DPDP Act for Small Businesses: What to Do Before May 2027

Last updated: 26 October 2026

India’s Digital Personal Data Protection Act, 2023 (DPDP Act) and the DPDP Rules, 2025 change how every business handles customer data. If you collect names, phone numbers, emails, addresses, or patient or student records, this law applies to you. Here’s what it means in plain language, and what to do first.

Does it apply to my business?

Almost certainly, yes. The Act covers any business that handles digital personal data of people in India, including data collected on paper and later typed into a computer. There is no turnover limit. As of October 2026, the government has not notified any exemption for small businesses or startups. The Act allows the government to exempt some classes of business from certain duties in future, but even then the duty to keep data secure is expected to remain.

In the law’s language, your business is a Data Fiduciary, your customers are Data Principals, and vendors who handle data for you (your website developer, hosting, CRM, billing software) are Data Processors. You stay responsible for what they do with your customers’ data.

Key dates

The duties that matter most for a small business

1. Give a clear notice. Before or when you collect data, tell people in plain language what data you collect and why, how they can withdraw consent and use their rights, and how to complain to the Data Protection Board.
2. Get valid consent. Consent must be free, specific, informed and unambiguous, and as easy to withdraw as to give. Pre-ticked boxes and “by using this site you agree” banners don’t qualify.
3. Protect the data. You must take reasonable security safeguards to prevent a breach. The Rules point to measures like encryption, access control, logs and monitoring, and backups.
4. Report breaches. If personal data is breached, you must tell affected people and the Data Protection Board without delay, and send the Board a detailed report within 72 hours.
5. Answer people’s requests. Publish a contact for data questions, and handle requests to access, correct or erase data, plus complaints.
6. Delete data you no longer need. Once the purpose is served and consent is withdrawn, erase it, and make sure your vendors do too.
7. Take extra care with children. For anyone under 18, you need verifiable consent from a parent, and you must not track children or target ads at them.

What are the penalties?

The Data Protection Board can impose penalties of up to ₹250 crore for failing to take reasonable security safeguards, and up to ₹200 crore for failing to report a breach or for breaking the rules on children’s data. Small businesses are unlikely to face the maximum, but even a small penalty, or the news of a breach, can seriously hurt a local business.

Where to start: a 5-step action plan

1. Map your data. List every place customer data lives: website forms, WhatsApp, Excel sheets, billing software, email.
2. Check your website. It’s the part regulators, customers and attackers see first. Run our free DPDP Security Check to see your security and privacy gaps in 30 seconds.
3. Fix the security basics. HTTPS everywhere, security headers, secure cookies, email spoofing protection (SPF and DMARC), two-factor login on admin accounts, and tested backups.
4. Rewrite your privacy notice and consent. A short, DPDP-ready notice linked at every form, and a consent banner that blocks tracking until people agree.
5. Prepare for a breach. Write a one-page 72-hour response plan: who leads, whom to call, how to inform people and the Board.

The mistake most businesses make

Many businesses buy a privacy policy template and stop there. But the biggest penalty is for failing to protect data, and a template doesn’t stop a hacker. Paperwork shows you meant well. Security is what actually protects your customers.

Check your website’s DPDP security, free →