Yes. The DPDP Act has no size threshold: any business that decides why and how digital personal data is processed is covered. Most duties start on 13 May 2027 under notifications published in November 2025, so use this year to map your data, fix your forms and write a breach plan.
Yes. The Digital Personal Data Protection Act, 2023 has no turnover or headcount threshold. It applies to any business that decides why and how digital personal data is used, so a two-chair dental clinic in Kochi with an online booking form has the same core duties as a large retailer. Under the Rules and a commencement notification, both published on 13 November 2025, most of those duties start on 13 May 2027: notices, consent, security safeguards, breach reporting and answering people's requests.
That is less time than it sounds, because the real work is finding where personal data already sits: website forms, spreadsheets, WhatsApp chats, billing software and the inbox of whoever answers enquiries. Here is what the law requires, the timeline and a plan. It is a practical starting point, not legal advice.
- Maximum penalty for failing to take reasonable security safeguards
- ₹250 crore
- Maximum penalty for failing to take reasonable security safeguards
- To send the Data Protection Board a detailed report after learning of a breach
- 72 hours
- To send the Data Protection Board a detailed report after learning of a breach
- Longest you can take to respond to a person's request or grievance
- 90 days
- Longest you can take to respond to a person's request or grievance
- Minimum period to keep logs of each processing activity
- 1 year
- Minimum period to keep logs of each processing activity
01
Who the law covers, and what it leaves out
The Act covers personal data in digital form, including data you collected on paper and later typed into a computer. A handwritten visitor register that never leaves the front desk is outside it; the same names copied into Excel are inside. It does not apply to data an individual handles for personal or domestic reasons, or to information people have made public about themselves.
If you decide what data to collect and what to do with it, you are a Data Fiduciary. The companies that handle data on your behalf, such as your CRM, cloud host or payroll bureau, are Data Processors. You stay responsible for what they do, and you may only use them under a valid contract. The Act allows the government to exempt startups from a few duties, but the November 2025 Rules contain no general carve-out for small businesses.
02
Consent, and when you do not need it
Where you rely on consent, the Act says it must be "free, specific, informed, unconditional and unambiguous with a clear affirmative action", limited to the data the stated purpose needs, and as easy to withdraw as to give. A pre-ticked box, or a form that will not submit unless someone accepts marketing, will struggle to meet that test.
Consent is not the only route. Among the Act's legitimate uses, the most useful for small firms is data a person gives you voluntarily for a specific purpose: its own example is a pharmacy texting a payment receipt to the number a customer provided. Employment purposes, legal duties to share information with the State, court orders and medical emergencies are also covered. The catch is purpose: a number shared for a receipt is not permission for promotional broadcasts.
Children need extra care. For anyone under 18 you need verifiable consent from a parent, and you must not track, behaviourally monitor or target advertising at children. The Rules allow narrow exceptions, such as schools monitoring pupils for educational activities or safety. If you serve students or young customers, plan for parental consent now.
03
The timeline, as of June 2026
11 Aug 2023
The Act is enacted
It receives Presidential assent but is not yet in force.
3 Jan 2025
Draft Rules published
The consultation received 6,915 inputs.
13 Nov 2025
Final Rules published
Provisions setting up the Data Protection Board take effect immediately.
Jan 2026
A faster rollout is floated
MeitY asks companies about cutting the runway from 18 months to 12.
13 Nov 2026
Consent Manager rules take effect
13 May 2027
Main duties apply
Notice, consent, security, breach reporting, rights and children's data rules bind every Data Fiduciary.
04
What changes on your forms, website and WhatsApp
Rule 3 sets out what a notice must contain: clear, plain language that makes sense on its own, an itemised list of the personal data you collect, the purpose and the service it enables, and how people can withdraw consent, exercise their rights and complain to the Data Protection Board. You must also publish a contact who can answer questions about your data handling, explain how to request access, correction or erasure, and respond within 90 days at most.
| Where data sits | Typical gap today | What the law expects |
|---|---|---|
| Website enquiry form | Asks for date of birth and address just in case | Only the fields the purpose needs, with an itemised notice |
| WhatsApp broadcast list | Numbers added from old bills | Promotional messages only with consent |
| Shared customer spreadsheet | Everyone can edit, nobody knows who opened it | Access control, plus logs to detect misuse |
| CRM, hosting or payroll vendor | No data protection clause in the contract | A contract requiring reasonable security safeguards |
| Old enquiries and leads | Kept indefinitely | Erased once the purpose is served, with processing logs kept for a year |
Retention cuts both ways. You must erase personal data when consent is withdrawn or the purpose is over, and make your processors do the same. Rule 8(3) also requires you to keep the personal data, traffic data and logs of each processing activity for at least one year from that processing, so build a deletion schedule rather than clearing folders on impulse. See also our guides to choosing a first CRM and privacy-first analytics.
05
Security and breaches: where the big penalties sit
Rule 6 lists the minimum safeguards: encryption, masking or similar protection of personal data; access controls on the systems that hold it; logs and monitoring so you can detect and investigate unauthorised access; backups so you can keep working if data is lost; and security clauses in your contracts with processors. In practice: individual logins with two-factor authentication, encrypted devices, and tested backups. Our website security essentials cover the basics.
If a breach happens, Rule 7 requires you to tell each affected person without delay, in plain language: what happened, the likely consequences, what you are doing about it, what they can do to protect themselves, and who to contact. The Board must also be told without delay, followed by a detailed report within 72 hours.
06
What to do before the deadline
For most small businesses this is a few weeks of focused housekeeping, not a legal project:
- Map your data. List every place personal data enters or lives: forms, WhatsApp, spreadsheets, billing software, email, and every vendor that touches it.
- Cut what you do not need. Drop unnecessary form fields and stale records, keeping processing logs for the one-year minimum.
- Rewrite your notices. One plain-language notice per form, listing the data and the purpose, with a way to withdraw consent and make a request.
- Separate service from marketing. Use unticked opt-ins for promotions, and treat receipts, reminders and order updates as their own purpose.
- Name a contact and open one request channel. Publish it on your website, log every request and track the 90-day limit.
- Lock down access. Individual accounts, two-factor login, the least access each role needs, and a checklist for staff who leave.
- Fix vendor contracts. Add security and deletion clauses for your CRM, hosting, payroll and messaging providers.
- Write a one-page breach plan. Decide who leads, who informs customers and who files with the Board within 72 hours.
If you want a second pair of eyes on your forms, tracking and hosting, start with a free audit.
Sources
Facts current as of 5 June 2026; watch for MeitY notifications that change the dates.