DPDP Rules 2025: What Indian Businesses Must Fix in Their Websites, Apps & Software Before May 2027

India’s Digital Personal Data Protection (DPDP) Rules, 2025, are changing how organisations collect, use and protect personal information. For businesses using websites, mobile apps, CRM, ERP and Learning Management Systems (LMS), this is also a technology-readiness issue.

A business may collect contact details through forms, record enquiries in a CRM and store customer records in an ERP. Schools may hold student profiles and parent details in an LMS. Organisations need to know what they collect, why, who can access it and how long it is retained.

The Act and Rules establish India’s framework for processing digital personal data. Their phased commencement gives organisations time to prepare, but system changes and testing should begin early.

This guide covers the key dates, affected businesses and practical technology changes.

1. What are the DPDP Act and Rules 2025?

The Digital Personal Data Protection Act, 2023, sets out the legal framework for processing digital personal data in India. The DPDP Rules, 2025, provide operational detail for several requirements.

The Act calls an organisation that determines why and how personal data is processed a “Data Fiduciary”. Using an external vendor or cloud provider does not automatically remove the organisation’s responsibilities.

The framework covers data collected digitally and information collected offline but later digitised. It can also apply to overseas processing connected with offering goods or services in India. A coaching institute or retailer should assess its activities and any applicable exemptions.

2. DPDP Act compliance timeline: three important dates

The Act and Rules were notified in the Gazette on 13 November 2025. Their provisions do not all commence on the same day.

The official notifications specify commencement on publication, after one year and after eighteen months. Some secondary commentary refers to 14 May 2027, but the Gazette notifications are dated 13 November 2025 and specify eighteen months from publication. Plan to be ready before 13 May 2027.

MeitY+1

The November 2026 milestone concerns Consent Managers, not the commencement of every business consent obligation.

3. Who should prepare for DPDP compliance?

Any organisation processing digital personal data within the Act’s scope should assess its responsibilities. This can include e-commerce businesses, hospitals, educational institutions, software companies, professional services firms, marketing agencies, startups and small businesses.

There is a common misconception that only companies with turnover above ₹2 crore need to consider DPDP compliance. The Act does not establish a general ₹2 crore turnover threshold for applicability. The relevant question is whether the organisation processes digital personal data in circumstances covered by the law. Specific exemptions may apply, but businesses should not assume that their size alone excludes them.

List where information enters the organisation, such as contact forms, purchases, apps, student portals and employee systems. Then map where it goes: one form submission may reach email, a CRM, a spreadsheet and analytics tools.

4. What should businesses change on their websites?

A privacy policy alone is not a complete compliance programme. Review how the website collects information and which tools receive it.

Clear notices and purposeful forms

Explain what information a form collects and why it is needed. If a service enquiry form asks for a name, business email, phone number and project description, tell visitors how those details will be used. Avoid collecting information unrelated to the stated purpose.

The Rules require clear, independently understandable notices explaining the personal data and processing purposes. Review forms, landing pages, newsletter sign-ups, chat widgets and account creation screens.

Consent management and marketing tags

Websites commonly use Google Analytics, Meta Pixel, remarketing tags and chat tools. Inventory these scripts and identify what information they receive.

Where consent is the basis for processing, applicable optional tags should respect the visitor’s choice and not run before required consent. A consent management platform can record preferences and support withdrawal.

Google Consent Mode v2 communicates choices to supported Google tags; it is not a DPDP compliance solution or a technology expressly mandated by the Act. Businesses must still assess their purposes, legal basis and data flows. If fewer visitors agree to optional tracking, observable GA4 data and campaign comparisons may change.

Withdrawal, correction and erasure

Provide a usable route for people to exercise applicable rights. Decide how requests are authenticated, assigned, tracked and completed across connected systems.

Include these requirements in a website revamp brief. Explore IPIX web development services when planning forms and integrations.

5. Mobile apps, CRM and ERP: follow data beyond the website

Personal information rarely stays in one place. A lead may move from a landing page to a CRM and then to billing or ERP software. Mobile apps may collect account details, device permissions and location information. Compliance planning should follow these data journeys.

CRM and ERP systems should help identify a person’s records, restrict access, apply retention rules and handle correction or erasure requests. Where information is synchronised, define how changes reach connected systems; deleting one record may leave unnecessary copies elsewhere.

App teams should review registration, permissions, notifications, analytics SDKs and integrations. Each permission should be necessary and explained.

The Rules require reasonable safeguards such as encryption or masking, access controls, monitoring, backups and appropriate processor contracts. Maintain relevant logs and document system access.

A breach response plan is essential. Inform affected individuals and the Board without delay; provide detailed information to the Board within 72 hours unless it allows more time. Assign owners for investigation and communications.

MeitY+1

These requirements should be considered when upgrading mobile applications, CRM and ERP platforms, not added as an afterthought.

6. Why schools and LMS platforms need particular attention

Schools may process children’s names, dates of birth, parent contacts, attendance, grades, assessments, photographs and learning activity. Under the Act, a child is below 18 years of age.

Section 9 requires verifiable parental consent before processing a child’s personal data, subject to applicable exemptions. It also restricts harmful processing, tracking, behavioural monitoring and targeted advertising directed at children, subject to specified exceptions.

IndiaCode+1

An LMS should support parental consent where required and distinguish student, parent, teacher and administrator accounts. Access should match each role. Institutions should define retention periods, protect student records and review third-party video, analytics, messaging and advertising tools.

Privacy belongs in product requirements: account design, parent portals, reporting, data exports, retention and security should be considered together. Schools reviewing their digital learning infrastructure can explore IPIX Learning Management System, assessing its capabilities against their own requirements.

7. Penalties under the DPDP Act

The Act’s Schedule sets maximum monetary penalties for specified breaches. These are potential maximum amounts, not automatic fines imposed whenever an organisation makes a mistake.

The Schedule also sets a maximum of ₹10,000 for breach of a Data Principal’s duties. Penalties are determined through the statutory process.

India Code+1

Weak access controls, untested backups and missing incident procedures create operational risks beyond potential fines.

8. A practical 90-day DPDP readiness checklist

A 90-day programme can organise preparation, but does not guarantee legal compliance. Review the work with qualified legal or privacy advisers.

Days 1–30: Map the data

• List websites, apps and internal systems collecting personal data.
• Record collection purposes and map storage, sharing and transfers.
• Inventory analytics, advertising and other third-party tools.
• Identify children’s data and review notices and processor contracts.

Days 31–60: Design the changes

• Prepare clear notices and consent/withdrawal records.
• Define processes for access, correction and erasure requests.
• Set retention rules and remove unnecessary copies.
• Review permissions, security controls and breach-response owners.

Days 61–90: Build and test

• Implement priority website and app changes; test consent and tags.
• Test requests across systems and review backups, logs and access.
• Test parental consent where relevant; practise breach response.
• Train employees and record remaining gaps, owners and deadlines.

The output should be an action plan with owners and deadlines. Vendor dependencies or legacy systems may require more than 90 days.

9. Frequently asked questions

Is DPDP compliance mandatory for small businesses?

The Act does not set a general ₹2 crore turnover threshold. A small business should assess whether it processes digital personal data within the Act’s scope and whether a specific exemption applies.

When do the main DPDP obligations commence?

The principal provisions of the Act and Rules are scheduled to commence eighteen months after publication of the notifications dated 13 November 2025, which is 13 May 2027. Consent Manager-related provisions have a one-year commencement milestone.

Does every website need a cookie banner?

The Act does not prescribe one universal banner design. Businesses must assess their data, purposes and legal basis. Where consent is required, they must obtain and respect it; a banner alone does not establish compliance.

Does DPDP apply to student information stored in an LMS?

Yes, where the platform processes digital personal data within the Act’s scope. When information relates to children, the additional requirements in Section 9 and applicable Rules must also be considered, including verifiable parental consent subject to exemptions.

What is the maximum DPDP penalty?

The maximum penalty for failure to take reasonable security safeguards is ₹250 crore. Other categories have different maximum amounts, including ₹200 crore for specified breach-notification and children’s-data violations.

10. Prepare your technology before the deadline

DPDP readiness is not only a legal-team task. Management, marketing, developers, IT administrators, vendors and employees who handle personal information all have a role. The organisation must understand its data flows and ensure systems support the processes it promises users.

Websites may need clearer notices and request workflows; apps may need permission reviews; CRM and ERP platforms may need access controls and coordinated deletion; schools need particular care with parental consent and student data.

IPIX Technologies works across website development, mobile applications and business software. Organisations planning a revamp or platform upgrade can use this opportunity to review technical requirements before development begins.

Planning to assess your website, app or business software? Contact IPIX Technologies to discuss a technology-readiness review and identify the development work your organisation may need before the DPDP deadlines.

Disclaimer: This article provides general information and is not legal advice. Applicability, exemptions and obligations depend on the facts and current law. Consult a qualified legal professional for advice specific to your organisation.