Does the DPDP Act apply to your business?
The Act regulates the processing of digital personal data. That covers data collected online, and data collected offline and then digitised. A business is a Data Fiduciary when it decides why and how personal data is processed. The people the data is about are Data Principals.
It applies to processing within India, and to processing outside India when it relates to offering goods or services to people in India. There is no exemption for being small. A clinic booking form, an online store checkout, a school admissions page or a lead form on a consulting site all collect personal data.
Section 17(3) allows the Central Government to notify classes of data fiduciaries, including startups, for relief from some provisions. Relief is by notification, not automatic, so verify the current position before assuming it covers you.
DPDP timeline: what applies when
| Milestone | Timing | What it means for an SME |
|---|---|---|
| Act enacted | August 2023 | The statute exists, but obligations were not yet in force. |
| Rules notified | November 2025 | Procedures, notice contents, safeguards and breach reporting are defined. Phased commencement begins. |
| Data Protection Board provisions | On notification | The regulator exists. Business obligations are not yet enforceable. |
| Consent Manager provisions | About 12 months after notification | Registered consent managers can operate. |
| Core data fiduciary obligations | About 18 months after notification (May 2027) | Notice, consent, safeguards, breach reporting and rights handling become enforceable. |
Dates summarise the notifications published by the Ministry of Electronics and Information Technology. The official documents listed at the end of this page are the source of truth.
The ten-step DPDP checklist
- Map the personal data you hold. List every form, account system, payment flow, CRM, spreadsheet and vendor that touches customer or employee data. You cannot protect or delete what you have not found.
- Write down why you collect each item. Every field needs a stated purpose. If you cannot explain why you collect a field, stop collecting it.
- Publish a clear privacy notice. Explain what you collect, why, how a person can withdraw consent and exercise their rights, and how to complain. Present it with or before you ask for consent, in plain language.
- Fix consent where you rely on it. Consent must be free, specific, informed and unambiguous, given by a clear affirmative action. Pre-ticked boxes and bundled consent do not meet that bar, and withdrawing must be as easy as giving.
- Publish a grievance contact. Give a named role and a working email address for privacy questions and complaints, and commit to a response time you can actually meet.
- Apply reasonable security safeguards. This is where the largest penalty sits. Use encryption in transit and at rest, access controls, logging and monitoring, backups and timely patching, scaled to the data you hold.
- Prepare a breach response plan. The Rules require telling affected people without delay and sending the Board a detailed report within 72 hours. Decide who investigates, who decides and who writes the notices before an incident.
- Set up rights handling. People can ask to access, correct and erase their data and to nominate someone to act for them. Create a process, an owner and a log for these requests.
- Review your vendors. Hosting providers, payment gateways, analytics and email tools process data for you. You remain responsible, so put data-protection terms in contracts and know where each vendor stores data.
- Delete data you no longer need. Set retention periods and delete on schedule. Take extra care with children’s data, which needs verifiable parental consent and may not be used for tracking or targeted advertising.
DPDP penalties for businesses
| Breach | Maximum penalty |
|---|---|
| Failure to take reasonable security safeguards to prevent a personal data breach | Up to ₹250 crore |
| Failure to notify the Board and affected people of a personal data breach | Up to ₹200 crore |
| Breach of obligations relating to children’s data | Up to ₹200 crore |
| Breach of other provisions of the Act or Rules | Lower maximums set out in the Schedule |
These are ceilings, not fixed fines. The Data Protection Board considers the nature, gravity and duration of the breach, the data involved, steps taken to mitigate harm and repetition. A documented, proportionate security programme is your best evidence of reasonable care.
What an outside-in scan can and cannot show
An external scan looks at your business the way a visitor or attacker would. For DPDP readiness it can observe:
- whether a privacy notice is publicly reachable and has the expected content
- whether consent controls appear where non-essential tracking is observed
- whether a privacy or grievance contact is published
- technical hygiene that supports the safeguards duty: TLS, security headers, exposed ports, email authentication, known-vulnerable software and leaked credentials
It cannot see your data inventory, consent records, retention schedule, vendor contracts, internal access controls or breach process. Treat a scan as a readiness aid that points at gaps, and use qualified legal and security advice for a complete assessment. The DPDP readiness page explains exactly which signals RiskPulse checks.
DPDP Act questions small businesses ask
Does the DPDP Act apply to a small business or startup in India?
Yes, if the business processes digital personal data in India, or offers goods or services to people in India. The Act has no blanket exemption by company size. Section 17(3) lets the Central Government notify certain classes, including startups, for relief from some provisions, so check the current notifications for your situation.
When do the DPDP obligations for businesses start?
The DPDP Rules were notified in November 2025 with phased commencement. The Data Protection Board provisions took effect first, Consent Manager provisions follow after about 12 months, and the core obligations on data fiduciaries are scheduled to apply after 18 months, in May 2027. Confirm dates against the official notification.
What is the maximum penalty under the DPDP Act?
The Act’s Schedule allows penalties of up to ₹250 crore for failing to take reasonable security safeguards to prevent a personal data breach, up to ₹200 crore for failing to notify the Board and affected people of a breach or for breaching children’s-data obligations, and lower amounts for other provisions. Actual exposure depends on the facts and the Board’s process.
Do I need a Data Protection Officer?
Only Significant Data Fiduciaries must appoint a Data Protection Officer based in India. Every data fiduciary, however, must publish the business contact information of a person who can answer questions about processing, and must provide a grievance redressal mechanism.
Can an automated website scan prove DPDP compliance?
No. An external scan can observe public signals such as an accessible privacy notice, consent controls and a grievance contact, plus technical security hygiene. It cannot see internal data inventories, consent records, vendor contracts or breach processes, so it is a readiness aid, not a compliance certificate.
Official sources
Read the law at its source. This page is guidance for Indian SMEs, not legal advice.
- Digital Personal Data Protection Act, 2023 — India Code
- DPDP Act commencement notification — Ministry of Electronics and Information Technology
- Digital Personal Data Protection Rules, 2025 — Ministry of Electronics and Information Technology