DPDP Act and Live Chat: India’s Privacy Law for Chat Widgets

DPDP Act live chat questions are arriving at any business that talks to customers in India. The Digital Personal Data Protection Act, 2023 is India’s first general data protection law, and a chat widget handles exactly the data it covers: names, phone numbers, e-mail addresses, order details and whatever a visitor decides to type. This guide explains the parts of the law that matter for chat, shows what to put in your notice and settings, and says where a lawyer should check the details. It is a practical overview, not legal advice, and some provisions are being brought into force in stages.

Talkmio is an AI live chat for websites. Its assistant, Mio, answers visitors in their own language, including Hindi and English, from your website, FAQ and uploaded documents, and hands the conversation to your team when it cannot answer. Data is stored on servers in the EU, in Germany, a fact that matters for the transfer question later in this article.

What the Act Covers and the Words It Uses

The Act applies to digital personal data processed in India. It also reaches processing outside India when it is connected with offering goods or services to people in India, so a foreign shop or software company with Indian customers should assume it is in scope and check. The central government’s data protection framework page collects the Act, the rules and related notices, and the overview of the Act gives a neutral summary.

Learn the vocabulary first. A Data Principal is the person the data is about, such as a visitor in your chat. A Data Fiduciary decides why and how personal data is processed, which is you as the business. A Data Processor handles data on a fiduciary’s behalf, which is the role of a chat provider. The Act also creates a Data Protection Board to supervise compliance and hear complaints. These terms replace the controller and processor language of European law, although the ideas are similar.

DPDP Act Live Chat: Obligations in Plain Words

Idea in the Act	What it means for a chat	What to do
Notice	Tell people what you collect, why, how to withdraw and how to complain	Link a clear notice from the chat and the footer
Consent	Free, specific, informed and unambiguous, for a stated purpose	Ask only for data you need; never bundle unrelated purposes
Withdrawal	Withdrawing must be as easy as giving consent	Offer a simple route, such as a contact address
Purpose and minimisation	Use data only for the stated purpose and no more than needed	Keep the pre-chat form short
Children	Special rules for minors, with parental consent	Avoid collecting children’s data; review your audience
Security and breaches	Safeguards are required; breaches must be reported	Limit access and prepare an incident procedure
Retention	Erase data when the purpose is served unless the law requires otherwise	Set and apply a retention rule
User rights	Access, correction, erasure and grievance redress	Name a contact and process requests

The sections below take the rows that need real work in a chat: notice and consent, children, processors and transfers, and rights and breaches.

Notice and Consent in a Chat Window

The Act puts notice and consent at its centre. When you ask a person for consent to process personal data, you must give a notice that describes the personal data and the purpose, explains how they can withdraw consent and exercise their rights, and tells them how to complain to the Board. The notice must be available in English or in any of the languages in the Eighth Schedule of the Constitution, which includes Hindi and many other Indian languages. Check the current rules for the exact text and form.

In practice, link the notice from the chat window and from your footer, and make sure it is available in the languages your visitors use. Talkmio’s widget text is translated into 25 languages including Hindi and Bengali, and Mio replies in the language the visitor writes in, but the notice itself is your own page and needs to be written and translated by you or a qualified translator. The pre-chat form can be set to none, optional or required for details such as name and e-mail. Ask only for what you need to answer the question, state the purpose and do not make unrelated consent a condition of getting help.

The Act also recognises certain legitimate uses of data without consent, for example where a person voluntarily provides data for a specified purpose and does not indicate that they do not consent to its use. A visitor who types a question into your chat and expects an answer may fall under such a use, but the details depend on the rules and on what you do with the data afterwards. Do not rely on this for marketing or for other purposes. Ask a lawyer how it applies to your use.

Children’s Data

The Act treats anyone under 18 as a child and requires verifiable consent of a parent or guardian before processing a child’s personal data, with limits on tracking, behavioural monitoring and targeted advertising directed at children. If your service is for families, schools or teenagers, such as tutoring, games or education, this is the part to take most seriously. A chat widget on a children’s site is not harmless: the child may type their name, school and address into it.

Practical steps: avoid asking for personal details in chat on child-facing pages, tell Mio in the business instructions never to ask for a child’s personal data and to hand over to a person when a visitor says they are under 18, and review whether you need the chat there at all. Our guide to COPPA and live chat covers a similar rule in the United States, and many of its steps carry over.

Processors, Contracts and Transfers Abroad

When you use a chat provider, you are the Data Fiduciary and the provider acts as a Data Processor. The Act makes you responsible for processing done on your behalf, and requires a valid contract with the processor. That means a written agreement that limits the processor to your instructions and requires safeguards. Our article on the data processing agreement lists what to look for.

The Act allows transfers of personal data outside India, except to countries the government restricts by notification. Check the current list and any sector rules before relying on this. Talkmio stores data on servers in the EU, in Germany, and sends only the conversation text and relevant knowledge base excerpts to the AI model provider; visitors’ IP, country and device data are used to show context in the Inbox. Describe that accurately in your notice. Our guide to GDPR and live chat covers the European side of the same facts.

Retention, Rights and Breaches

Keep chat data only as long as the purpose requires, and then erase it. The default history depends on the plan: Free keeps 30 days, Pro keeps 365 days and Ultimate and the Enterprise plans keep unlimited history, so set an internal rule and delete older conversations where you do not need them. Read more in our article on live chat data retention. You can export or delete data at any time by writing to [email protected].

People can ask for a summary of the data you hold, ask you to correct or erase it, and use your grievance process. Name a contact in your notice, decide how you will verify the requester, set a deadline and keep a record of what you did. Security incidents are the other duty with consequences: a personal data breach must be reported to the Board and to affected people, and the Act sets heavy financial penalties for failures, with the highest penalty reaching 250 crore rupees. Prepare a procedure in advance: who decides, who writes to the Board, how you find the chats that were affected. In Talkmio, Agents handle conversations and Admins also manage websites, Mio and settings, so you can limit who sees what.

Timing: A Law Coming Into Force in Stages

The Act was passed in 2023, and the rules that make it workable were notified later with a phased start. The Board comes first, other provisions follow after a transition period, and most duties for businesses apply after a longer period, so the full set of obligations is expected to take effect in 2027. Dates and details can change, and the government may issue further rules, so check the official pages before you plan. The sensible use of the transition is to build a notice, a consent route, a retention rule and a request process now, so you are ready when the duties begin.

A Practical Checklist

1. Decide whether the Act applies by checking whether you offer goods or services to people in India.
2. Write a notice in English and in the languages of your main audiences, with purposes, rights and a grievance contact.
3. Link it from the chat and the footer, and keep the pre-chat form short.
4. Tell Mio never to ask for sensitive details or for a child’s data, and to hand over when a visitor says they are under 18.
5. Sign a data processing agreement with your chat provider and record where data is stored.
6. Set a retention period and a deletion routine.
7. Prepare procedures for requests and breaches, with named owners.
8. Review everything each year and when the rules change.

Talkmio starts free, with 1 operator, 1 website and 50 AI answers a month, and paid plans start with a 14-day trial. Pro costs 19 euro a month. See the pricing page for current plans, and our guide to live chat for the Indian market for language and service expectations.

Frequently Asked Questions

Does the DPDP Act apply to a chat widget on a foreign website?

It can. The Act applies to digital personal data processed in India and to processing outside India that is connected with offering goods or services to people in India. If you serve Indian visitors, treat your chat data as in scope and confirm with a lawyer who knows Indian law.

Do I need consent before a visitor uses the chat?

Where you rely on consent, it must be free, specific, informed and unambiguous, with a notice that explains the data, the purpose and how to withdraw. The Act also recognises certain legitimate uses without consent. Ask a lawyer which applies to each purpose in your chat.

What about visitors under 18?

The Act treats people under 18 as children and requires verifiable parental consent for processing their data, with limits on tracking and targeted advertising. Avoid collecting personal details from children in chat, tell Mio never to ask for them and hand over when a visitor says they are a minor.

In which languages must the notice be available?

The Act requires the notice to be available in English or any language listed in the Eighth Schedule of the Constitution, which includes Hindi and others. Write the notice for your main audiences and have a qualified translator check it. Mio replies in the language the visitor writes in.

Can I use an EU-hosted chat provider for Indian visitors?

The Act allows transfers abroad except to countries restricted by government notification, so EU storage is not blocked by default. Check the current notifications and sector rules, sign a processing agreement and describe the arrangement accurately in your notice.

Is this article legal advice?

No. It is a practical overview of how a chat widget interacts with India’s data protection law, which is being brought into force in stages. Confirm the current rules and your obligations with a qualified adviser before finalising your notice and procedures.

The Bottom Line

For DPDP Act live chat compliance, start with four things: a clear notice in the right languages, consent for stated purposes only, special care with children’s data and a processing contract that matches where your data is stored. Add a retention rule and a plan for user requests and breaches, and use the transition period to be ready. Start free with Talkmio, test Mio in Hindi and English on your own pages and have an adviser review your notice before launch.