Get your website ready for the DPDP Act, in the language your users read
India's Digital Personal Data Protection Act obligations arrive in stages through 2027. We do the technical side for websites and apps: capture consent properly, log it, publish notices in your users' language, and build the flow that answers access and deletion requests.
For: Businesses collecting personal data through a website, app or form — clinics, schools, coaching centres, e-commerce, service businesses
The problem we usually walk into
Most Indian SMEs collecting names, phone numbers and Aadhaar copies have no idea they are Data Fiduciaries. The compliance vendors sell subscription dashboards aimed at digital-native startups in English, and nobody addresses the clinic in Kadapa with a paper form and a WhatsApp number — which is most of the country.
See what this costs \u2192What's included
Find what you actually collect
A map of every form, tracker, spreadsheet and WhatsApp flow that touches personal data, and where each one stores it.
Consent that would survive scrutiny
Specific, informed, itemised and withdrawable — captured with a timestamp and a record of exactly what was agreed, not a pre-ticked box.
Notices in your users' language
The Act contemplates notice in English or a language from the Eighth Schedule. We write and publish yours in Telugu, Hindi, Tamil or whichever your users read — which almost no vendor does.
Data request handling
A working route for someone to ask what you hold, correct it, or have it deleted — with deletion that actually removes it from backups and spreadsheets too.
Retention and deletion
Rules for how long each kind of record is kept, and automation that enforces them instead of relying on someone remembering.
Breach readiness
Logging, a simple internal procedure, and a drafted notification so you are not writing one under pressure.
How we work
In this order, because each step depends on the one before it.
- Step 1
Data mapping workshop
Half a day with your team tracing what you collect and why. This usually surprises the owner more than anything else.
- Step 2
Fix the collection points
Forms, consent capture, trackers and third-party scripts — changed in your actual website or app.
- Step 3
Build the rights flow
Access, correction and erasure requests routed to a named person with a working process behind them.
- Step 4
Document and train
A record of what was done, plus a short session so your staff know what to do when someone asks.
Questions we get asked
- Is this legal advice?
- No. We are engineers and this is the technical implementation — consent capture, notices, request handling, retention and deletion. For a legal opinion on your specific obligations, use a data protection lawyer. We work alongside yours happily.
- When do we actually have to comply?
- The DPDP Rules were notified in November 2025 and obligations phase in, with the substantive requirements landing in 2027. The practical answer is that the work takes weeks, so starting in the last quarter before a deadline is how people end up paying twice.
- We are small. Does it really apply to us?
- The Act reaches anyone processing personal data of people in India, and there are stricter rules for children's data — which puts schools, coaching centres and paediatric clinics squarely in scope. Size does not exempt you, though it does make the work much cheaper.
- Do we need a consent management subscription?
- Usually not. Those platforms suit companies with very high traffic and many data flows. A typical SME site needs consent captured and logged properly once, which is a build, not a monthly fee. We will tell you if you are the exception.
Tell us what you need
A 20-minute call, then a written fixed-price scope. No obligation.