What a small Indian company must have in place by 13 May 2027

If your company decides why and how personal data is processed, it is a Data Fiduciary under Section 2(i) of the Digital Personal Data Protection Act, 2023, and the Act’s duties apply to it whatever its size: the definition covers “any person”, with no headcount or revenue threshold. The core obligations (notice, security safeguards, personal data breach intimation, erasure, children’s data and Data Principal rights) apply from 13 May 2027, eighteen months after the DPDP Rules, 2025 were published (Rule 1(4)).

“Data Fiduciary” means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data;

— Digital Personal Data Protection Act, 2023, Section 2(i)

The Act covers digital personal data, including records you collected on paper and digitised later (S.3(a)). Your customers, your employees and the people on your sales list are all Data Principals. Ten common beliefs about scope, from a startup exemption to paper records, are checked against the text in who the DPDP Act applies to. The rest of this page is the DPDPA compliance list for a company of 5 to 200 people: what “in place” means, one row per obligation.

What does DPDPA compliance require of a small company?

#	Obligation	Source	What “in place” looks like	Read more
1	Notice	S.5, Rule 3	A standalone notice shown with or before every consent request. It lists the personal data item by item, the specific purpose, and the service that purpose enables, and links to where the person can withdraw consent, exercise their rights and complain to the Board. It is available in English or any language in the Eighth Schedule to the Constitution (S.5(3)). People who consented before the Act commenced get a notice as soon as reasonably practicable (S.5(2)).	Consent management API
2	Consent, and withdrawal as easy as giving it	S.6	Consent is free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the data the purpose needs (S.6(1)). Withdrawing takes no more effort than consenting did (S.6(4)). After a withdrawal, you and your processors stop within a reasonable time (S.6(6)). You keep records of each notice and consent, because you must prove them if challenged (S.6(10)).	Consent management API
3	Legitimate uses (processing without consent)	S.7	A written note, per data flow, of which processing runs without consent and under which clause: data a person gave you voluntarily for a purpose and hasn’t objected to (S.7(a)), legal disclosure duties and court orders (S.7(d)–(e)), medical emergencies (S.7(f)), and employment purposes (S.7(i)). Everything else needs consent.	DPDPA compliance guide
4	Security safeguards	S.8(5), Rule 6	At minimum (Rule 6(1)): encryption, masking or tokenisation of personal data; access control on the systems that hold it; logs, monitoring and review that let you detect and investigate unauthorised access; backups so you can keep working after a compromise; those logs and the related personal data kept for one year; security clauses in processor contracts; and the technical and organisational measures that make all of this stick.	Encryption requirements, Zero trust
5	Personal data breach intimation	S.8(6), Rule 7	Two clocks. On becoming aware of a personal data breach, tell each affected person and the Board without delay (Rule 7(1), Rule 7(2)(a)). Then send the Board the detailed report within 72 hours of becoming aware, or within a longer period the Board allows on a written request (Rule 7(2)(b)). In place means a runbook, message templates carrying the five items Rule 7(1) lists, and a working route to every user through their account or registered contact details.	Breach intimation explained, Breach runbook, Breach notification automation
6	Erasure and processing logs	S.8(7), Rule 8	Erase personal data when consent is withdrawn or the purpose is no longer served, whichever comes first, unless a law requires you to keep it, and make your processors erase their copies (S.8(7)). Separately, keep personal data, traffic data and processing logs for at least one year from the date of processing, then erase them unless another law requires longer (Rule 8(3)). In place means a retention schedule per data category, with the legal reason for anything kept longer.	Privacy by design in CI/CD
7	A published contact person	S.8(9), Rule 9	The business contact details of a person who can answer questions about how you process personal data, published prominently on your website or app and included in every reply to a request from a Data Principal exercising their rights. This person does not have to be a Data Protection Officer.	5-step implementation roadmap
8	Children and lawful guardians	S.9, Rules 10–12	If anyone under 18 may use your service: verifiable consent of a parent before you process the child’s personal data, with due diligence that the parent is an identifiable adult (Rule 10). The same applies to the lawful guardian of a person with disability, whose appointment you verify (Rule 11). No processing likely to harm a child’s well-being, and no tracking, behavioural monitoring or targeted advertising directed at children (S.9(2)–(3)). Some classes and purposes are exempt (Rule 12, Fourth Schedule).	No dedicated article yet
9	Data Principal rights and grievances	S.8(10), S.11–14, Rule 14	A published way for people to request a summary of their data and the list of everyone you shared it with (S.11), to have it corrected, completed, updated or erased (S.12), and to nominate someone to act for them (S.14). A grievance process that answers within the period you publish, which may not exceed 90 days (Rule 14(3)). Behind it: knowing which systems hold each person’s data.	No dedicated article yet
10	Processor contracts	S.8(1)–(2), Rule 6(1)(f)	A valid contract with every vendor that processes personal data for you (cloud hosting, CRM, payroll, email), with security safeguard clauses, and terms on erasure and log retention. You remain responsible for what they do on your behalf (S.8(1)).	No dedicated article yet
11	Cross-border transfer	S.16, Rule 15	Transfers abroad are allowed by default. The Central Government may restrict transfers to specific countries by notification (S.16(1)), a negative-list model, and may set requirements on making data available to a foreign State (Rule 15). In place means a current list of the countries where your data and vendors sit, so you can act if a country is notified. A stricter sector law still applies (S.16(2)).	Cross-border data transfer

Penalties are set case by case: up to ₹250 crore for security safeguard failures (Schedule item 1), set by the Board under S.33(2).

What does the DPDPA not require of most small businesses?

The heaviest duties sit with a Significant Data Fiduciary, which the Central Government notifies (S.10(1)). Unless you have been notified, the right-hand column does not apply to you.

Duty	Every Data Fiduciary	Significant Data Fiduciary	Source
Security safeguards, personal data breach intimation, grievance redressal	Yes	Yes	S.8(5), S.8(6), S.8(10)
Publish a contact person who can answer questions	Yes	Yes, as the DPO’s contact details	S.8(9), Rule 9
Appoint a Data Protection Officer based in India	No	Yes	S.10(2)(a)
Appoint an independent data auditor	No	Yes	S.10(2)(b)
Periodic Data Protection Impact Assessment	No	Yes	S.10(2)(c)(i)
DPIA and audit every twelve months, with a report of significant observations to the Board	No	Yes	Rule 13(1)–(2)
Due diligence that its algorithmic software poses no likely risk to Data Principals’ rights	No	Yes	Rule 13(3)

Beyond that table, three more things are not required of most small businesses:

• Registration with the Board. Neither the Act nor the Rules ask a Data Fiduciary to register. The only registration they set up is for Consent Managers (S.6(9), Rule 4).
• A Consent Manager. A Data Principal may give, manage, review or withdraw consent through a registered Consent Manager (S.6(7)). Whether you integrate with one is your choice; the registration regime is in Rule 4.
• Fixed inactivity deletion with a 48-hour warning. That applies only to the platform classes in the Third Schedule: e-commerce entities and social media intermediaries with at least two crore registered users in India, and online gaming intermediaries with at least fifty lakh (Rule 8(1)–(2)).

When do the DPDP Rules come into force?

Date	What comes into force	Covers
13 Nov 2025	Rules 1, 2 and 17–21	Title, definitions, and the rules on how the Board itself is run (Rule 1(2))
13 Nov 2026	Rule 4	Registration and obligations of Consent Managers (Rule 1(3))
13 May 2027	Rules 3, 5–16, 22 and 23	Notice, safeguards, personal data breach intimation, retention, children, Significant Data Fiduciary duties, rights, cross-border transfer, appeals and calls for information (Rule 1(4))

By the numbers. Of the 23 DPDP Rules, 7 came into force on publication, 1 a year later, and the remaining 15 come into force on 13 May 2027. Nine of the eleven checklist rows above rest on one of those 15 Rules; the other two (consent and legitimate uses) cite only sections of the Act. Method: counted from Rule 1(2)–(4) of the Rules, G.S.R. 846(E) dated 13 November 2025 as corrected by G.S.R. 892(E), and from the Source column of the checklist.

Find your gaps

Eleven rows is a short DPDPA compliance list, but each row is a set of engineering decisions. For the hours each row takes and what drives them, see what DPDPA readiness costs a small company. To weigh software, a consultant and a law firm for that work, see DPDPA tools vs consultants vs law firms. The free DPDP Gap Identifier walks through them for your company and shows which rows are open. If you’d rather work through it with an engineer, our DPDPA compliance service turns the open rows into a six-month plan, or get in touch.

If your team would rather build it, the tested code behind our engineering articles, from consent records and breach detection to encryption and data-residency policies, is open source in the DPDPA Engineering Kit on GitHub (Apache 2.0).

To find out what personal data your code already holds, run dpdp-scan (Apache 2.0) over a repository: it finds Aadhaar, PAN, GSTIN, UPI and phone numbers in code, fixtures and logs with their real checksums, lists the personal-data fields your SQL, Prisma and OpenAPI schemas declare, flags personal data written to logs or sent to analytics SDKs, and points each finding at the section or Rule it engages. It runs as a GitHub Action and puts findings in the Security tab; every value is masked in the output. Try it on DVDPA, a deliberately leaky demo app.

Frequently asked questions

Does the DPDP Act apply to a 10-person company?

Yes. A Data Fiduciary is “any person” that determines the purpose and means of processing personal data (S.2(i)). The Act sets no headcount or revenue threshold.

When do we have to comply?

The core duties (notice, security safeguards, personal data breach intimation, erasure, children’s data and rights) apply from 13 May 2027 (Rule 1(4)). Consent Manager registration under Rule 4 began on 13 Nov 2026.

Do we need to appoint a Data Protection Officer?

Only if the Central Government notifies you as a Significant Data Fiduciary (S.10(2)(a)). Otherwise, publish the business contact details of a person who can answer questions about your processing (S.8(9), Rule 9).

Is there a 72-hour deadline for a personal data breach?

For the detailed Board report, yes: within 72 hours of becoming aware, or longer if the Board allows on a written request (Rule 7(2)(b)). Affected people and the Board get a first intimation without delay.

Do we have to register with the Data Protection Board?

No. Neither the Act nor the Rules set up registration for Data Fiduciaries. The only registration they create is for Consent Managers (S.6(9), Rule 4).

Can we keep using servers outside India?

Yes, by default. The Central Government may restrict transfers to countries it notifies (S.16(1)) and may set requirements on making data available to a foreign State (Rule 15). A stricter sector law still applies (S.16(2)).

Is there an exemption for startups?

The Act lets the Central Government notify classes of Data Fiduciaries, including startups, to which S.5, S.8(3) and (7), S.10 and S.11 do not apply (S.17(3)). Unless a notification covers you, plan to comply in full.