DPDP Act: Your Website Collects Data. Who Takes Responsibility for It? May cost a penalty of up to Rs 250 crore for weak data security.

Your Website Form Is Now Under the Law: What Every Business Owner Must Know Before 13 May 2027

If a customer’s data leaked from your website today, would your team know by tomorrow morning?

Most business owners say, "I’m not sure." That uncertainty could cost your business up to Rs 250 crore. Here is why.

Every time a visitor fills out an enquiry form on your website, you collect their name, phone number, and email. This is personal data. In India, this data is now strictly protected by law under the Digital Personal Data Protection (DPDP) Act, 2023.

The full rules come into effect on 13 May 2027, carrying a maximum penalty of up to Rs 250 crore for weak data security.

“We’re B2B businesses. This doesn’t apply to us.” .... It does.

Your clients are institutions & companies. But the people you call, email, and WhatsApp are individuals.

A dealer’s mobile number is personal data. A purchase manager’s email ID is personal data.

Yes. While your customers are companies, the individuals you interact with are human beings. A buyer’s mobile number or a dealer’s email ID constitutes personal data under the Act.

Where your business is vulnerable:

• Enquiry forms on your website
• Cookies and marketing tracking tools
• Email and WhatsApp marketing lists
• CRM software and sales databases
• Website hosting and cloud storage

Four questions every business owner must ask:

• Are we asking for clear consent? People must know why you’re taking their data, and say yes before you use it.
• Can they opt out easily? Leaving should be as easy as signing up.
• Is the data safe? Only the people who need it should be able to see it.
• Can we respond within 72 hours? If data leaks, you must inform the affected people and the Data Protection Board without delay, then file a full report with the Board within 72 hours.

The law allows penalties of up to ₹250 crore for weak data security.

But the bigger question isn’t the penalty. It’s trust.

You may have excellent products. Strong customer relationships. Decades of manufacturing experience.

One data breach can damage the trust you’ve spent years building.

At Appac Media, we build websites, custom software development, and cloud systems that are DPDP-ready by design, and we’re ISO 27001:2022 certified. Your lawyer signs off the policy. We make sure the technology backs it up.

Digital growth and digital responsibility must go together.

Don’t just build a digital business. Build one people can trust.

About 200 days to go. Where does your business stand today?