The DPDP Act and website tracking: what Indian brands should check

What did the DPDP Rules change, and when?

The Digital Personal Data Protection Act was passed in 2023. The Rules that make it operational were notified by the Ministry of Electronics and Information Technology on 14 November 2025. As reported at the time, some provisions took effect immediately and the major obligations, including notices to individuals and the consent manager framework, were phased in over 12 to 18 months.

The Act provides for penalties of up to 250 crore rupees for certain failures by data fiduciaries. That is the ceiling, not the typical fine, but it explains why boards are asking about it. This page is general information, not legal advice.

Does website analytics involve personal data?

It can, and often does more than people assume. IP addresses, device identifiers tied to a person, email addresses captured in forms or URLs, recordings of what someone typed, and chat transcripts can all be personal data. A simple page view count with no identifier generally is not.

The practical question for each tool is what it stores about a visitor, whether that can be linked to an identifiable person, and for how long it is kept.

• Does it store IP addresses?
• Does it record sessions, keystrokes or form fields?
• Does it capture emails or phone numbers, and where?
• How long is data retained, and can it be deleted on request?

When is consent needed?

The Act's default basis for processing personal data is consent that is free, specific, informed and unambiguous, given for a stated purpose, with a few defined legitimate uses besides. Where a tool processes personal data for marketing or profiling, plan for a clear notice and consent. Where it processes no personal data, consent questions largely fall away, which is the cheapest compliance there is.

Ask your lawyer where each of your tools falls. The answer depends on configuration as much as on the vendor.

What should you ask every website vendor?

What exactly they collect by default and what can be switched off. Whether they store IP addresses. Whether data is encrypted at rest and under whose keys. Where it is processed. How long it is kept by default. How deletion requests are handled. And whether the tool can wait for your consent banner before acting.

How does IntellQ approach this?

IntellQ reads behavioural intent without trying to identify who a visitor is. It does not store IP addresses: country, region and city come from the CDN's geolocation headers. It does not record sessions or keystrokes, encrypts agent memory with AES-256-GCM under a key per workspace, expires behavioural data after a retention period of 180 days by default, and can be set to change the page only for visitors whose consent your banner has passed to it. An identified visitor exists only when your own server signs an assertion saying so.

What should a brand do this quarter?

List every script on your site and what each collects. Remove the ones nobody uses. For the rest, record the purpose, the data collected, where it is stored and for how long. That inventory is the starting point for any notice, consent design or deletion process your lawyer recommends, and it usually shrinks the problem considerably.

Revisit the inventory every quarter. Marketing teams add tags for campaigns and forget them, and each forgotten tag is a data flow you are responsible for. A short review that removes unused scripts also tends to make the site faster, which helps conversion as well as compliance.