DPDP Compliance Kit for Indian websites
A DPDP checklist from what you collect, with draft notice and consent text, a cookie banner and a breach plan.
- Free to use
- Runs in your browser
- No sign-up
Runs in your browser. Your answers and ticks stay in this browser.
Example: a made-up dental clinic, Smile Studio Dental in Kothrud, Pune.
Not legal advice
This kit is a starting point built from the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025, as published by the Government of India. It cannot tell you how the law applies to your business. Consult a lawyer before you rely on it or publish these texts.
0 of 0 done
Built from your answers. Each item names its source in the Act or the Rules, or says it is our suggestion.
Penalties in the Schedule to the Act
The most the Data Protection Board can impose for each kind of breach.
- Not taking reasonable security safeguards to prevent a personal data breach (section 8(5))Up to ₹250 crore
- Not telling the Board or the people affected about a breach (section 8(6))Up to ₹200 crore
- Not meeting the extra duties for children (section 9)Up to ₹200 crore
- Not meeting the extra duties of a Significant Data Fiduciary (section 10)Up to ₹150 crore
- Any other breach of the Act or the Rules (PIB summary)Up to ₹50 crore
Next steps
- Have a lawyer check the result against your business.
A draft from your answers. Edit it here, then copy it to your privacy page.
You can edit the text. Changes to your answers update it until you do.
Unticked boxes for your contact, booking and job forms, and a WhatsApp first reply.
You can edit the text. Changes to your answers update it until you do.
The DPDP Rules, 2025 (rule 7)
72 hours
to send the Data Protection Board the detailed report, after telling it and the people affected without delay.
The Board can allow a longer period on a written request. The headings for the report and the steps marked "our suggestion" are ours, not the Rules' wording.
Breach response plan
Want an expert to check this result?
Send it to us in one click. We read it and reply within one business day with what we would fix first.
Embed this tool on your websiteFree. Paste one code; it runs in your visitors' browsers.
Copy this code into a page of your site. The tool sets no cookies and sends nothing your visitors type to us. Change height="760" if it needs more room.
About the DPDP Compliance Kit
Answer a few questions about the personal data your business collects, where you keep it and who else gets it. You get a checklist under the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025, with the dates they apply, a draft privacy notice and consent text you can edit, a cookie banner that keeps analytics off until a visitor accepts, and a breach response plan with the Rules' 72-hour timeline. It runs in your browser, and your answers stay in this browser. It is a starting point, not legal advice.
How it works
-
Step 1
Tick the personal data you collect, where you keep it and who else gets it. Press Try an example to see a dental clinic in Pune.
-
Step 2
Work through the checklist. Each item names its section of the Act or its rule, or says it is our suggestion, and your ticks are saved in this browser.
-
Step 3
Copy or download the notice, consent text, cookie banner and breach plan, and have a lawyer check them before you publish them.
When the DPDP Rules apply
The DPDP Rules, 2025 were published in the Gazette on 13 November 2025. Rules 1, 2 and 17 to 21 applied at once, the Data Protection Board of India was set up the same day, and rule 4 applies one year later. Rules 3, 5 to 16, 22 and 23, including security safeguards (rule 6) and breach intimation (rule 7), apply eighteen months after publication: about 13 May 2027 by our count.
Consent, notice and children
Consent must be "free, specific, informed, unconditional and unambiguous with a clear affirmative action", and withdrawing it must be as easy as giving it. People must be able to read your notice in English or any language in the Eighth Schedule to the Constitution. For anyone under 18, you need verifiable consent from a parent or lawful guardian, and you may not track children, monitor their behaviour or target ads at them.
What this tool cannot do
It cannot tell you how the law applies to your business, whether you are a Significant Data Fiduciary, or whether an exemption covers you. The cookie banner and the items marked "our suggestion" are ours, not rules from the Act. We checked the Act, the Rules and PIB's summaries in October 2026, and the government can change the Rules. This is not legal advice: consult a lawyer.
Frequently asked questions
When does the DPDP Act apply to my business?
The DPDP Rules, 2025 phase in from their publication on 13 November 2025, which PIB describes as an 18-month phased compliance timeline. Rules 1, 2 and 17 to 21 applied at once, and rule 4 applies after one year. The rest, including the security and breach rules, apply eighteen months after publication, about 13 May 2027 by our count. Ask your lawyer which dates apply to you.
What must a consent request look like?
Consent must be "free, specific, informed, unconditional and unambiguous with a clear affirmative action", and cover only the personal data needed for the purpose you state. Our suggestion: a box the person ticks themselves, with marketing as a separate box. Withdrawing must be as easy as giving consent, so add an unsubscribe link and a "Cookie choices" link, and act on requests by email.
What do I do if customer data leaks?
Tell each affected person without delay, in plain language, and tell the Data Protection Board of India without delay. Within 72 hours of becoming aware of the breach, or longer if the Board allows it on a written request, send the Board the detailed report. The breach plan in this kit lists the steps and works out the deadline from the time you became aware.
What are the penalties under the DPDP Act?
The Schedule to the Act sets the most the Data Protection Board can impose: up to ₹250 crore for not taking reasonable security safeguards, up to ₹200 crore for not reporting a breach to the Board and the people affected, up to ₹200 crore for the duties on children, and up to ₹150 crore for a Significant Data Fiduciary's extra duties. PIB's summary gives up to ₹50 crore for other breaches.
Does the DPDP Act cover cookies and Google Analytics?
We found no rule written for cookies in the Act or the Rules. Our suggestion is to treat analytics and ad cookies like any other consent: keep them off until the visitor accepts, make rejecting as easy as accepting, and let visitors change their choice later. The banner in this kit does that. If you advertise to people in the EEA, the UK or Switzerland, Google also needs Consent Mode signals.
Sources and checks
Rules last checked
The DPDP Compliance Kit follows these official pages:
- The Digital Personal Data Protection Act, 2023 (meity.gov.in)
- Digital Personal Data Protection Rules, 2025 (egazette.gov.in)
- Government notifies DPDP Rules to empower citizens and protect privacy (pib.gov.in)
The cookie banner and the items marked "our suggestion" are ours, not rules from the Act. It is not legal advice.
Scores, limits and suggestions marked "our checklist", "our measure" or "our suggestion" are ours, not Google's or the platform's. How our tools work
Related reading
Rather have us do it for you?
Tell us about your business and what you want to fix. We reply within one business day.
Talk to us Our service: Technical SEO servicesMore free tools
All tools- Website SEO Audit Crawl up to 50 pages and get a health score, every issue and a 30-day plan.
- Redirect Checker Trace 301/302 redirects, chains and loops to the final URL.
- Robots.txt Tester Test a URL against robots.txt and see which rule blocks or allows it.
- AI Bot Log Analyzer See how AI crawlers crawl your site from your server access log.
Want us to fix what the tool found?
Tell us about your business and what you want to grow. We reply within one business day with next steps, not a sales script.
- A reply within one business day
- A quick look at your site and search visibility before we talk
- Your details are only used to answer your enquiry