IT Act 2000 Compliance Checklist: Essential Legal Requirements for Indian Websites

If you run a website for your Indian business — one that has a contact form, collects email addresses, processes payments, or stores customer information — you have legal compliance obligations.

Most Indian small business owners don’t know this. Even fewer have taken steps to comply. And the penalties for non-compliance under the newest regulations can reach up to ₹250 crore.

This article breaks down the key laws, explains what they mean for your website in plain English, and gives you a practical checklist to work toward compliance.

Disclaimer: This article is for educational purposes only and does not constitute legal advice. For specific compliance questions, consult a qualified legal professional familiar with Indian IT and data protection law.

The Three Laws That Affect Your Website

1. The Information Technology Act, 2000 (IT Act)

The IT Act is the foundational law governing cybersecurity and electronic transactions in India. Key provisions relevant to website owners:

• Section 43A — If your business handles “sensitive personal data” and fails to implement “reasonable security practices,” you are liable for damages to affected individuals. There is no monetary cap specified in this section, making it particularly significant.

• Section 72A — Disclosure of personal information in breach of a lawful contract is punishable with imprisonment up to 3 years and/or a fine up to ₹5 lakh.

• Reasonable Security Practices (Rule 8) — The IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 define “reasonable security” as implementing IS/ISO/IEC 27001 or equivalent security standards. This includes having a documented information security policy and programme.

What this means for your website: If your website collects sensitive data (passwords, financial information, health data, biometrics) and you don’t have documented security practices in place, you can be held personally liable for any breach.

2. The Digital Personal Data Protection Act, 2023 (DPDPA)

The DPDPA, which was notified in August 2023 and whose rules are being finalised, is India’s comprehensive data privacy law. It affects every website that collects personal data from Indian users — which includes anyone with a contact form, newsletter signup, or customer login.

Key requirements:

• Consent: You must obtain clear, informed consent before collecting personal data. Pre-ticked boxes and buried clauses don’t count.

• Purpose limitation: You can only use collected data for the specific purpose you stated when collecting it.

• Data minimisation: Only collect data that you actually need. If your contact form asks for date of birth and you have no reason to need it — you’re over-collecting.

• Right to erasure: Users must be able to request deletion of their personal data, and you must comply.

• Breach notification: In the event of a data breach, you must notify both the Data Protection Board of India and the affected individuals.

• Penalties: The DPDPA specifies penalties up to ₹250 crore for significant non-compliance. Even for smaller businesses, penalties can be substantial.

What this means for your website: You need a proper privacy policy, a consent mechanism for data collection, and the technical infrastructure to protect and manage the data you collect.

3. CERT-In Directions (April 2022)

The Indian Computer Emergency Response Team issued mandatory cybersecurity directions that apply to all Indian businesses with a digital presence:

• Incident reporting: Cybersecurity incidents must be reported to CERT-In within 6 hours of discovery.

• Log retention: You must maintain server logs for a rolling period of 180 days within Indian jurisdiction.

• Time synchronisation: All IT systems must synchronise with NTP servers provided by CERT-In or NIC to ensure accurate timestamps for incident investigation.

What this means for your website: If your website is hacked and you discover it 3 weeks later because you had no monitoring in place — and then you can’t provide server logs because your hosting provider stores them overseas — you’re in violation of these directions.

The Practical Compliance Checklist for Your Website

Here’s what you need to actually do. This isn’t about checking boxes — it’s about protecting your business and your customers:

📄 Privacy Policy (Required)

Your website must have a published privacy policy that:

• States what personal data you collect
• Explains why you collect it
• Describes how you store and protect it
• Lists who you share it with (third-party services, payment gateways, analytics)
• Explains how users can request access to or deletion of their data
• Identifies your “Data Fiduciary” (typically the business entity)

The privacy policy must be in clear, plain language. Legalese that no one can understand doesn’t fulfil the spirit of the law.

🔐 Data Security (Required)

“Reasonable security practices” under the IT Act include:

• SSL/TLS encryption on all pages (not just the checkout page — all pages)
• Encrypted data storage for sensitive information
• Access controls — ensure only authorised personnel can access customer data
• Regular security audits — documented proof that you’re actively monitoring and improving security
• Incident response plan — a documented procedure for what to do when a breach occurs

If you’re using WordPress, this translates to: strong hosting security, a Web Application Firewall, daily malware scanning, and encrypted backups.

🏠 Data Residency (Strongly Recommended)

While the DPDPA doesn’t currently mandate that all data remains within India (the government can specify restricted countries through rules), hosting your website and its data on Indian servers provides several advantages:

• Compliance with CERT-In’s 180-day log retention requirement (within Indian jurisdiction)
• Faster response to legal data requests from Indian authorities
• Easier demonstration of “reasonable security” under the IT Act
• Better performance for Indian visitors (lower latency)

If your website is currently hosted on a US or European server, consider migrating to an Indian data centre. This single step addresses multiple compliance requirements simultaneously.

📋 Consent Mechanism (Required under DPDPA)

Your website needs to obtain valid consent before collecting personal data. This means:

• Cookie consent banner — if you use Google Analytics, Facebook Pixel, or similar tracking tools, you need informed consent before setting tracking cookies
• Form consent — contact forms and newsletter signups should explicitly state what you’ll do with the submitted data
• Opt-in, not opt-out — consent must be affirmative. Pre-checked boxes are not valid consent.

📊 Logging and Monitoring (Required under CERT-In)

As per CERT-In directions:

• Enable and retain server access logs for 180 days
• Synchronise server time with Indian NTP servers
• Implement real-time monitoring that can detect security incidents promptly

What Most Indian Small Businesses Get Wrong

Based on our experience maintaining Indian business websites, here are the most common compliance gaps:

• No privacy policy at all — We regularly encounter business websites that collect customer data through contact forms but have no published privacy policy. This is the most basic and most common failure.

• Privacy policy is a copy-paste template — A generic privacy policy that mentions “cookies” and “GDPR” but says nothing specific about your actual data practices provides minimal real protection. And it’s often obviously written for a different business in a different country.

• Hosting on overseas servers — Many Indian businesses don’t even know where their website is hosted. If your hosting control panel shows your server is in “us-east-1” or “eu-west-2,” your data is not in India.

• No logging or monitoring — Without uptime monitoring, malware scanning, and access logging, you have no way to detect incidents — let alone report them within 6 hours.

• No incident response plan — If your site is hacked tomorrow morning, do you know what steps to follow? Who to contact? How to notify affected users? Most businesses don’t.

A Reasonable Path Forward

Full compliance doesn’t happen overnight, and for many small businesses, it’s an ongoing process. Here’s a pragmatic roadmap:

Month 1:

• Publish a proper privacy policy (specific to your business, not a template)
• Install SSL if you don’t have it
• Implement a cookie consent banner
• Verify where your website is hosted

Month 2:

• Migrate to Indian hosting (if currently overseas)
• Enable server logging and set up basic uptime monitoring
• Audit your forms — remove unnecessary fields, add consent language

Month 3:

• Implement a Web Application Firewall and malware scanning
• Set up automated daily backups (encrypted, offsite)
• Document your security practices and incident response plan

Ongoing:

• Quarterly security audits
• Keep WordPress core, themes, and plugins updated
• Review and update your privacy policy when you add new tools or services

This roadmap isn’t about achieving perfection — it’s about demonstrating consistent, documented effort toward compliance.

Compliance as a Competitive Advantage

Here’s a perspective shift: in a market where most competitors don’t even have a privacy policy, demonstrating compliance sets you apart. It tells your customers:

• You take their data seriously
• You operate professionally
• You’re invested in long-term trust, not just short-term sales

For businesses that work with larger clients or government entities, compliance isn’t optional — it’s a requirement for vendor empanelment.

At SiteSuraksha, Indian data residency is built into every plan. Every site we manage is hosted in our Kochi or Mumbai data centres, with encrypted backups, 24/7 monitoring, server logging, and WAF protection — all the technical building blocks of a compliant infrastructure. See our plans →

SiteSuraksha provides IT Act-aligned hosting and maintenance for Indian businesses. secure cloud architecture. Enterprise-grade security. Talk to our compliance-aware team →