DPDP for Small Websites: What to Do Before 13 November 2026

The short answer

If your website collects any personal data from people in India, the Digital Personal Data Protection (DPDP) Act 2023 applies to you. There is no exemption for small businesses when it comes to notice and consent. A contact form, a newsletter signup, a booking widget or Google Analytics is enough.

The good news: for most small sites, getting ready is a one-afternoon job, not a legal project.

The dates that matter

The DPDP Rules 2025 phase in over 18 months:

Always check the official Rules text for the latest dates.

You are not fined on 13 November 2026 for missing a banner. So why act now? Because consent you collect today is consent you can prove in May 2027. Starting early gives you months of clean records, time to fix mistakes, and no last-minute rush when every agency and developer in India is busy.

Does this apply to me?

You are a Data Fiduciary under the Act if you decide why and how personal data is processed. That covers:

• Freelancers and consultants with a contact or enquiry form
• Small SaaS with signups, trials or product analytics
• Service businesses like clinics, coaches, salons, tutors and agencies taking bookings online
• One-page and landing sites running Google Analytics, Meta Pixel, Hotjar or a WhatsApp chat widget
• Small online stores on Shopify, WooCommerce or Instamojo

If none of your pages collect names, emails, phone numbers, IP-linked analytics or cookies tied to a person, you may not need consent. Very few real websites fall in that group.

The small website checklist

1. List what you collect

Write down every place your site collects personal data: forms, analytics, ad pixels, chat widgets, embedded videos, payment pages. Our free DPDP website scanner finds most trackers for you.

2. Show a clear notice

The notice must say, in plain language, what data you collect, why, and how people can withdraw consent or complain. It must stand on its own, not be buried in your terms and conditions. It should be available in English and in Indian languages your visitors use.

3. Ask before tracking

Analytics and ad scripts should not run until the visitor agrees. A banner that loads Google Analytics first and asks later does not meet the DPDP standard of free, specific and unambiguous consent.

4. Make withdrawal easy

Withdrawing consent must be as easy as giving it. A small “Privacy settings” link in your footer that reopens the banner is enough.

5. Keep a record

Under Section 6(10), if there is ever a dispute, you must prove consent was given. Keep a record of who agreed to what, and when. A spreadsheet of form submissions is not enough for cookie and analytics consent.

6. Name a contact

Give an email address where people can ask questions, request their data or raise a complaint, and reply to them.

What it costs

For a small site, nothing. ConsentPlix has a Free Forever plan: one website, 1,000 consent events a month, a DPDP consent banner in English and Hindi, and a signed record of every consent. No credit card, no trial timer.

When you grow, Starter is ₹399 a month and adds all 22 official Indian languages, a custom banner design and a Data Principal rights portal. See pricing.

How to set it up

1. Request a free account. We set it up and email you a link to set your password.
2. Paste one script tag into your site header. On WordPress, Shopify, Wix and Webflow this is a settings field.
3. Check the banner shows before your analytics fires.

Full steps are in the quickstart guide.

Summary

• The DPDP Act applies to small websites.
• Consent Manager rules start 13 November 2026; everything is enforced from 13 May 2027.
• You need a clear notice, consent before tracking, easy withdrawal, a record of consent and a contact person.
• You can do all of it for free.

Get your website DPDP consent ready, free →