DPDP Act 2023: what a small business must do first

A small business should start its DPDP work by finding out what personal data it holds, then fixing the notice and consent people see, securing the data, and agreeing what happens in a breach. Those steps cover most of what the Digital Personal Data Protection Act, 2023 asks of a business that collects customer, user or employee details. This is not legal advice. TechSum implements the technical side, and partner counsel advises on what the law requires of you.

Does the DPDP Act apply to a small business?

In nearly every case, yes. The Act applies to digital personal data processed in India, and to processing outside India when it relates to offering goods or services to people in India (section 3). A business that decides why and how personal data is processed is a Data Fiduciary (section 2(i)). If you keep customer phone numbers in a CRM, collect emails through a website form or hold employee records, you are one.

The Act does not exempt businesses by size. Section 17(3) lets the Central Government notify classes of Data Fiduciaries, startups among them, for relief from some provisions. Ask counsel whether a notified class covers you before you rely on it.

When do the DPDP obligations start?

The Digital Personal Data Protection Rules, 2025 were notified in November 2025 and switch on in stages. The provisions on the Data Protection Board came first. Most duties on Data Fiduciaries, including notice, security safeguards and breach intimation, apply about 18 months after notification, which is around May 2027. The commencement rule in the Rules gives the exact dates, and counsel can confirm them for your case.

Waiting for the date is a poor plan. Mapping data and changing systems takes longer than writing a policy.

What should a small business do first?

Work in this order. Each step feeds the next.

1. Find your personal data. List every place it enters, moves and rests: website forms, WhatsApp, email, CRM, accounting software, payment gateway, analytics, HR files, spreadsheets on someone's laptop. Note who can see each one and which outside vendors receive it. This is a data map, and every later step depends on it.
2. Write down why you hold each item. The Act ties consent and use to a specific purpose (sections 4 to 7). If you cannot name the purpose for a field, you probably should not be collecting it.
3. Fix the notice. Before or when you ask for consent, you must tell people what you collect, why, how to withdraw consent and exercise their rights, and how to complain to the Data Protection Board (section 5). The DPDP Rules, 2025 (rule 3) add detail on what the notice must contain. It must be in clear, plain language, with an option to read it in English or a language listed in the Eighth Schedule of the Constitution.
4. Fix consent. Consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and as easy to withdraw as to give (section 6). Pre-ticked boxes and bundled consents are the first things to remove. There is a separate guide on cookie consent under DPDP.
5. Secure the data. Section 8(5) requires reasonable security safeguards. The Rules (rule 6) name the basics: encryption or similar protection, access control, monitoring through logs, and backups. Turn on multi-factor authentication, remove accounts of people who have left and stop sharing passwords in chat.
6. Prepare for a breach. Section 8(6) requires you to tell the Data Protection Board and each affected person. Rule 7 sets what that intimation contains and the time for the detailed report. Decide now who investigates, who decides and who writes to customers. Our guide to the CERT-In reporting rule covers the parallel obligation under the IT Act.

What comes after the first six steps?

Once the basics hold, add the slower items:

• A process for access, correction and erasure requests and complaints (sections 11 to 13), covered in how to handle data requests.
• A retention rule for each data type, with deletion that actually runs (section 8(7)).
• Written agreements with every processor that handles data for you, such as your email platform, cloud host or agency (section 8(2)).
• Verifiable parental consent if your service is used by anyone under 18 (section 9). The Act also bars tracking, behavioural monitoring and targeted advertising aimed at children.

Each of these touches a real system. A retention rule needs a database job, and an erasure request needs a search across every tool that holds the person's data.

What does non-compliance cost?

The Schedule to the Act, read with section 33, sets maximum penalties. The highest are up to Rs 250 crore for failing to take reasonable security safeguards, and up to Rs 200 crore for failing to notify a breach or to meet the duties on children's data. These are ceilings. The Data Protection Board considers the nature, gravity and duration of the breach, among other factors, before deciding an amount.

The practical risk for a small business is usually less dramatic: a customer complaint you cannot answer, an enterprise client who asks for your data protection practices before signing, or a breach that you learn about late because nobody was watching.

What are the trade-offs?

Collecting less data is the cheapest protection and it sometimes costs you marketing convenience. A shorter form may mean fewer leads to chase. Deleting old records frees you from risk and removes history you might have used. Counsel will set the line on what you must keep for tax and other laws. Your engineers set it in code.

Another trade-off is where to spend first. A small team cannot do everything at once. Data map, notice and consent, security basics and breach plan, in that order, buys the most protection per week of effort.

Where does TechSum fit?

We build and fix the technical parts: data mapping, consent and notice flows, request workflows, retention jobs and security hardening. Partner counsel advises on legal interpretation. If you want a first look at your own setup, the DPDP Readiness Scan gives a short written report with the top fixes, and the free health check covers the public-facing basics. More detail is on the DPDP Act compliance page and the Trust, Security and Compliance pillar.