DPDP Act Compliance for Small Business in India 2026: A 90-Day Plan

Compliance | RegisCorp Team

Checked on 23 October 2026. India's data protection law is already on the statute book, and its main duties for businesses start on 13 May 2027, 202 days from 23 October 2026. The Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 apply to any business that collects personal data in digital form: an online store, a coaching institute, a clinic with an appointment app, a recruiter with a spreadsheet of CVs, a CA firm with a client WhatsApp group. There is no general exemption for small businesses. Penalties on paper run to Rs 250 crore. This post explains what the law requires in plain language, what is already in force, what comes in November 2026 and May 2027, what a small business should do and in what order, and what we could not confirm.

RegisCorp Consultancy LLP is a digital-first legal and compliance firm in Kota, Rajasthan, working with businesses across India. We write these guides so you can check the rules before you pay anyone, including us.

Key takeaways

• The main duties start on 13 May 2027. That covers notices, consent, security safeguards, breach reporting, children's data and the rights of individuals. Sections 3 to 5, 6(1) to (8) and (10), 7 to 17 and the penalty sections 28 to 34 of the Act begin on that date, according to the commencement notification as summarised by a compliance site.
• Two earlier dates exist. The Data Protection Board provisions have been in force since 13 November 2025. Consent manager registration starts on 13 November 2026, 21 days after 23 October 2026. Unless you plan to become a registered consent manager, that second date does not affect you.
• There was a proposal to speed things up for big players. In January 2026 MeitY proposed shortening the 18-month period to 12 months for "significant data fiduciaries". Sources up to October 2026 found no amending notification. A small business is very unlikely to be a significant data fiduciary, which the government designates on the basis of data volume, sensitivity and risk.
• There is no small-business exemption that we could confirm. The Act lets the government exempt classes of fiduciaries, including startups, by notification. We found no notification doing so.
• Penalties are large on paper. Up to Rs 250 crore for failing to take reasonable security safeguards, Rs 200 crore for failing to report a breach or for breaching children's data duties, and Rs 50 crore for other breaches. How the Board will apply them to small firms is not yet known, because the Board has no appointed chairperson or members as of the sources we read.
• A breach report has a 72-hour clock. After telling the Board without delay, you must give full details within 72 hours or a longer period the Board allows.
• Children's data is the hardest rule to live with. Verifiable parental consent for anyone under 18, and no tracking or targeted advertising directed at children.
• Most of the work is not legal drafting. It is knowing what personal data you hold, who has access, who your vendors are, and writing it down.
• The cheapest time to start is now. Seven months is enough for a small firm to map its data, rewrite its forms and sign vendor terms, if it begins in the next few weeks.

The key numbers and dates in one place

Does the law apply to you?

If you handle personal data in digital form, or non-digital data that you later digitise, and you decide why and how it is processed, you are a "data fiduciary" under the Act. That is the term for the business that decides the purpose. A "data principal" is the person the data is about: your customer, student, patient, applicant or employee.

What counts as personal data

Any data about an individual who can be identified from it. A name with a phone number is personal data. So is an email address, a photograph, a delivery address, an Aadhaar number, a purchase history linked to an account, a CV, a log of what someone browsed on your site and a recorded call. Anonymous aggregate statistics are not.

Who is covered

• A business in India that processes personal data of people in India.
• A business abroad that processes personal data of people in India in order to offer them goods or services.
• A business that uses a processor, such as a cloud provider, a payroll firm or an SMS vendor. You remain responsible for what the processor does with the data.

What is outside it

• Personal data processed by an individual for a purely personal or domestic purpose.
• Data made public by the person themselves or under a legal obligation.
• Certain government and security processing, which the Act exempts in specified ways.

Small businesses and startups

The Act allows the government to notify classes of data fiduciaries, including startups, who are exempt from some provisions such as notice or the rights of data principals. We found nothing showing a notification has been issued. A business that bets on an exemption that has not been notified is carrying the full risk, so plan as if there is none.

What the law asks of a data fiduciary

The duties can be grouped into seven. Each has a paragraph below.

1. Give a clear notice

Before or when you ask for consent, tell the person, in plain language and separately from other terms, what personal data you want, why, how they can withdraw consent, how they can exercise their rights and how to complain to the Board. The Rules require the notice to be available in the languages of the Eighth Schedule on request. A notice buried in a 40-page terms-of-service document does not meet this.

2. Ask for consent properly, or rely on a "legitimate use"

Consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action. Withdrawing consent must be as easy as giving it. You must keep records of what each person agreed to.

Some processing does not need consent. The Act lists "legitimate uses", such as when a person voluntarily gives data for a purpose and does not object, to comply with a law, to respond to a medical emergency, or for certain employment purposes. Read these closely. They are narrower than most people assume, and a business that uses them should be able to say which one applies.

3. Use the data only for the stated purpose, and delete it when the purpose ends

When a person withdraws consent, or when the purpose is complete, the data should be erased unless a law requires you to keep it. Some digital platforms must warn a user 48 hours before erasing inactive accounts, under the Third Schedule of the Rules as summarised. Logs and certain traffic data have to be kept for at least one year.

4. Keep the data secure

You must take reasonable security safeguards to prevent a breach. The Rules give examples: encryption, masking or tokenisation, access control, monitoring of access, backups and logs. Your contracts with processors must include security terms. For a small business this does not mean an expensive security operations centre. It means passwords and multi-factor sign-in, encrypted laptops, restricted access to customer sheets, backups, and a written record of who has what.

5. Report breaches

If personal data is lost, leaked, altered or accessed without authority and it affects people, you must tell each affected person promptly, in plain language, about what happened, the likely consequences and what they can do. You must also inform the Data Protection Board without delay and, within 72 hours (or a longer period the Board allows), give full details of the breach, its cause, mitigation and the people affected. The 72-hour limit applies to the Board, not to individuals.

6. Respect the person's rights

A person may ask what data you hold and how it is used, ask you to correct or erase it, nominate someone to exercise rights if they die or lose capacity, and complain. You must publish how to make these requests and respond within a stated time. One checklist reports a maximum of 90 days for grievance redressal. Have a named contact, and publish it.

7. Take special care with children

For anyone under 18, you need verifiable consent from a parent or guardian, subject to listed exceptions, and you must not track or monitor children's behaviour or direct targeted advertising at them. If you run a coaching institute, a school app, a gaming site or an online store with teenage customers, this is the rule that most changes your forms.

Significant data fiduciaries: will your business be one?

The government can designate a data fiduciary as "significant" based on the volume and sensitivity of the personal data, the risk to individuals, the risk to the security and sovereignty of India, and similar factors. A significant data fiduciary has extra duties: appoint a Data Protection Officer based in India, appoint an independent data auditor, and carry out periodic Data Protection Impact Assessments. The penalty ceiling for breaching those duties is Rs 150 crore.

Most small and medium businesses will not be designated. If you handle data of millions of people, or very sensitive categories, assume you might be, and watch for a notification. The January 2026 proposal to bring forward the significant fiduciary deadline to November 2026 was reported as a draft. Sources up to October 2026 found no gazette notification adopting it.

Processors and vendors

You are responsible for personal data even when a vendor handles it for you. Typical processors for a small firm are:

• A cloud storage or email provider.
• A payment gateway.
• An SMS, WhatsApp or email marketing tool.
• A payroll or HR software provider.
• A CRM or lead-form tool.
• An external accountant or consultant who receives customer lists.
• A call centre or courier firm.

The Act says a fiduciary can engage a processor only under a valid contract. The Rules require that contract to include security terms. In practice, you should:

1. List every vendor that touches personal data.
2. Ask each for its data protection terms and where it stores data.
3. Add or update clauses on security, confidentiality, sub-processors, breach notice to you, deletion on termination and cooperation with your obligations.
4. Keep a copy of each signed contract.

Cross-border transfers

The Act permits transfer of personal data outside India except to countries the government restricts by notification. We did not find a restricted list. Several summaries note that cross-border restrictions for significant data fiduciaries have been discussed. If you use a foreign cloud service, check where data is stored and whether your sector regulator (the RBI for payments, for example) has stricter rules. The DPDP Act does not override stricter sector laws.

Where small businesses will feel it most

Based on the rules as summarised, the practical pain points are these.

• Lead forms and WhatsApp lists. If you have collected phone numbers over years without a clear purpose or consent record, you cannot easily prove consent.
• Pre-ticked boxes and bundled consent. A single "I agree to everything" tick that mixes service terms, marketing and sharing with partners is weak consent.
• Staff access. A shared spreadsheet where every employee can see every customer is a security problem.
• Old data. A drawer of ten-year-old application forms or a laptop of CVs from 2019 is a liability if there is no purpose to keep it.
• Children. Any service with users under 18 needs a parental consent flow.
• Marketing. Sending promotional messages to a list you bought is hard to defend.

A 90-day plan for a small firm

You do not need to do it all at once. This plan gives a sensible order for the next three months, leaving the rest of the time to May 2027 for testing and fixing.

Weeks 1 to 2: map your data

For each activity, write down what personal data you collect, from whom, through which channel, why, where it is stored, who can see it, who you send it to and how long you keep it. A simple table is enough.

Weeks 3 to 4: decide your legal basis for each

For each activity, decide whether you rely on consent or a legitimate use, and write down why. If you cannot explain it, treat it as consent.

Weeks 5 to 6: rewrite your notices and forms

Write one plain notice per collection point: website forms, checkout, app sign-up, enquiry forms, walk-in forms and hiring forms. Make consent a separate, unticked box for each distinct purpose. Add a withdrawal route that is as easy as the consent route.

Weeks 7 to 8: sort your vendors

Make the vendor list and send requests for updated terms. Where a vendor cannot or will not give security terms, plan to replace it.

Weeks 9 to 10: security basics

• Turn on multi-factor sign-in for email, cloud storage and admin accounts.
• Remove access for people who do not need it.
• Encrypt laptops and phones that hold customer data.
• Back up the important data and test restoring it.
• Keep access logs where your tools allow, and keep them for at least a year.

Weeks 11 to 12: breach playbook and rights process

• Write a one-page breach plan: who decides, who calls the vendors, who prepares the message to affected people, who prepares the report to the Board.
• Publish a contact for data requests and set a target response time well inside the maximum.
• Run a drill: pretend a laptop is stolen and see how long it takes to know what was on it.

A worked example: a coaching institute with an online portal

Here is how the rules play out for a mid-sized coaching institute in Kota. The numbers are illustrative.

Facts:

• 3,000 students a year, about 40 percent under 18.
• A portal with student accounts, test scores, parent phone numbers and fee records.
• Marketing by WhatsApp and SMS through two vendors.
• A cloud storage account with scanned admission forms and Aadhaar copies.
• Eight staff members with access to the whole student sheet.

What the institute must change by 13 May 2027:

The effort here is mostly organisation, not software. It is also better done in November than in May, because the institute's admission season starts in the new year.

A second worked example: a breach on a Monday

Suppose a staff member at an online store loses a laptop on Sunday night. The laptop holds a spreadsheet with 2,500 customers' names, addresses and phone numbers. The laptop was not encrypted. The owner learns at 9 am on Monday, 17 May 2027. This is a hypothetical, assuming the main duties are in force.

The penalty ceiling for failing to take reasonable safeguards is Rs 250 crore and for failing to report a breach is Rs 200 crore. Real penalties for a small firm are unlikely to approach those figures. What matters is that the duties exist, a record of what you did will be asked for, and an unencrypted laptop with a customer sheet is the sort of fact that decides whether safeguards were "reasonable".

Sample wording for consent and notice

These are drafts to adapt. They are not legal advice and not tailored to your business.

A consent line on a checkout form

[ ] I agree that [Business name] may use my name, phone number and delivery address to deliver my order and send order updates. I can withdraw this at any time by writing to [email]. [Link to our privacy notice]

A separate marketing line

[ ] I would also like to receive offers by WhatsApp and email. I can unsubscribe at any time. (Optional)

The headings of a privacy notice

1. Who we are and how to reach us.
2. What personal data we collect.
3. Why we collect each type.
4. Who we share it with.
5. How long we keep it.
6. How to withdraw consent.
7. Your rights and how to use them.
8. How to complain to us, and then to the Data Protection Board.
9. Children.

The Data Protection Board and what to expect

The Board is established in law from 13 November 2025. It handles complaints and can impose penalties after an inquiry. As of the sources we read, no chairperson or members were reported as appointed, and MeitY had invited applications in May 2026. This means the enforcement machinery is not yet visible. That should not make a business comfortable. The Act's duties start on 13 May 2027 whether or not the Board is busy, and complaints can be made from that date. Records you create now are the evidence of compliance later.

The Act also contains a voluntary undertaking route: if the Board is inquiring into a breach, a fiduciary can offer an undertaking, and if accepted the proceedings can be closed. We did not read how this will work in practice.

Penalties in context

The Board decides the amount after considering the nature, gravity and duration, whether the breach was repeated, the type of data, the mitigation done and the likely effect of the penalty. A small business that can show a mapped data inventory, a clear notice, vendor contracts, basic security and a breach plan is in a very different position from one that cannot show anything. These are ceilings, not predictions.

Mistakes to avoid

• Waiting for the Board. The duties apply from the date, not from the date the Board gets busy.
• Copying a foreign privacy policy. It may promise rights and processes you do not have.
• Bundled consent. One tick for everything is weak.
• Collecting too much. An Aadhaar copy "just in case" is a liability.
• Forgetting employees. Staff records are personal data too.
• Forgetting old data. Delete what you no longer need and have no duty to keep.
• Assuming vendors are responsible. You remain responsible for your processors.
• Ignoring children. Teenagers are children under this law.
• No breach plan. The 72-hour clock begins when you know, not when you are ready.
• Treating compliance as a one-time document. The law expects you to keep records and keep them current.

Frequently asked questions

When does the DPDP Act apply to businesses?

The main duties for data fiduciaries start on 13 May 2027, 18 months after the Rules were notified on 13 November 2025. The Data Protection Board provisions have applied since 13 November 2025, and consent manager registration starts on 13 November 2026.

Does the DPDP Act apply to small businesses?

Yes. We found no general small-business exemption. The Act allows the government to notify exemptions for classes of fiduciaries, including startups, but we found no notification.

What is personal data under the DPDP Act?

Data about an individual who can be identified by or in relation to it. Names with phone numbers, emails, addresses, photos, IDs, purchase histories linked to accounts and recorded calls are all examples.

What is a data fiduciary?

The person or business that decides the purpose and means of processing personal data. A data processor is a business that processes data on a fiduciary's behalf.

Do I need consent for every use of customer data?

Not always. The Act lists "legitimate uses" for which consent is not needed, such as when a person voluntarily gives data for a purpose, or to comply with a law. These are narrow, so if you cannot say which one applies, rely on consent.

What must a privacy notice contain?

The data collected, the purposes, how to withdraw consent, how to exercise rights and how to complain to the Board. The Rules call for plain language and a standalone notice, available in Eighth Schedule languages on request.

How fast must I report a data breach?

Tell affected people promptly and tell the Board without delay. The detailed report to the Board is due within 72 hours or a longer period the Board allows.

What is the penalty under the DPDP Act?

The ceilings are Rs 250 crore for failing to take reasonable security safeguards, Rs 200 crore for failing to report a breach or for children's data failures, Rs 150 crore for significant data fiduciary duties and Rs 50 crore for other breaches. The Board decides actual amounts on the facts.

Do I need a Data Protection Officer?

Only a significant data fiduciary must appoint one, based in India. Other businesses need not appoint a DPO but must publish contact details for someone who can answer questions about processing.

What counts as a child under the DPDP Act?

Anyone under 18. A fiduciary must obtain verifiable consent from a parent or guardian, with listed exceptions, and must not track children's behaviour or direct targeted advertising at them.

Can I keep customer data forever?

No. When the purpose is complete or consent is withdrawn, you should erase the data unless a law requires you to keep it. Tax and accounting laws require some records for years, so keep those and delete the rest.

Is my cloud provider responsible if it is hacked?

The provider has duties as your processor, but you remain responsible as the fiduciary. That is why the contract should include security terms and breach notification to you.

Does the Act apply to employee data?

Yes, employees are data principals. The Act has a legitimate use for certain employment purposes, so check whether it covers what you do.

Can I still send marketing messages?

With consent, yes. Make it a separate optional choice and honour withdrawals. Sending promotions to a bought list is hard to defend.

Will the timeline be shortened?

MeitY proposed in January 2026 to shorten the period for significant data fiduciaries from 18 to 12 months. Sources up to October 2026 found no amending notification.

Where do I complain about a breach of the Act?

First to the business using its grievance route. If unresolved, to the Data Protection Board, once it is working. The Board had no reported chairperson or members as of September 2026.

What to do next

1. Spend one hour listing the personal data you hold and where it sits. A simple table is enough.
2. Put 13 May 2027 on your calendar and work back from it.
3. Replace bundled consent with separate unticked choices on your forms.
4. Make a list of vendors and ask each for data protection terms.
5. Turn on multi-factor sign-in and remove unnecessary access today.
6. Write a one-page breach plan and name a person responsible.
7. If you serve anyone under 18, design the parental consent step now.

If you want help mapping your data, drafting a privacy notice, updating vendor contracts or building a breach plan, contact RegisCorp.

This post is general information, not legal advice. Rules change, so check your facts with a qualified professional before you act.

Sources and what we could not verify

Sources used

• ConsentOS, DPDP Rules notification status: the commencement notification G.S.R. 843(E), the Rules G.S.R. 846(E), the dates of each section and rule, the corrigenda and the status of the Board. Status as of September 2026, reviewed 9 October 2026.
• MirvoLegal, DPDP Rules compliance timeline: the phased timeline, the January 2026 proposal, notice, security, breach and children's rules, and penalty ceilings. Position as at 20 September 2026.
• Pyroniq, DPDPA compliance deadlines: the November 2026 and May 2027 dates and the list of obligations. Published 22 July 2026.
• Legal500, compression of DPDP enforcement timeline proposed by MeitY: the January 2026 proposal for significant data fiduciaries.
• Invield, DPDP Rules checklist: the compliance checklist and penalty table. Updated 7 October 2026.

All are secondary or vendor sources, and several publishers sell compliance products. We did not open the Gazette, MeitY's site or the Act's text.

What we could not verify

• The text of the Act and the Rules. Everything above is from summaries.
• Whether any amendment to the Rules or any notification compressing the timeline has been issued after the dates of our sources.
• Whether any class of startups or small businesses has been exempted under the Act.
• The exact wording of the legitimate uses and how they will be read for small firms.
• The 90-day grievance maximum, the one-year log retention and the 48-hour erasure warning, which we read in summaries of the Rules.
• Whether the "without delay" notice to the Board has a specific format or portal, and what the Board will require in practice.
• The list of countries to which cross-border transfers are restricted, if any.
• How the Board will set penalties for small businesses, and how the voluntary undertaking route will work.
• Whether and how sector regulators will adjust their rules to the Act.
• Any development after 20 October 2026.