DPDP Act for Startups & SMEs: A Practical Compliance Guide
If you run a startup, a small manufacturer, a clinic, a coaching class, an agency or a shop with a customer app, the DPDP Act applies to you the day your business keeps personal data in digital form. The law does not carve out small businesses. What it leaves room for is a lean, proportionate way of complying.
There is no automatic exemption for small size. Section 17(3) lets the Central Government relax certain duties for notified classes of Data Fiduciary, including start-ups, but only through a notification, so plan as if it will not happen. Penalties are the same size for everyone, though the Board must weigh the circumstances. A short, well-documented programme covers most of it. Most duties take effect on 13 May 2027.
Who this covers
Early-stage and growth startups are Data Fiduciaries for user, customer and employee data from the first sign-up.
Small and medium enterprises are fiduciaries for customer lists, billing data, CCTV, WhatsApp marketing and employee records kept digitally.
Agencies, consultancies and freelancers-turned-firms are often processors for clients and fiduciaries for their own staff and leads.
Local retailers, clinics and coaching centres using apps, digital billing or CRM tools are covered for that digital data.
Founders raising money or selling to enterprises will be asked for proof of compliance during diligence and procurement.
Personal data you are likely to hold
Key provisions for Startups & SMEs
The parts of the Act and Rules that matter most here. Select a reference to read the full explanation.
The Act covers digital personal data, and non-digital data once digitised. Purely personal or household use is outside it.
Itemised notice and clear, withdrawable consent.
Accuracy, security, breach intimation, erasure and written processor contracts.
Subsection (3) allows the Central Government to relax certain duties for notified classes, including start-ups.
The Board can accept a voluntary undertaking, which stops proceedings on the matter.
Penalty ceilings and the factors the Board must weigh, including mitigation and the impact of the penalty.
Only larger or higher-risk businesses are likely to be notified as Significant Data Fiduciaries.
01Is there an exemption for startups and small businesses?
Not by default. The Act's duties attach to anyone who decides why and how personal data is processed, however small. Section 17(3) gives the Central Government power to notify classes of Data Fiduciary, including start-ups, to which certain provisions will not apply, having regard to the volume and nature of data. Provisions that can be relaxed include the notice requirement, some accuracy and erasure duties, the Significant Data Fiduciary rules and the right to access information.
Check the official gazette and the Board's announcements for any notification. If none covers you, or it covers only part of the Act, the rest still applies. Even a notified start-up must keep personal data secure, report breaches and follow the rules on children's data.
02A lean compliance plan
You do not need a large team. You need a small set of things done well, written down and repeatable.
- Know your data. One page listing the personal data you hold, where it sits, which tools touch it and why.
- Publish a notice. Plain-language, itemised, linked at every sign-up and form (Rule 3).
- Fix consent. Separate optional uses such as marketing from what you need to deliver the service (Section 6).
- Secure the basics. Multi-factor authentication, role-based access, encryption, backups and logging (Rule 6).
- Sign vendor contracts. Every tool that stores or processes personal data needs a written agreement (Section 8).
- Prepare for incidents. Name who decides, who tells customers and how you report to the Board within 72 hours (Rule 7).
- Publish a contact and handle requests (Rule 9).
- Set retention. Delete data you no longer need (Rule 8).
03Everyday tools that count as vendors
Small teams run on third-party tools, and each one holding your customers' or staff's data is a Data Processor working for you. CRMs, email-marketing platforms, WhatsApp Business tools, payroll apps, accounting software, cloud storage, analytics and support desks all qualify. Review their terms, use business-grade plans that include a data processing agreement, switch on security features and remove access for people who have left.
Do not paste customer data into free tools or consumer AI assistants unless you have checked the terms, because you remain responsible for what happens to it.
04Penalties and how the Board weighs them
The maximum amounts are the same for every business. Section 33 tells the Board to consider the nature, gravity and duration of the breach, the type of data, repeated failures, steps taken to reduce harm, and the likely impact of a penalty on the business. A small company that kept sensible records and acted quickly is in a very different position from one that ignored the law.
The Board can also accept a voluntary undertaking under Section 32, which can end proceedings on that matter. Early, sensible action is the best protection.
05Investors, enterprise customers and procurement
Enterprise buyers and investors now ask for evidence of data-protection practice. Be ready with a data map, your published notice, a sub-processor list, a short security summary, an incident-response outline and a named contact. These also answer security questionnaires faster, which helps sales.
If you sell to regulated customers such as banks, hospitals or schools, expect them to push their duties down to you by contract.
Penalties
The Data Protection Board decides actual penalties after an inquiry. These are the maximum amounts in the Schedule to the Act and apply to every Data Fiduciary, whatever the sector.
A breach of a voluntary undertaking accepted by the Board carries the penalty applicable to the matter the undertaking covered.
Common situations
No. If you keep digital personal data and decide how it is used, the Act applies unless a notification relieves you of specific duties.
Both are processors. Check their terms include data-protection commitments, and use paid plans that offer a data processing agreement.
Delete it from your database and tools, keep only what the law requires, and reply in writing. Keep a short log of the request.
Treat it as a possible breach. Assess exposure, inform affected people and the Board as required, and fix the practice that allowed it.
Share your data map, notice, vendor list and incident plan. Be candid about gaps and show a dated plan to close them.
Compliance checklist
Common mistakes to avoid
Assuming that being small or early-stage means the Act does not apply.
Collecting everything "in case it is useful".
Letting everyone share one admin login.
Using free tools for customer data with no terms in place.
Waiting until an investor or customer asks before doing anything.
Common questions
Are startups exempt from the DPDP Act?
Not automatically. Section 17(3) allows the Central Government to notify classes of Data Fiduciary, including start-ups, that are relieved of certain provisions. Until a notification covers you, all the duties apply.
Do we need a Data Protection Officer?
Only if you are notified as a Significant Data Fiduciary, which is unlikely for a small business. Every fiduciary must publish contact details of a person who can answer questions (Rule 9).
Does the Act apply to paper records?
Only digital personal data is covered, and non-digital data once it is digitised. Paper records that are never digitised are outside the Act.
Are the penalties lower for small businesses?
The ceilings are the same. The Board must consider the circumstances, including the likely impact of a penalty, when deciding the amount.
Do we need a consent management platform?
Not necessarily. You need to ask clearly, record what each person agreed to, and honour withdrawal. A simple, well-kept system can do that.
When do we need to be ready?
Most duties take effect on 13 May 2027. Starting early spreads the work and makes customer and investor conversations easier.