DPDP Act and your website chatbot: what Indian small businesses should do

This article is general information, not legal advice. Check the current text of the Act and Rules, or speak to a lawyer, before you rely on it for your business.

If your website has a chatbot that asks visitors for a name, phone number or email, you are collecting personal data. India's Digital Personal Data Protection Act, 2023 (DPDP Act) sets rules for how businesses handle that data, and the Rules that put it into operation are being phased in. Small businesses are not exempt just because they are small. This guide covers what a chatbot changes and a practical checklist.

Where a chatbot touches personal data

• Lead capture. Names, phone numbers and email addresses typed into the chat or a contact form.
• The conversation itself. Visitors often type personal details nobody asked for, such as a health issue, a budget or an address.
• Technical data. Anything the widget or your website stores in the browser, such as a session identifier.
• Third-party processing. The chatbot provider, an email service and an AI model provider may all handle the text.

The ideas in the Act that matter most

Notice before you collect

People should be told what data you collect and why, before or when you collect it. For a chatbot that means a short, plain-language line near the point of collection, linking to your privacy policy.

Consent for a stated purpose

You collect data for a purpose the person agrees to. If a visitor gives their number so you can call back about a trial, using it for unrelated marketing needs separate consent. Keep consent clear, specific and easy to withdraw.

Collect only what you need

Ask for a phone number if you will call, or an email if you will email. Do not require both just in case. The shorter the form, the smaller your exposure and the higher your completion rate.

Reasonable security

You are expected to protect the data you hold. The Act sets significant financial penalties for failing to take reasonable security safeguards, so choose providers that use encryption in transit and access controls, and limit who on your team can see conversations.

People can ask for correction and erasure

You need a way for someone to ask what you hold about them and to have it corrected or deleted. A named email address in your privacy policy is a reasonable starting point for a small business.

Children's data

The Act has stricter rules for data of children under 18, including verifiable parental consent. If your audience includes minors, such as a coaching centre or school, take extra care and do not collect more than you need.

A practical checklist for your chatbot

1. Add a notice line. For example in the greeting or beside the contact form: "We store this chat and any details you share to answer your question and contact you. See our privacy policy."
2. Update your privacy policy. Name the chatbot, the data it collects, why, who processes it and how long you keep it.
3. Ask for the minimum. Remove optional fields you never use.
4. Set a retention period. Do not keep chats forever. FiveMinChat deletes message history automatically after a period set by plan: 7 days on Free, 30 on Starter, 90 on Growth and a year on Pro.
5. Restrict access. Only people who need leads should have dashboard logins.
6. Plan for requests. Decide who answers a deletion or correction request and how quickly.
7. Review your providers. Know which companies process your chatbot data and where, and read their privacy terms.
8. Do not use chat data for unrelated marketing unless the person agreed to it.

What a chatbot provider should help with

When you compare chatbot tools, ask about data retention controls, who can access conversations, where data is stored, which AI provider receives the text, and how you can delete a person's data on request. A provider that cannot answer these clearly is a risk for you, because the responsibility for the data stays with your business.

Do not over-collect to look "smart"

A chatbot that asks for a name, phone, email, city and budget before answering anything will annoy visitors and add compliance weight. Let it answer first, then ask for contact details at the moment the visitor wants a callback.

Frequently asked questions

Does the DPDP Act apply to a small business with a chatbot?

It applies to businesses that process digital personal data, and a chatbot that collects names, phone numbers or emails is doing that. Check the current Rules for any exemptions and timelines, or ask a lawyer about your case.

Do I need a consent checkbox in my chatbot?

You need to give clear notice and have a valid basis for collecting the data. A visible notice line linked to your privacy policy, plus consent for any marketing use, is a sensible approach. Confirm the exact wording with your legal adviser.

How long should I keep chat history?

Keep it only as long as you need it for the purpose you stated. FiveMinChat deletes message history automatically after a period that depends on your plan, from 7 days on Free to one year on Pro.

Is this legal advice?

No. This article is general information. The Act and Rules are being phased in and details can change, so verify against the current official text.