What DPDPA readiness costs a small Indian company (5–200 people)

There is no fee to comply with the DPDP Act. A Data Fiduciary does not register with the Data Protection Board; the Act’s only registration is for Consent Managers (S.6(9)). So the DPDPA compliance cost for a small company is almost entirely effort: hours from your own team, a little tooling, and any outside help you buy. This page breaks that effort down by obligation, names the cost drivers that move it, and sets out the effort model behind our estimates. Most of the obligations apply from 13 May 2027 (Rule 1(4)).

Part of the DPDPA checklist for small companies. We quote no market rates here, because almost none are published. Where a public source states a price, we cite it.

What does DPDPA readiness cost, and what drives it?

The Act applies to “any person” who decides why and how personal data is processed (S.2(i)), and it sets no headcount threshold. A 10-person company has the same list of obligations as a 200-person one. What changes with size is how much work each obligation takes.

Four cost drivers explain most of the difference between two companies of the same size:

1. Systems holding personal data. Every system is a place where you secure the data (Rule 6), keep logs for a year (Rule 6(1)(e), Rule 8(3)), erase it when the purpose ends (S.8(7)), and find it when someone asks what you hold (S.11(1)(a)). Count spreadsheets on shared drives and SaaS tools, not just your own app.
2. Processors. Each vendor that processes personal data for you needs a valid contract (S.8(2)) with security safeguards (Rule 6(1)(f)), must be made to stop processing when consent is withdrawn (S.6(6)) and to erase data (S.8(7)(b)), and appears in the list of everyone you shared data with (S.11(1)(b)). You stay responsible for what they do (S.8(1)).
3. Children’s data. If any of your users are under 18 (S.2(f)), you need verifiable parental consent before processing (S.9(1), Rule 10) and must not track, behaviourally monitor or target ads at them (S.9(3)). This is the largest single step up in the model.
4. Data volume. The number of people whose data you hold drives how hard it is to reach each one after a personal data breach (Rule 7(1)), how many rights requests arrive, and how much log storage a year of retention needs.

Two smaller drivers: the number of consent flows (each signup, form or screen that asks for consent needs its own notice and withdrawal path), and cross-border processors, which add a check against any country restriction the Central Government notifies (S.16(1)), any requirement it specifies for making data available to a foreign State (Rule 15) and any stricter sectoral law (S.16(2)).

What work does each obligation take?

The table summarises each obligation. The coefficients in the last column are our working assumptions (StateCheck’s estimate of typical effort for a 5–200 person company), not measured or published figures. The ranges are deliberately wide.

Obligation	What the work is	Tooling	Outside help useful for	Main cost driver	Our effort assumption (internal hours)
Notice (S.5, Rule 3)	A standalone, itemised notice for each consent flow, with links to withdraw, exercise rights and complain to the Board	None beyond your site or app	Drafting and legal wording	Consent flows, languages	2–4 base, plus 1–2 per consent flow
Consent and withdrawal (S.6)	Record each consent, build withdrawal as easy as giving it, stop processing and tell processors to stop	Consent records in your database, or a consent tool	Reviewing the design	Consent flows	2–4 base, plus 4–10 per consent flow
Security safeguards (S.8(5), Rule 6)	The seven Rule 6(1) safeguards for every system: encryption or masking, access control, logs, backups, one-year retention, processor clauses, organisational measures	Logging and backup storage	Gap review, security testing	Systems; reduced by ISO 27001 or SOC 2	4–8 base, plus 4–10 per system
Breach intimation (S.8(6), Rule 7)	Runbook, an “aware” trigger, three message templates, a way to reach each affected person, a yearly rehearsal	Bulk email or SMS you already use	Templates, tabletop exercise	Data volume	10–20 base, plus 0.5–1 per system
Erasure and retention (S.8(7), Rule 8)	A retention schedule, erasure jobs per system, and a one-year minimum for processing logs	Scheduled jobs; log storage	Checking sectoral retention laws	Systems	2–4 base, plus 3–8 per system
Contact person (S.8(9), Rule 9)	Name a person, publish their business contact details, mention them in every rights response	None	Rarely needed	None	1–2
Children’s data (S.9, Rule 10)	Age and parental-consent flow with due diligence on the parent, and a review of tracking and ads	Possibly an identity or age token service	Flow design, Fourth Schedule check	Consent flows	8–16 base, plus 4–8 per consent flow
Rights and grievances (S.11–14, S.8(10), Rule 14)	Publish how to make a request, locate and export or correct data per system, grievance process within the period you publish (up to 90 days), nomination	A ticket queue	SOPs	Systems, data volume	4–8 base, plus 1–3 per system
SDF duties (S.10, Rule 13), only if notified	DPO based in India, independent data auditor, a DPIA and audit every twelve months	Varies	Required: the auditor must be independent	Notification by the Central Government	80–160, low confidence

Rule 6 by the numbers. Rule 6(1) lists 7 minimum safeguards, clauses (a) to (g). In our model, 2 of those 7 (one-year retention and processor clauses) are counted outside the per-system security row, under retention and processor contracts, so they are not double-counted. Method: counted from the clauses of Rule 6(1)(a)–(g), G.S.R. 846(E) as corrected by G.S.R. 892(E); allocation from our effort model.

Notice (S.5, Rule 3)

Every consent request must be “accompanied or preceded by a notice” (S.5(1)). Rule 3 says the notice must stand on its own, itemise the personal data, state each specified purpose, and link to the means to withdraw consent, exercise rights and complain to the Board. You must offer it in English or a language in the Eighth Schedule to the Constitution if the person wants (S.5(3)). If people consented before commencement, you also owe them a notice “as soon as it is reasonably practicable” (S.5(2)(a)).

Work: mostly writing and product changes. Drivers: the number of consent flows and the number of languages you offer. Translation is a vendor cost our model does not price.

Consent and withdrawal (S.6)

Consent must be “free, specific, informed, unconditional and unambiguous with a clear affirmative action” (S.6(1)). Withdrawal must be as easy as giving consent (S.6(4)), and after it you and your processors must stop processing within a reasonable time (S.6(6)). In a dispute, you must prove that notice was given and consent obtained (S.6(10)), so you need records, not just a checkbox. Using a Consent Manager is optional (S.6(7)).

Work: engineering time per consent flow, plus a way to pass withdrawals to processors. Drivers: consent flows and processors. Read DPDPA consent management API design for the data model.

Security safeguards (S.8(5), Rule 6)

Section 8(5) requires “reasonable security safeguards to prevent personal data breach”, including for processing your processors do. Rule 6(1) sets the minimum: encryption, obfuscation, masking or virtual tokens; access control; logs, monitoring and review; backups; keeping logs and personal data for one year; contract clauses with processors; and technical and organisational measures.

Work: a gap review against Rule 6(1) for each system, then the fixes. Tooling: the main recurring cost here is log storage (see below). Outside help: a gap review, and security testing (VAPT, source code review) to check the safeguards hold. Drivers: systems. An ISO 27001 or SOC 2 programme already covers much of access control, logging and backups, so our model reduces this row for certified companies. It does not reduce the DPDPA-specific rows. See the DPDPA to ISO 27001 mapping and SOC 2 and DPDPA.

Breach intimation (S.8(6), Rule 7)

A personal data breach must be intimated to the Board and each affected person (S.8(6)). Both get a first intimation without delay (Rule 7(1), Rule 7(2)(a)); the detailed Board report is due within 72 hours of becoming aware, or longer if the Board allows on a written request (Rule 7(2)(b)).

Work: mostly preparation, done once and rehearsed yearly. Drivers: data volume, because Rule 7(1) requires telling each affected person through their user account or a contact method they registered. The full process is on the breach intimation page.

Erasure and retention (S.8(7), Rule 8)

Erase personal data when consent is withdrawn or the purpose is no longer served, whichever is earlier, unless a law requires you to keep it, and make your processors erase too (S.8(7)). Separately, keep personal data, traffic data and processing logs for at least one year from processing, then erase them unless another law requires longer (Rule 8(3)). The three-year inactivity rule in Rule 8(1) applies only to the large platforms in the Third Schedule (e-commerce and social media with at least two crore registered users in India, online gaming with at least fifty lakh), not to most small companies.

Work: a retention schedule, then an erasure job and a log-retention setting for each system. Outside help: checking which sectoral laws make you keep data longer; that is a legal question. Drivers: systems and processors.

Contact person (S.8(9), Rule 9)

Publish the business contact details of a person who can answer questions about your processing, prominently on your website or app, and mention them in every response to a rights request (Rule 9). You don’t need a Data Protection Officer unless you are a Significant Data Fiduciary (S.10(2)(a)). This is the cheapest obligation: an hour or two.

Children’s data (S.9, Rule 10)

Before processing any personal data of a child, you need verifiable consent of the parent (S.9(1)). Rule 10 requires technical and organisational measures for this and due diligence that the person claiming to be the parent is an identifiable adult, using identity and age details you already hold, or details provided voluntarily by the person or through a virtual token issued by an authorised entity (Rule 10(1)). You must not track, behaviourally monitor or target ads at children (S.9(3)), which may mean changing your analytics and ad setup. Some classes and purposes are exempt from S.9(1) and (3), such as an educational institution tracking for its educational activities or children’s safety (Rule 12 and the Fourth Schedule).

Work: a new consent flow and a review of every tracker. Tooling: possibly an identity or age-token service; we found no published price to cite. Drivers: consent flows. Persons with disability who have a lawful guardian need a similar flow (S.9(1), Rule 11); our model does not cost it separately.

Rights and grievances (S.11–14, Rule 14)

People can ask for a summary of their data and the processing done with it, and the identities of everyone you shared it with (S.11(1)). They can ask for correction, completion, updating and erasure (S.12), and can nominate someone to act for them on death or incapacity (S.14). You publish how to make a request (Rule 14(1)), run a grievance mechanism (S.8(10)), and answer grievances within the period you publish, which may not exceed 90 days (Rule 14(3)).

Work: SOPs, plus the ability to find and act on one person’s data in every system. Drivers: systems (how many places to search) and data volume (how many requests).

SDF duties (S.10, Rule 13), only if notified

These apply only if the Central Government notifies you as a Significant Data Fiduciary (S.10(1)). An SDF appoints a DPO based in India and an independent data auditor (S.10(2)(a)–(b)), and carries out a DPIA and an audit once every twelve months, with a report of significant observations to the Board (Rule 13(1)–(2)). Our effort model counts these hours only for a notified SDF, and marks them low confidence.

What does a year of log retention cost?

Log storage is the one recurring cost where a public price exists. Rule 6(1)(e) and Rule 8(3) both mean keeping logs for at least a year. In AWS’s published price list for the Asia Pacific (Mumbai) region, S3 Standard storage is listed at $0.025 per GB-month for the first 50 TB, and S3 Glacier Instant Retrieval at $0.005 per GB-month (AWS price list API, ap-south-1, publication date 4 Nov 2026, accessed 4 Nov 2026).

A company writing 50 GB of logs a month holds about 600 GB once a year of logs has built up. At those list prices that is about $180 a year in S3 Standard, or about $36 a year in Glacier Instant Retrieval. Method: 50 GB × 12 months = 600 GB held; 600 × $0.025 × 12 months, and 600 × $0.005 × 12 months. Excludes request, retrieval and transfer charges and taxes; prices are in US dollars and change over time. For most small companies, storage is a small part of the DPDPA compliance cost next to the people time.

What does the effort model give for typical companies?

We ran our effort model for four example companies. “Outside help” is the share of work a consultant would typically do; if you do it yourself, those hours move to your team, roughly one for one.

Example company	Internal hours	Outside help hours	Total hours	Total working days
5 people, 1 system, no processors or consent flows, under 10,000 people’s data	46–102	41–84	87–186	11–23.5
40 people, 6 systems, 8 processors (5 abroad), 3 consent flows, 1 extra language, existing users, 10,000–1 lakh people	170–397	87–186	257–583	32–73
The same 40-person company with ISO 27001	155–361	77–162	233–523	29–65.5
120 people, 12 systems, 15 processors (6 abroad), 5 consent flows, 2 extra languages, existing users, children’s data, 1–10 lakh people, SOC 2	328–759	132–280	460–1039	57.5–130

Method: outputs of our effort model, with 8 hours to a working day, rounded to the nearest hour and half day. The coefficients are StateCheck’s assumptions, not survey or market data, and the ranges are deliberately wide.

Two things stand out. Security safeguards are the largest obligation in all four runs, and certification trims the total by roughly a tenth, not more, because the DPDPA-specific work remains. Children’s data and staff numbers push the 120-person company well past the others.

What does not complying cost?

The only figures the Act gives are ceilings. The Schedule to the Act sets them, under S.33(1):

Sl. No.	Breach of provisions of this Act or rules made thereunder	Penalty
1.	Breach in observing the obligation of Data Fiduciary to take reasonable security safeguards to prevent personal data breach under sub-section (5) of section 8.	May extend to two hundred and fifty crore rupees.
2.	Breach in observing the obligation to give the Board or affected Data Principal notice of a personal data breach under sub-section (6) of section 8.	May extend to two hundred crore rupees.
3.	Breach in observance of additional obligations in relation to children under section 9.	May extend to two hundred crore rupees.
4.	Breach in observance of additional obligations of Significant Data Fiduciary under section 10.	May extend to one hundred and fifty crore rupees.
7.	Breach of any other provision of this Act or the rules made thereunder.	May extend to fifty crore rupees.

— Digital Personal Data Protection Act, 2023, the Schedule (items 1–4 and 7; items 5 and 6 cover the duties of Data Principals and voluntary undertakings)

These are maximums. The Board imposes a penalty only if it finds, after an inquiry and a hearing, that a breach is significant (S.33(1)). It then decides the amount, having regard to matters including the nature, gravity and duration of the breach, the type of personal data affected, whether it was repeated, whether you mitigated it and how quickly, and the likely impact of the penalty on you (S.33(2)(a)–(g)). No one can tell you in advance what a given failure would cost.

How do you budget for DPDPA readiness?

1. List every system that holds personal data, including spreadsheets and SaaS tools. This number drives most of the estimate.
2. List every processor and where it processes the data. Note which are outside India.
3. Count your consent flows: each signup, form or screen that asks for consent.
4. Check for children’s data. If any user may be under 18, budget for the parental-consent flow, and check whether a Fourth Schedule exemption applies.
5. Estimate how many people’s data you hold, in bands: under 10,000; up to 1 lakh; up to 10 lakh; more.
6. Apply the ranges in the obligation table to your counts, and take the high end if your systems are poorly documented.
7. Decide what to buy and what to build. Writing and legal wording are good candidates for outside help; consent flows, erasure jobs and log settings are usually your engineers’ work.
8. Plan back from 13 May 2027. Leave time in your DPDPA readiness plan for a breach rehearsal and for sending notices to existing users.

Common mistakes

• Budgeting for a registration fee. There isn’t one for a Data Fiduciary; the Act’s registration is for Consent Managers (S.6(9)).
• Budgeting for a DPO. Only a Significant Data Fiduciary must appoint one (S.10(2)(a)). Everyone else publishes a contact person (S.8(9), Rule 9).
• Treating ₹250 crore as the price of non-compliance. It is the ceiling for one item in the Schedule. The Board sets each amount under S.33(2).
• Assuming certification means compliance. ISO 27001 or SOC 2 reduces the security safeguards work. It does not produce your notices, consent records, rights process or retention schedule.
• Leaving out processors. You stay responsible for processing done on your behalf (S.8(1)), so every processor adds contract and erasure work.
• Forgetting existing users. People who consented before commencement still need a notice as soon as reasonably practicable (S.5(2)(a)).

Related obligations

• The full checklist: all eleven obligations on one page.
• Breach intimation: the two clocks of Rule 7.
• DPDP Gap Identifier: find which obligations are still open for you.

Frequently asked questions

How much does DPDPA compliance cost a small company?

There is no fixed DPDPA compliance cost, because the Act charges no fee. The cost is your team’s time, some tooling and any outside help. Our effort model puts a 40-person company with six systems and eight processors at 257–583 hours in total; your numbers depend on your systems, processors, children’s data and data volume.

Do we have to pay to register with the Data Protection Board?

No. A Data Fiduciary does not register. The Act’s registration requirement is for Consent Managers (S.6(9)), and using one is optional (S.6(7)).

Is the fine for non-compliance ₹250 crore?

No, ₹250 crore is the ceiling for failing to take reasonable security safeguards (the Schedule, item 1). Other items have lower ceilings. The Board decides each amount after an inquiry, having regard to the matters in S.33(2).

Does ISO 27001 or SOC 2 make us DPDPA compliant?

Not on its own. It covers much of the security safeguards work under S.8(5) and Rule 6, so it lowers that part of the budget. Notice, consent, rights, retention and children’s data are separate obligations.

Are startups exempt?

The Central Government has the power to exempt notified Data Fiduciaries, including startups, from some provisions (S.17(3)). Unless you fall within such a notification, budget for the full list.

When do we need to have spent the money?

Most obligations apply from 13 May 2027 (Rule 1(4)). Work on processor contracts and erasure jobs takes the longest, so start there.

---

Checked against the DPDP Act, 2023 and the DPDP Rules, 2025 (G.S.R. 846(E), as corrected by G.S.R. 892(E)) on 25 October 2026.

Start with the free DPDP Gap Identifier, or get in touch for a written scope.