Secure your website in a weekend — the DPDP fast-track for Indian SMBs

DPDP compliance for a small Indian website is not a year-long programme — it's four concrete fixes, each shippable in under three hours, that move you from 'enforcement-risk' to 'defensible' for almost every realistic Board scenario. This guide is the weekend sprint we walk Indian SMBs through.

**Friday evening (90 minutes) — Banner.** Use the checkDPDP banner builder, pick your brand colors and the three cookies you actually set (analytics, marketing, session), verify ownership with the HTML file method, paste one script tag before </body>. Done. The banner mounts in a shadow DOM so it won't break your CSS, and the 'Secured by checkDPDP' footer doubles as a free signal to visitors.

**Saturday morning (90 minutes) — Privacy notice.** Run the scanner on your homepage. Wherever it returns Fail or Warning for 'privacy-notice', rewrite that page using the Section 5 itemisation template from our consent-notice guide. Name a Grievance Officer (it can be the founder for an SMB). Add the email and the 30-day response SLA. Push.

**Saturday afternoon (60 minutes) — Withdraw flow.** Add a single 'Manage cookies' link in the footer of every page. Click → re-opens the banner with the per-category toggles → user can switch off analytics or marketing without leaving the page. That's all Section 6 requires for most small sites.

**Sunday morning (90 minutes) — Breach playbook + processor inventory.** Make a one-page doc: list every external service that touches user data (Mailchimp, Google Analytics, Hotjar, payment gateway, hosting). For each, note whether you have a Data Processing Addendum on file. For the ones you don't, send the standard DPA request email. Then save our 72-hour breach template, fill in your team contacts, and put it in your Notion / Drive root so you can find it under pressure.

Sunday night, re-run the scanner. The score should jump 20–40 points. You won't be at 100/100 — getting there is a quarterly programme — but you'll be visibly trying, with documented controls, in a band where the Data Protection Board treats you as 'cooperating' rather than 'wilful'. That's the bar that matters under Section 33(2).