DPDP Act and Website Analytics — A Practical Compliance Guide for Indian Businesses

India's Digital Personal Data Protection Act, 2023 (DPDP Act), together with the DPDP Rules notified in 2025, sets out how businesses must handle digital personal data. If you run analytics, heatmaps, or session recording on a website or app used by people in India, it applies to you.

Table of Contents

1. Key Terms in Plain Language
2. Is Analytics Data Personal Data?
3. Consent and Notice
4. Children's Data: A Special Caution
5. Data Principal Rights
6. Minimization and Retention
7. Practical Compliance Checklist
8. Key Takeaways

Key Terms in Plain Language

Is Analytics Data Personal Data?

Often, yes. IP addresses, device identifiers, user IDs from identify calls, and anything typed into forms can relate to an identifiable person. Session recordings can capture names, emails, or account details on screen unless masked.

Consent and Notice

The DPDP Act is consent-centric: consent should be free, specific, informed, unconditional, and unambiguous, given through a clear affirmative action, and preceded by a notice explaining what data is collected and why.

For analytics, that typically means:

1. A clear notice describing analytics and session recording.
2. Opt-in consent before recording, where consent is your basis.
3. An easy way to withdraw consent—as easy as giving it.
4. Recording that stops immediately on withdrawal.

DeepSync projects default to consent-required mode: the SDK collects nothing until your banner sends a consent signal, and withdrawing consent stops recording immediately. See consent modes and cookie consent setup.

Children's Data: A Special Caution

The DPDP Act requires verifiable parental consent for processing children's data and restricts tracking, behavioural monitoring, and targeted advertising directed at children. If your product serves users under 18—edtech, gaming, kids' content—review with counsel whether and how you can use session recording at all, and consider excluding those areas from recording.

Data Principal Rights

Visitors can request access to, correction of, and erasure of their personal data, and must have a way to raise grievances. For analytics, you should be able to:

• Find data tied to a person (via identified user ID)
• Export it
• Erase it

DeepSync supports GDPR/CCPA-style export and erasure, which also helps with DPDP requests—see export, erasure & retention.

Minimization and Retention

• Mask by default. DeepSync masks passwords, payment fields, and text inputs in the browser before anything is sent (PII masking).
• Mask extra elements that display personal data—account balances, names, IDs.
• Don't send unnecessary attributes in identify calls.
• Keep data only as long as needed—set retention to match your purpose.

Practical Compliance Checklist

• [ ] Privacy notice describes analytics and session recording in plain language
• [ ] Consent banner with opt-in, wired to the analytics consent call
• [ ] Withdrawal is easy and stops recording immediately
• [ ] Masking audited on pages showing personal data
• [ ] Children's sections reviewed or excluded
• [ ] Export and erasure process tested
• [ ] Retention period defined
• [ ] Vendor (processor) agreements in place
• [ ] Grievance contact published

Key Takeaways

• The DPDP Act applies to most analytics on Indian users.
• Use clear notices and opt-in consent; make withdrawal easy.
• Be especially careful with children's data.
• Mask by default, minimize what you send, and support erasure.

Conclusion

Privacy compliance and good analytics aren't opposites. With consent, masking, and minimization in place, you can understand your users and respect them at the same time.

Start free · Privacy best practices for session recording