India’s Digital Personal Data Protection Act, 2023 now has Rules. Implementation is staggered. Board pieces started earlier. The consent-manager framework is widely discussed around mid-November 2026. Broader notice, consent, security, and rights duties are expected to become enforceable later - commonly cited as May 2027. Confirm dates with your counsel. Do not wait for a fine to read the page.
If your website takes a name, phone, or resume, you are in the plot. You do not need a ₹250-crore scare story. You need a site that tells people what you collect, why, and how they can ask.
What a business site should show this quarter - A privacy notice a human can finish. - Consent that is not a pre-ticked box hiding in the footer. - A real contact for privacy questions - not a dead info@ alias. - Forms that collect only what the sales team uses. - Basic security: HTTPS, sensible access, no client files in a public Drive link.
What we will not pretend to be We are not your Data Protection Officer. We do not file with the Board. We build the pages, forms, and - when you need it - a simple request flow so “access / correction” is not a WhatsApp scramble.
Law firms, CA firms, and D2C stores all collect personal data. The copy changes. The job does not.
If you want the public-facing piece done without a 40-page policy nobody reads, talk to us or book a call with the forms you already run.