and MeitY’s notices on 11 November 2026. It is not legal advice. Please speak to a lawyer about your own situation.

The words the law uses

The Act uses a few terms you will see again below.

• Data Fiduciary: the business that decides why and how personal data is used. If the form is on your website, that is usually you.
• Data Principal: the person the data is about, such as the visitor who fills in your form.
• Data Processor: a company that handles the data for you, such as your hosting provider or email service.
• Board: the Data Protection Board of India, which handles complaints and breaches.

Personal data means any data about a person who can be identified from it. A name, an email address and a phone number all count.

What applies when

The dates come from two Gazette notifications dated 13 November 2025: one for the sections of the Act and one for the DPDP Rules, 2025. MeitY’s press release describes this as an “18-month phased compliance timeline”.

Counting from the Gazette date, the 18-month mark falls on 13 May 2027. Some advisers count from 14 November 2025, the day the Gazette was uploaded, so you may also see 14 May 2027.

The November 2026 step is about Consent Managers. It does not, by itself, start the form-related duties for an ordinary business.

In January 2026, Business Standard reported that MeitY was considering cutting the 18 months to 12 for some rules. We did not find an amending notification on MeitY’s website when we checked on 11 November 2026. A proposal does not change the law, but it could still be adopted, so check MeitY’s site for the current position before you set your plan.

Is there an exemption for small businesses?

No. The Act does not exempt a business because it is small. Section 17(3) lets the government notify certain businesses, including recognised startups, that are excused from a few duties. That only applies if such a notification is issued and covers you. It is not a general exemption, so plan as if the law applies.

The checklist for your contact form

1. Give a clear notice beside the form

Rule 3 says the notice must make sense on its own, in clear and plain language. At minimum it must list the personal data you collect, item by item, and say what you will use it for.

It must also say how a person can withdraw consent, use their rights and complain to the Board. Section 5(3) of the Act says people should be able to read the notice in English or any language in the Eighth Schedule to the Constitution.

A short line under the form, linked to a fuller privacy page, is a practical way to do this.

2. Keep each purpose separate

Section 7(a) allows you to use data that someone gives you voluntarily for the purpose they gave it, unless they tell you they do not agree. The Act’s own example is a person who messages a property broker for help finding a flat: the broker may use her details for that, and must stop once she says she no longer needs help.

So replying to an enquiry is one purpose. Adding the person to a newsletter is another. Section 6 says consent must be free, specific and given by a clear action, so use a separate box that is not ticked in advance. Withdrawing consent must be as easy as giving it.

3. Collect only what you need

Consent must be limited to the data needed for the stated purpose (section 6(1)). If you only reply by email, ask whether you really need a phone number, company size or address. Every field you remove is one less thing to protect.

4. Decide how long you keep enquiries

Section 8(7) says you must erase personal data once consent is withdrawn or the purpose is no longer being served, unless another law requires you to keep it. Rule 8(3) also asks every business to keep personal data and processing logs for at least one year for certain government purposes, and then erase them.

In practice, set a written retention period, store it with your form settings, and delete old enquiries from your inbox, CRM and spreadsheets when it ends. Ask your lawyer how the one-year rule fits your records.

5. Show people how to use their rights

People can ask for a summary of the data you hold (section 11), ask you to correct, complete, update or erase it (section 12), and raise a complaint with you (section 13).

Rule 14 says you must publish on your website how to make these requests. You must also publish the time you take to respond to complaints, which cannot be more than 90 days.

6. Name a contact person

Rule 9 says you must publish, prominently, the business contact details of someone who can answer questions about how you use personal data. A small business does not need a Data Protection Officer unless the government has named it a Significant Data Fiduciary. A named person with a working email address is enough to start with.

7. Protect the data you hold

Rule 6 lists reasonable security safeguards. For a small website, that means protecting stored data, for example with encryption. It also means limiting who can open submissions, keeping logs of who accessed data, and taking backups.

Your contract with your hosting or email provider should cover security too. You stay responsible for data your provider handles for you (section 8(1)).

8. Know what to do if data leaks

A personal data breach includes any unauthorised access, sharing or loss of personal data. Rule 7 says you must tell each affected person without delay, in plain language: what happened, what it may mean for them, what you are doing and who they can contact.

You must also tell the Board without delay, and send a detailed report within 72 hours of becoming aware of it. Write down now who would do this in your business.

What the Act says about penalties

The Schedule to the Act sets maximum penalties. For example, failing to take reasonable security safeguards may lead to a penalty of up to ₹250 crore. Failing to report a breach may lead to up to ₹200 crore. Section 33 says the Board must consider factors such as how serious the breach was and whether the penalty is proportionate. These are upper limits, not fixed amounts.

Common questions

Do I need consent just to reply to an enquiry?

Section 7(a) of the Act allows you to use details someone gives you voluntarily for that purpose, unless they object. You should still show the notice and keep any other use, such as marketing, separate. Ask your lawyer if your form does more than collect an enquiry.

My form sends enquiries straight to my email. Does the law still apply?

Yes. The data is still personal data under your control, whether it sits in an inbox, a spreadsheet or a CRM. Retention, access and deletion apply there too.

My website also has visitors from the UK or Europe. Is this enough?

Not always. Sites serving people in the UK or the EU may also need to follow GDPR, which has its own rules.

Will the dates change?

They might. The current notified timeline is in the table above. Check MeitY’s website for any later notification before relying on a date.

A sensible next step

Start with the form you already have. List each field, why you need it, where the submissions end up and who can open them. That one page covers most of the checklist above.

If you would like help reworking the form, notice and storage on your site, see our website development service or get in touch.