Is Your Chatbot DPDP-Ready? A Practical Checklist for Indian Businesses
India's DPDP Act applies to chatbots that collect names, numbers or messages. A practical checklist covering notice, consent, retention, rights, children and vendors.
TL;DR: If your chatbot collects names, phone numbers, emails or chat messages from people in India, the Digital Personal Data Protection (DPDP) Act, 2023 applies. The DPDP Rules 2025 phase in obligations, with most expected to apply from May 2027. Start now with notice, consent, data minimisation, retention, rights handling, breach readiness and vendor contracts.
This article is general information, not legal advice. Speak to a lawyer about your specific situation.
Does the DPDP Act apply to my chatbot?
Very likely. The Act covers digital personal data, meaning any data about an identifiable person in digital form. A chatbot that captures a lead's name and number, or stores conversation history, processes personal data.
| Term | Who it is | In a chatbot context |
|---|---|---|
| Data Principal | The person the data is about | Your website visitor or WhatsApp customer |
| Data Fiduciary | Decides why and how data is processed | Your business |
| Data Processor | Processes data on the fiduciary's behalf | Your chatbot vendor, CRM, email provider |
| Consent Manager | Registered platform for managing consent | Optional, under the Rules |
What is the timeline?
Commentators describe a phased rollout under the DPDP Rules 2025 (Trilegal):
| Phase | What starts | Expected date |
|---|---|---|
| 1 | Data Protection Board provisions | November 2025 |
| 2 | Consent Manager framework | November 2026 |
| 3 | Most substantive obligations for fiduciaries | May 2027 |
Penalties under the Act are significant, reaching up to ₹250 crore for failing to take reasonable security safeguards. Preparing early is cheaper than retrofitting.
The chatbot checklist
1. Give notice before collecting data
Tell visitors, in plain language, what you collect, why, and how to exercise their rights. A short line in the chat welcome with a link to your privacy policy is a practical start:
We use your details to answer your enquiry and contact you. See our privacy policy.
2. Get clear consent where you rely on it
Consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action. On WhatsApp, record how and when the customer opted in, especially before sending marketing templates.
3. Collect only what you need
Ask for a phone number only if your team will call. Skip date of birth, address or ID numbers unless the service genuinely needs them.
| Purpose | Collect | Avoid |
|---|---|---|
| Call-back | Name, phone | Address, ID numbers |
| Quote | Requirement, budget range | Income details |
| Appointment request | Name, phone, preferred time | Detailed symptoms in chat |
4. Set retention periods and delete on time
Decide how long you keep conversations and leads, for example 12 months after the last contact, and delete after that. Data should not be kept once the purpose is served.
5. Support rights requests
People can ask to access, correct or erase their data, and must have a way to raise grievances. Make sure you can find and delete one person's conversations and lead records across your chatbot, sheets and CRM.
6. Protect the data and plan for breaches
Use access controls, strong passwords and limited team access. Under the Act, personal data breaches must be reported to the Data Protection Board and to affected people. Write down who does what if a breach happens.
7. Check your vendors
Ask your chatbot vendor where data is stored, who can access it, how deletion works and how they would notify you of a breach. Put a data processing agreement in place.
8. Be careful with children's data
If minors may use your chatbot, for example on a school or tutoring website, verifiable parental consent is required, and tracking or targeted advertising directed at children is restricted. Ask for a parent's contact rather than the child's. See chatbots for schools and colleges.
9. Think about cross-border transfers
If your vendor stores data outside India, check the Act's transfer conditions and any restrictions notified by the government.
A 30-minute audit of your current chatbot
| Check | Yes / No |
|---|---|
| Welcome message links to the privacy policy | |
| Lead form asks only for what we use | |
| WhatsApp opt-in is recorded | |
| We know where conversations and leads are stored | |
| We can delete one person's data everywhere | |
| A retention period is written down | |
| The vendor contract covers data processing | |
| Someone owns breach response |
How InfiBot helps
InfiBot lets you choose exactly which lead fields to collect, keeps each company's conversations, leads and files separate, lets you delete conversations and knowledge sources yourself, and delivers leads only to destinations you configure. The chat widget sets no cookies. Your own privacy notice, consent wording and retention policy remain your responsibility. Read our privacy policy.
Who in your team owns what
| Task | Owner | How often |
|---|---|---|
| Privacy notice and chat welcome wording | Marketing with legal review | When anything changes |
| Lead form fields | Sales lead | Quarterly review |
| Retention and deletion | Operations | Monthly clean-up |
| Rights and grievance requests | Named privacy owner | Within the required timelines |
| Vendor contracts | Founder or finance | At signing and renewal |
| Breach response | Named privacy owner with IT | Plan reviewed yearly |
Writing these owners down is one of the cheapest and most useful steps you can take now.
Frequently asked questions
Is the DPDP Act fully in force?
Not yet. Obligations are phasing in under the DPDP Rules 2025, with most expected to apply from May 2027.
Does it apply if my servers are outside India?
Yes, if you process personal data of people in India in connection with offering them goods or services.
Is a cookie banner enough?
No. Chatbot lead capture needs its own notice, and consent where you rely on it, at the point of collection.
Do I need a Data Protection Officer?
Only Significant Data Fiduciaries, designated by the government, must appoint one. Most small businesses won't be designated, but naming an internal privacy owner is good practice.
What about chat transcripts used to improve the bot?
Reviewing transcripts to fix answers is part of running the service, but keep access limited and apply the same retention period.