If your website has a contact form, a newsletter signup, or a WhatsApp button, you are already collecting personal data, and India's DPDP Act already applies to you. You don't need a legal team or a Data Protection Officer to comply — those apply mainly to large-scale “Significant Data Fiduciaries.” You need an honest privacy policy that names exactly what you collect and why, and a short consent line placed next to every form on your site, not buried in a footer link nobody reads.
Open the footer of almost any small business website in India and you'll find a “Privacy Policy” link. Click it, and there's a fair chance the page still talks about cookies the site doesn't use, a newsletter that doesn't exist, and “third parties” that are never named — because it was copied from a free template in an afternoon, years ago, and never opened again.
That habit used to be low-risk. It's a weaker position now that India has an actual data protection law with teeth: the Digital Personal Data Protection Act, 2023, backed by the Digital Personal Data Protection Rules, 2025, which are being rolled out in phases. The good news for a small consultancy, clinic, or agency website is that the Act doesn't demand a compliance department. It demands honesty about four or five simple things — which a copied template, by definition, cannot give you.
You Are A “Data Fiduciary” The Moment You Collect A Name And A Phone Number
Under the DPDP Act, the business collecting personal data is called a Data Fiduciary, and the person it belongs to is the Data Principal. There is no minimum size for this: a solo dietitian collecting a client's name and phone number through a WhatsApp link is a Data Fiduciary in exactly the same sense a bank is, though the two carry very different levels of obligation. The Act's heaviest requirements, like appointing a Data Protection Officer, apply only to businesses the government separately designates as a Significant Data Fiduciary, based on the scale and sensitivity of the data they handle — a category almost no small local service business falls into.
| What It Should Show | Copied Template Policy | An Honest, Site-Specific Policy |
|---|---|---|
| What data is collected | Vague — “we may collect information you provide” | Specific — name, phone number, email, via the contact form and WhatsApp |
| Consent language | Buried in a page nobody opens | A short line placed right next to every form |
| Who to contact about privacy | Missing, or a generic “support@” nobody checks | A named person or a real, monitored email address |
| How long data is kept | Unspecified, or copied wording about “as required by law” | A plain sentence — kept only as long as needed to respond and follow up |
| Whether data is sold or shared | Unclear, sometimes contradicts itself | Explicit — not sold; shared only with tools used to respond, like WhatsApp or email |
A Contact Form, A Newsletter Box, Or A WhatsApp Button Is Already “Data Collection” Under The Act
It's easy to assume a data protection law is written for e-commerce stores handling payment details, or apps tracking location. In practice, the DPDP Act's definition of digital personal data is much wider: any name, phone number, or email address a person types into your site, in any form, counts. That includes a plain “Get in Touch” form, a newsletter signup, an appointment booking box, and a WhatsApp chat that starts from a pre-filled link on your homepage.
This is why the size of the business isn't the deciding factor. A five-page website for a single consultant that only ever collects a name and a phone number is doing the same category of thing, under this law, as a much larger platform — just at a far smaller scale, and with far lighter obligations attached to it.
A Copied Privacy Policy Template Describes A Website You Don't Run
The problem with a free privacy policy generator isn't that it's free — a generated starting point is a reasonable way to begin. The problem is stopping there. A generic template is written to cover every possible website: e-commerce carts, cookie banners, third-party ad networks, newsletter platforms. If your actual site is five pages, a contact form, and a WhatsApp button, a policy still describing carts and cookies you don't have isn't neutral boilerplate — it's a page that visibly wasn't written for your business, by anyone, ever.
A visitor who's paying attention notices that mismatch, even without knowing the DPDP Act exists. It reads the same way a testimonial with no name reads: technically present, functionally hollow.
You do not need a legal team to comply with the DPDP Act. You need four honest sentences near every form on your site, and a privacy policy that actually describes what your business does with a name and a phone number.
A Consent Line Next To The Form Matters More Than The Policy Page Itself
The DPDP Act asks for consent that is specific and informed, given through a clear affirmative action — not a policy a visitor is assumed to have read because a link existed somewhere on the site. In practice, that means the most important sentence on your website about data isn't on the privacy policy page at all. It's the one line sitting directly above or below your contact form, the one a visitor actually sees at the exact moment they're about to type their phone number in.
A privacy policy page that visitors never open is still worth having — it's where the fuller detail lives, and where a visitor who does want to check goes to find it. But it cannot do the job of the short consent line on its own.
Two websites, the same contact form
A privacy policy dated 2019, mentioning cookies the site doesn't use, with no reference to WhatsApp at all. The contact form has a “Submit” button and nothing else.
Above the form: “By submitting this form, you agree to be contacted by phone, email, or WhatsApp about your enquiry. See our Privacy Policy.” The policy itself names the business's actual data practices, dated and specific.
A WhatsApp-First Website Still Needs To Say So In Writing
This blog has argued elsewhere that a pre-filled WhatsApp link converts better than a traditional contact form for most small Indian service businesses. That argument doesn't change here — it adds one more thing your privacy policy needs to mention by name. The moment a visitor sends a name or number through a wa.me link, that's personal data collection, the same as a form field, and a policy that only describes “information submitted via our contact form” is describing an incomplete version of the site.
The fix costs one sentence: naming WhatsApp specifically, alongside the contact form and any newsletter signup, as a channel through which the business collects a visitor's name and number, and stating plainly that it's used only to respond to that enquiry.
List exactly what you collect, nothing invented, nothing vague
Name, phone number, email, WhatsApp number. If a form field asks for it, it belongs on this list; if it isn't on this list, don't ask for it on the form.
Say why you collect it, and keep the reason genuinely narrow
“To respond to your enquiry and follow up about our services” is honest for most small businesses. Don't add a hidden secondary use you don't actually perform.
Put a one-line consent notice next to every form, not just a footer link
A visitor should see the consent line at the moment they're about to submit their details, not have to go looking for it separately.
Name a real contact for privacy questions
Even a founder's own monitored email address is enough for a small business. What matters is that it's a real inbox someone actually checks, not a placeholder.
State plainly how long you keep data, and that you don't sell it
“We keep your details only as long as needed to respond and follow up, and we do not sell your information” covers what most visitors actually want to know.
Update the date whenever your practices genuinely change
A policy dated this year, describing this year's actual site, is more credible on sight than a static one — and it's the difference a careful visitor is actually looking for.
Specific, Checkable Disclosures Build The Same Trust As Specific Results
This blog has made the same argument twice before, about case studies and about pricing: a specific, checkable detail earns more trust than a vague promise ever does. The two verified client results we cite anywhere on this site exist for exactly that reason — Hamara Ashiyana, taken from zero to a #1 Google ranking for its target keywords, and Hashika Vyas DT, a Mumbai-based clinical dietitian who signed 39 new clients in 90 days and grew from 75 to 1,145 Instagram followers.
A privacy policy works on the same logic. “We may collect information you provide” asks a visitor to trust you with no detail to check. A policy that specifically names a contact form, a WhatsApp number, and a real reason for collecting both gives them something concrete instead — and a business precise about how it handles a phone number tends to read as precise about everything else it does, too.
Questions business owners ask about privacy policies and the DPDP Act
Does a small business website in India legally need a privacy policy page?
Yes, if it collects any personal data — which almost every small business site does the moment it has a contact form, a newsletter signup, or a WhatsApp button. Under India's DPDP Act, a business becomes a Data Fiduciary the moment it collects digital personal data, regardless of its size, and a privacy policy page is the standard way of meeting the Act's notice requirement.
Do I need a Data Protection Officer or a compliance team for a small website?
No. The DPDP Act's heavier obligations, like appointing a Data Protection Officer and running data protection impact assessments, apply mainly to businesses the government designates as a Significant Data Fiduciary, based on the volume and sensitivity of data they handle. A small business collecting names and phone numbers through a contact form needs a clear, honest policy and a real contact for privacy questions, not a compliance department.
Does a WhatsApp button on my website count as personal data collection?
Yes. The moment a visitor sends their name or number through a pre-filled wa.me link or a WhatsApp chat started from your site, that is digital personal data collection under the Act, in the same way a contact form is. A privacy policy that only mentions a contact form and says nothing about WhatsApp is describing an incomplete picture of what the site actually does.
Can I just use a free privacy policy generator?
A generator gives you a legally-shaped starting point, not a finished policy. It becomes a real, accurate privacy policy only once you edit it to match what your specific site actually collects, why, and for how long — a generated policy that still mentions cookies, carts, or newsletters your site doesn't have is worse than no policy at all, because it signals the page was never actually read.
What happens if my website's privacy policy is inaccurate or missing?
That is a legal compliance question specific to your business, not something a blog post can answer with certainty — India's rules under the DPDP Act are still being rolled out in phases, and outcomes depend on the specifics of what data is involved. If you are genuinely unsure whether your website is compliant, that is worth a short conversation with a lawyer or a compliance consultant, rather than relying on generic advice, including this article.
Not Sure If Your Website's
Privacy Policy Actually Holds Up?
Send us your current privacy policy and your contact form on WhatsApp, and we'll tell you plainly what it's missing and what to add.
Get Your Privacy Policy Checked