MAKIN 
The deadline is closer than it looks.
The Digital Personal Data Protection Rules were notified on 14 November 2025 with an 18-month phase-in. Consent manager provisions start on 14 November 2026, and the core duties, user rights, breach rules and penalties apply from 14 May 2027. If your business collects names, phone numbers or emails through a website, an app, WhatsApp or a CRM, the rules apply to you, and six months goes quickly once you count the time to find the data, change forms and software, and train staff.
Who this applies to.
Any business that decides why and how personal data is used is a data fiduciary under the Act: a clinic booking form, a real estate lead list, an online checkout, a coaching app. Size does not exempt you. The heavier extra duties fall on significant data fiduciaries, which the government names itself, so most small businesses will not carry those.
Consent has to be provable, and easy to take back.
Where you rely on consent, it must be free, specific, informed and given by a clear action, such as a box the user ticks. Pre-ticked boxes and banners that say using the site means agreeing do not count. Withdrawing consent should be as easy as giving it: if signing up took one tap, leaving should not take an email chain.
Keep less, protect it, and answer requests.
Data has to be deleted once its purpose is over, unless another law requires you to keep it. You must keep reasonable security safeguards and, after a breach, tell affected people without delay and report to the Data Protection Board. People can ask to see, correct or erase their data, and you need a named contact to answer them. The largest penalty, for failing to keep reasonable security safeguards, is up to 250 crore rupees.
Other duties to know
Two more rules catch businesses out:
- A plain notice: say what you collect, why, and how to complain, in clear language; a user can ask for it in any of the 22 languages of the Eighth Schedule
- Children’s data: anyone under 18 is a child, processing their data generally needs verifiable parental consent, and tracking or targeted ads aimed at children are restricted
- Vendors: you stay responsible for personal data your software providers and agencies process for you
A six-step plan to start now
Most businesses can do the bulk of the work in a few weeks, in this order:
- Map the data: every website form, landing page, WhatsApp number, lead source, app and spreadsheet where personal data comes in
- Fix the forms: add an unticked consent box with a one-line purpose and a link to your notice
- Rewrite the privacy notice: short, specific, with a contact for complaints, and nothing you do not actually do
- Add search, export and delete to your CRM so one person’s data can be found and removed on request
- Set retention rules for leads, customers and job applicants, then automate the clean-up
- Ask each vendor how they store and delete the data they hold for you
Do not want to pay a monthly fee for compliance software?
Many consent and privacy tools charge every month, for as long as you use them. We build the consent forms, consent records and deletion tools into your own website and CRM as a one-time project, so you own them and pay no recurring licence to us. Contact MakinForU for a fixed, written quote.
How we help
A software audit maps the personal data your website, app and CRM collect and lists what has to change. If leads sit in spreadsheets and inboxes, a custom CRM can find, export and delete one person’s records on request.
This article is a practical guide, not legal advice. Check the notified Rules or speak to a lawyer about your own case.