India's Digital Personal Data Protection Act was passed in 2023, but it couldn't really take effect until the government published the rules explaining how it works. Those rules have now been notified, with obligations coming into force in phases over the next year or so.
We're web developers, not lawyers, so please treat this as a practical starting point, not legal advice. But nearly every website collects personal data through a contact form, so this affects almost every business we work with.
What counts as personal data?
Anything that identifies a person: name, phone number, email address, address, photos, and even things like IP addresses in some contexts. If your contact form asks for a name and phone number, you're collecting personal data.
The key ideas, simplified
Consent must be clear. People should know what data you're collecting, why, and agree to it freely. A pre-ticked box doesn't count.
Collect only what you need. If you only need a phone number to call someone back, don't ask for their date of birth and address.
Use it only for the stated purpose. Data collected for a quote request shouldn't quietly end up in a marketing list.
Keep it safe. You're expected to take reasonable security measures to protect the data.
People have rights. They can ask what data you hold, ask you to correct it, and ask you to delete it.
Breaches must be reported. If personal data is leaked, there are notification requirements.
What we're changing on client websites
1. A clear notice near every form. A short line explaining what the data will be used for, with a link to the privacy policy. For example: "We'll use your details only to respond to your enquiry."
2. Separate consent for marketing. An unticked checkbox: "Send me occasional updates and offers." Not bundled with the main form.
3. An updated privacy policy. In plain language, listing what's collected, why, how long it's kept, who it's shared with (email providers, CRMs, WhatsApp), and how to contact you.
4. Fewer form fields. We review every form and remove fields that aren't really needed.
5. Secure storage. HTTPS everywhere, database access restricted, admin panels protected with strong passwords and two-factor login, and old enquiries cleared out after a set period.
6. A way to request deletion. Even a simple email address listed in the privacy policy, with someone responsible for responding.
Don't forget the hidden data
Personal data isn't only in your forms. Check:
- Old enquiries sitting in your website database for years
- Email inboxes with years of form submissions
- Spreadsheets exported from the website and shared around
- Analytics and tracking tools
- Chat widget transcripts
Start now, even with the phased timeline
Most of these changes are small and inexpensive. Updating forms and a privacy policy is a day or two of work for a typical site. Doing it now, calmly, is much better than rushing later. And customers increasingly notice which businesses treat their information with respect.
