A Small Business Guide to India’s DPDP Act: Compliance, Responsibilities and Penalties

Think about an ordinary Tuesday at a ten-person business in Hyderabad. A customer fills in the enquiry form on your website, leaving a name, mobile number and email address. Your HR executive saves a new joinee’s Aadhaar copy and salary details on Google Drive. Someone uploads last month’s delivery addresses into a shared spreadsheet.

None of that feels like a legal event. All of it is personal data processing, and India now has a law governing it.

The DPDP Act for small businesses is not a concern for large technology companies alone. It applies by reference to what you do with personal data, not to your turnover or headcount. The useful news is that most substantive obligations do not bite until 2027, which gives a workable runway. The less useful news is that nothing exempts you simply because you are small.

What Is India’s DPDP Act?

The Digital Personal Data Protection Act, 2023 is India’s main law on handling personal data in digital form. Parliament enacted it on 11 August 2023. It sets out when you may collect personal data, what you must tell people, how you must protect it, and what rights individuals have over it.

An Act alone is rarely operational. The detail arrived on 13 November 2025, when the Digital Personal Data Protection Rules, 2025 were published in the Official Gazette as G.S.R. 846(E). MeitY announced them publicly the following day, and a corrigendum, G.S.R. 892(E), made minor textual corrections.

The vocabulary is worth learning once, because every obligation hangs off it.

• Personal data: any data about an identifiable individual. A name with a phone number qualifies.
• Digital personal data: personal data in digital form, or collected on paper and later digitised. A handwritten visitor register sits outside the Act. The same register typed into Excel does not.
• Data Principal: the individual the data is about.
• Data Fiduciary: whoever decides why and how the data is processed. For your own records, that is your business.
• Data Processor: whoever processes it on your behalf, such as your CRM, payroll vendor or cloud host.
• Consent: must be free, specific, informed, unconditional and unambiguous, given by clear affirmative action and limited to the stated purpose.
• Personal data breach: unauthorised processing, or accidental disclosure, acquisition, sharing, alteration, destruction or loss of access that compromises confidentiality, integrity or availability.

Does the DPDP Act Apply to Small Businesses?

Usually yes, if you process digital personal data in India. The Act covers processing within India, and processing abroad connected with offering goods or services to people in India. There is no carve-out based on employee count, turnover or MSME registration.

In scope, therefore: a retailer capturing names and mobile numbers through a website form; an e-commerce store processing orders and addresses; a consultancy holding client records; any employer keeping employee records digitally; an agency managing lead databases; a startup running customers through a cloud CRM.

Genuine exclusions exist. The Act does not apply to personal data processed by an individual for purely personal or domestic purposes, nor to data the individual has themselves made publicly available. Section 17 adds exemptions for legal claims, court and regulatory functions, offence investigation, certain court-approved restructuring, and processing in India of foreign individuals’ data under contract with a foreign entity, which matters for some IT and BPO work.

One point circulates incorrectly and deserves emphasis. Section 17(3) allows the Central Government to exempt specified classes of Data Fiduciaries, including startups, by notification. No such notification exempting startups or small businesses generally had been issued at the time of writing. Planning on the assumption that one will arrive is not a compliance strategy.

Keep three categories distinct throughout: a statutory exemption, an obligation that has not yet commenced, and a recommended practice.

What Responsibilities Do Small Businesses Have Under the DPDP Act?

These sit mainly in Rules commencing eighteen months after 13 November 2025, which falls in mid-May 2027. Treat them as the target state you are building towards, not duties you are currently breaching.

Understand What Personal Data You Collect

Not itself a statutory obligation, but nothing else is possible without it. Record what you hold, where it came from, why, which systems store it, and who can open them. Most small businesses find two or three collections nobody remembered, usually an old marketing list.

Provide Clear Privacy Notices

Rule 3 requires a notice presented independently of other information, in clear and plain language, describing the data collected and the purpose of processing, plus how to withdraw consent, exercise rights and complain to the Data Protection Board. A buried link to a page written years ago will not satisfy this. The notice must sit where consent is given and match what you actually do.

Obtain and Manage Consent Where Required

Consent is central but not the only lawful basis. Section 7 permits certain legitimate uses, including where a person voluntarily provides data for a purpose and has not indicated otherwise, employment purposes, and medical emergencies.

A worked example: a visitor submits your contact form asking about your services. Replying is a purpose they voluntarily provided the data for. Adding them to a monthly promotional newsletter is a different purpose, and that is where separate, specific consent belongs. Withdrawing consent must be as easy as giving it.

Protect Personal Data

Rule 6 is the closest thing the framework has to a security checklist, and it is more specific than most businesses expect. A Data Fiduciary must protect personal data in its possession or control, including data processed on its behalf by a Data Processor, through measures that at minimum include:

• Encryption, obfuscation, masking or virtual tokens
• Controls on access to the computer resources used
• Logs, monitoring and review, so unauthorised access can be detected and investigated
• Reasonable measures for continued processing if confidentiality, integrity or availability is compromised, such as backups
• Retention of logs and personal data for one year for detection and investigation, unless another law requires otherwise
• Appropriate security provisions in contracts with Data Processors
• Technical and organisational measures ensuring the safeguards are actually observed

Note that phrase about processing on your behalf. Outsourcing the work does not outsource the responsibility.

Respect Applicable Data Rights

Individuals may obtain a summary of their personal data and the processing undertaken, along with the identities of other Data Fiduciaries it has been shared with. They also have rights to correction, completion, updating and erasure, to grievance redressal, and to nominate someone to exercise their rights on death or incapacity.

These carry conditions. Erasure may be refused where retention is necessary for the specified purpose or required by law. A grievance process must exist and must respond, and the Government has indicated a maximum of ninety days for such requests. Rule 9 requires you to publish contact details for a Data Protection Officer or a person able to answer processing questions.

Manage Vendors and Third-Party Service Providers

List every service touching personal data: CRM, email marketing, hosting, payroll, accounting, analytics, support tools. Rule 6(1)(f) expects your contract with a Data Processor to contain appropriate security provisions. Standard vendor terms frequently do not, which is a gap worth finding now rather than during an incident.

Establish a Data Breach Response Process

Rule 7 creates two obligations with different clocks, and this is the detail most often reported wrongly.

To affected individuals: on becoming aware, inform each person promptly in concise plain language, covering the nature, extent and timing of the breach, the likely consequences for them, mitigation taken, steps they can take themselves, and contact details for queries.

To the Data Protection Board: notify without delay with a description of the breach and its nature, extent, timing, location and likely impact. Then, within 72 hours of becoming aware, provide detailed information covering the facts and circumstances, the reasons, mitigation, findings on who caused it, remedial measures, and a report on what affected individuals were told. Only the 72-hour element may be extended, on written request to the Board.

A separate point catches businesses out: CERT-In’s 2022 directions require specified cyber incidents to be reported within six hours of noticing them. That obligation is already in force and runs alongside these timelines rather than replacing them.

DPDP Act Compliance Checklist for Small Businesses

Completing this does not by itself establish legal compliance. It does put you in a defensible position.

1. Identify the personal data you collect, including anything in spreadsheets outside your main systems.
2. Map where it is stored: servers, cloud drives, SaaS tools, laptops, inboxes, WhatsApp.
3. Record why you process each category. If nobody can state a purpose, that is a candidate for deletion.
4. Review website forms against your notice. Preparation step; Rule 3 commences mid-May 2027.
5. Check consent collection and withdrawal. Pre-ticked boxes and bundled consent do not meet the standard. Test that withdrawal works.
6. Review access controls and safeguards against Rule 6’s list. Preparation step; Rule 6 commences mid-May 2027.
7. Set retention and deletion rules for each category, with a reason.
8. Document third-party providers and check what their contracts say about security.
9. Create a process for individual requests, with a named owner and a response timeline.
10. Write a breach response procedure noting both the Rule 7 and CERT-In clocks.
11. Train the people who handle personal data. Most small-business breaches start with an ordinary mistake.
12. Track commencement dates and notifications, including any future exemption notification.

DPDP Act Implementation Timeline: What Should Businesses Know?

The Rules use phased commencement under Rule 1, so the notification date is not when everything starts applying. Dates below are calculated from Gazette publication on 13 November 2025; some advisers calculate from MeitY’s announcement on 14 November. The difference is a day, and the sensible approach is to work to the earlier date.

Provision or requirement	Commencement	What it means for a small business	Preparation step
Rules 1, 2 and 17–21: short title, definitions, constitution and functioning of the Data Protection Board	In force since November 2025	The regulator and its procedures exist. No direct operational duty falls on you from these.	Note that a digital-first Board and an appeal route to TDSAT now exist.
Rule 4: registration and obligations of Consent Managers	One year after publication, around 13–14 November 2026	Relevant only if you intend to operate as a Consent Manager, which must be an Indian company meeting prescribed criteria. Most small businesses are unaffected.	If you use a consent-management service, ask about its registration position.
Rules 3, 5–16, 22 and 23: notice, security safeguards, breach intimation, retention, contact information, children’s and guardianship consent, Significant Data Fiduciary obligations, Data Principal rights, cross-border transfer, appeals	Eighteen months after publication, around 13–14 May 2027	The substantive compliance set. Notices, consent, security, breach reporting and rights handling all become operative together.	Use the runway: data inventory first, then notices and security.

Two commonly misread points. Rule 8 and the Third Schedule set a three-year erasure requirement, but only for specified classes: e-commerce entities and social media intermediaries with at least two crore registered users in India, and online gaming intermediaries with at least fifty lakh. Those thresholds place almost every small business outside it. Separately, Significant Data Fiduciary status, which brings audits and impact assessments, applies only where the Central Government notifies a Data Fiduciary or class as such.

What Are the Penalties Under the DPDP Act?

Penalties sit in the Schedule to the Act and are maximum ceilings, not fixed fines. The Board sets the amount after an inquiry, weighing the nature and gravity of the breach, its duration, what was affected, whether it was repeated, and what mitigation was attempted.

Contravention	Maximum penalty
Failure to take reasonable security safeguards to prevent a personal data breach (Section 8(5))	Up to ₹250 crore
Failure to notify the Board or affected Data Principals of a breach (Section 8(6))	Up to ₹200 crore
Breach of additional obligations relating to children (Section 9)	Up to ₹200 crore
Breach of additional obligations of a Significant Data Fiduciary (Section 10)	Up to ₹150 crore
Breach of the duties of a Data Principal (Section 15)	Up to ₹10,000
Breach of a voluntary undertaking accepted by the Board (Section 32)	Up to the penalty applicable to the underlying breach
Breach of any other provision of the Act or its rules	Up to ₹50 crore

Read these sensibly. The ₹250 crore figure is a statutory ceiling for the most serious failures by the largest entities, not a tariff applied to a small firm that emailed the wrong recipient once. What the schedule does tell you is where the law places weight: security safeguards and breach notification carry the two highest ceilings, which is a fair guide to where preparation effort belongs.

Common DPDP Compliance Mistakes Small Businesses Should Avoid

• A privacy policy describing a different business. Read yours against what your forms actually collect. A practice weakness now; a likely legal gap from 2027.
• Collecting more than you need. Asking for a date of birth you never use conflicts with data minimisation and enlarges your exposure for nothing.
• Treating one consent as covering everything. Enquiry handling and marketing are different purposes.
• Everyone having access to everything. Shared logins and open drives are a Rule 6 access-control problem and the commonest cause of avoidable incidents.
• Keeping data indefinitely. Every retained record is a record that can leak.
• Not knowing what your vendors do. If you cannot say where your CRM stores data, you cannot assess your own position.
• No route for complaints. Grievance redressal is a statutory right, and an unmonitored inbox is not a process.
• Assuming small means exempt. It does not, and no notification has changed that.

A Practical 30-Day DPDP Readiness Plan

An illustrative plan for getting organised. Not a statutory deadline, and not a guarantee of compliance.

Week 1, understand your data. List the main categories across customers, employees and vendors. List every system touching them. Write down the purpose for each.

Week 2, review current practice. Compare website forms against your privacy notice. Check how consent is collected and whether withdrawal works. Identify data you collect but never use, and data kept with no current purpose. List third-party providers.

Week 3, improve internal processes. Review who has access to what and remove what is unnecessary. Draft a short data-handling procedure. Decide who owns privacy requests. Draft a breach response plan covering both clocks.

Week 4, document and plan. Assign named responsibility. Brief the staff who handle personal data. Record gaps you cannot yet close and when you will. Map remaining work to the mid-2027 date, and identify questions needing a qualified lawyer.

How Can Small Businesses Prepare Without a Large Compliance Team?

Most of the early work costs time rather than money. Start with a one-page data inventory in a spreadsheet; it is unglamorous and it unlocks everything else. Use the security controls you already pay for, such as access management in Google Workspace or Microsoft 365, two-factor authentication and encrypted backups. Name one person as owner of privacy questions, because an unowned task does not happen. Write procedures down. Ask vendors what they do with personal data. Train the few people who actually touch customer records.

Then be realistic about the boundary. Templates and tools help you organise, but no template establishes compliance by itself, and no tool can assess whether an exemption applies to your business. Scope, exemptions, cross-border transfers and sector rules belong with a qualified professional.

Frequently Asked Questions About the DPDP Act for Small Businesses

What is the DPDP Act for small businesses?

It is India’s Digital Personal Data Protection Act, 2023, read with the DPDP Rules, 2025. For a small business it governs how you collect, use, secure, retain and delete digital personal data belonging to customers, employees and others, and what rights those individuals can exercise against you.

Does the DPDP Act apply to small businesses in India?

Generally yes. It applies to processing of digital personal data in India, and to processing abroad connected with offering goods or services to people in India. There is no exemption based on turnover, headcount or MSME status.

What is the difference between a Data Fiduciary and a Data Processor?

A Data Fiduciary decides why and how personal data is processed and carries the primary legal responsibility. A Data Processor handles it on the Fiduciary’s behalf. Your business is usually the Fiduciary for its own records; your CRM or payroll vendor is usually a Processor.

Do small businesses need consent to collect personal data?

Not always. Consent is one lawful basis; Section 7 also permits specified legitimate uses, including where a person voluntarily provides data for a purpose, and certain employment purposes. Where consent is the basis, it must be free, specific, informed and unambiguous, and withdrawal must be as easy as giving it.

Does a small business need to update its privacy policy?

Almost certainly. Rule 3 requires a notice given independently of other information, in clear and plain language, describing the data collected, the purpose, and how to withdraw consent, exercise rights and complain. Rule 3 commences around mid-May 2027, so this is preparation rather than an immediate breach.

What are the penalties under the DPDP Act?

The Schedule sets maximums: up to ₹250 crore for failing to take reasonable security safeguards, up to ₹200 crore for failing to notify a breach or for contraventions relating to children, up to ₹150 crore for Significant Data Fiduciary failures, and up to ₹50 crore residually. These are ceilings determined after inquiry, not automatic fines.

What should a small business do if personal data is breached?

Under Rule 7, inform affected individuals promptly with the nature of the breach, likely consequences and what they can do, then notify the Data Protection Board without delay and file detailed information within 72 hours. Separately, CERT-In’s 2022 directions require specified cyber incidents to be reported within six hours, and that is already in force.

When do the DPDP Act and Rules become applicable?

In phases. Rules 1, 2 and 17 to 21 took effect on Gazette publication in November 2025. Rule 4 on Consent Managers takes effect one year later, around November 2026. The substantive set, Rules 3, 5 to 16, 22 and 23, takes effect eighteen months after publication, around mid-May 2027.

How can a small business prepare for DPDP compliance?

Begin with a data inventory covering what you hold, where it sits and why. Then review notices and consent, tighten access controls and backups, check vendor contracts, create a process for individual requests, and write a breach response plan. Take legal advice on anything turning on scope or exemptions.

Is a small business exempt from the DPDP Act?

Not by default. Section 17(3) permits the Central Government to exempt specified classes including startups by notification, but no such notification had been issued at the time of writing. Narrow exemptions exist in Section 17 for specific activities, which is different from a general small-business exemption.

Conclusion: Make Data Privacy Part of Good Business Practice

Three things are worth carrying away. The law applies on the basis of what you do with personal data, not how big you are. The substantive obligations arrive in phases, with the main set around mid-May 2027, so there is time to prepare properly rather than in a panic. And the penalty schedule points at where to focus, because security safeguards and breach notification carry the heaviest ceilings.

Almost everything useful you can do this month costs nothing but attention. Knowing what personal data you hold, deleting what you do not need, tightening who can see what, and writing down how you will respond when something goes wrong are good operational hygiene regardless of any statute. They also happen to be the foundation every DPDP obligation is built on. Start with the inventory this week, and bring in a qualified Indian data protection lawyer at the point a question turns on scope, an exemption or a cross-border transfer.

This guide is general information for business readers, not legal advice, and the law may have changed since publication. Verify the current position against the official notifications linked below before acting.

Official Sources and Further Reading

• Ministry of Electronics and Information Technology (MeitY)
• Digital Personal Data Protection Rules, 2025 (MeitY)
• PIB: Government notifies DPDP Rules to empower citizens and protect privacy
• National Cyber Crime Reporting Portal, and the cyber-fraud helpline 1930