DPDP Act Compliance for Startups and MSMEs: A Minimum Viable Data Protection Framework 

Introduction

The Digital Personal Data Protection Rules, 2025 (“DPDP Rules”) were notified on 13 November 2025, more than two years after the Digital Personal Data Protection Act, 2023 (“DPDP Act” or “Act”) received Presidential assent. The Government has adopted a phased implementation approach, with most of the substantive obligations under the Act and Rules becoming operative 18 months from the date of notification, i.e., on 13 May 2027.

For businesses that have not yet begun preparing, May 2027 may appear some distance away. However, consent mechanisms, privacy notices, data-retention practices, vendor contracts and personal data breach response protocols are not systems that can be meaningfully built overnight.

For a well-funded company, DPDP compliance may be another line item in the legal or technology budget. For a bootstrapped startup or a small manufacturing or services business, it may appear to be an additional cost competing with more immediate business priorities.

The objective is not to suggest that every startup or MSME needs an expensive data protection consultancy or enterprise-grade privacy technology. Instead, the more practical approach is to identify what is legally important, prioritise the measures that reduce the greatest risk, and build a proportionate compliance framework over time.

This article sets out a minimum viable DPDP compliance framework for startups and MSMEs, focusing on the steps that smaller businesses can take without disproportionately increasing their compliance costs.

Where Indian Data Protection Law Stands Today

The DPDP Act is underpinned by the constitutional recognition of privacy as a fundamental right. In Justice K.S. Puttaswamy (Retd.) v. Union of India, the Supreme Court recognised privacy as an intrinsic part of the right to life and personal liberty under Article 21 of the Constitution, subject to the constitutional requirements applicable to restrictions on that right.

The DPDP Act establishes a statutory framework for the processing of digital personal data. Broadly, it regulates the activities of Data Fiduciaries and Data Processors, provides for consent and specified legitimate uses as bases for processing, recognises rights of Data Principals, imposes security and accountability obligations, and establishes the Data Protection Board of India.

The implementation of the DPDP Act is phased. Certain provisions relating to the establishment and functioning of the Data Protection Board and other institutional and procedural matters came into force on 13 November 2025. The provision relating to the registration of Consent Managers is scheduled to come into force one year after notification, on 13 November 2026. The principal substantive provisions of the Act, including those concerning notice, consent, Data Principal rights, security safeguards, children’s data and Significant Data Fiduciaries, are scheduled to come into force 18 months after notification, on 13 May 2027.

The DPDP Rules follow a similar staggered commencement structure. Rules 1, 2 and 17 to 21 came into force upon publication; Rule 4 is to come into force one year after publication; and Rules 3, 5 to 16, 22 and 23 are to come into force 18 months after publication.

Is there a startup or MSME exemption under the DPDP Act?

One assumption that startups and MSMEs should avoid is that being a “small business” automatically places the organisation outside the DPDP Act. Section 17(3) of the DPDP Act does empower the Central Government, having regard to the volume and nature of personal data processed, to notify certain Data Fiduciaries or classes of Data Fiduciaries, including startups, to whom specified provisions will not apply. However, this is an enabling power and should not be treated as a blanket exemption available to every startup.

Similarly, the fact that an enterprise qualifies as an MSME under the applicable MSME classification does not, by itself, mean that it is exempt from DPDP compliance. Accordingly, a business processing digital personal data should approach compliance on the basis that the Act applies unless a specific exemption is available to it.

The practical burden of compliance, however, can and should be proportionate to the nature, scale and risk of the business. A ten-person startup does not necessarily need the same compliance infrastructure as a large financial institution.

Building a Minimum Viable DPDP Compliance Framework

A minimum viable compliance framework does not mean cutting corners. It means sequencing compliance efforts around the measures that address the most immediate legal and operational risks.

1. Start with a data inventory

The first step is to understand what personal data the business actually processes. A startup should identify:

• what personal data it collects;
• from whom it collects the data;
• the purposes for which the data is processed;
• where the data is stored;
• who within the organisation can access it;
• which Data Processors or other third parties receive it;
• how long the data is retained; and
• when and how the data should be deleted.

This does not necessarily require specialised software. For many small businesses, a well-maintained spreadsheet mapping categories of personal data against purpose, source, storage location, retention period and third-party access can provide a practical starting point.

A data inventory is important because it provides the foundation for almost every other aspect of DPDP compliance. A business cannot meaningfully determine whether its privacy notice is accurate, whether it is retaining data unnecessarily, or whether its vendors are appropriately contracted unless it first understands what data it holds and how that data moves through the organisation.

2. Put a clear privacy notice and consent mechanism in place

Businesses should prepare a clear and accessible privacy notice that explains the personal data being processed and the purpose or purposes for which it is processed. The DPDP Rules require the notice to be understandable independently of other information provided by the Data Fiduciary and to contain sufficient detail to enable the Data Principal to provide specific and informed consent.

Where consent is the basis for processing, the business should also ensure that withdrawal of consent is straightforward and reasonably comparable in ease to providing consent.

For smaller businesses, the objective should not be to produce a lengthy privacy policy that few users will read. The objective should be a clear, accurate and operational privacy notice supported by consent mechanisms that actually work.

3. Establish a simple grievance and rights-management process

The DPDP framework gives Data Principals rights in relation to their personal data, including rights relating to access, correction, completion, updating, erasure and grievance redressal, subject to the conditions prescribed under the Act and Rules. A small business does not necessarily need a dedicated privacy team to address these requirements. It should, however, identify:

• a responsible person or team for handling privacy-related queries;
• a designated business contact point;
• a process for receiving and tracking requests;
• a process for verifying requests where necessary; and
• an internal mechanism for responding within the applicable timelines.

The DPDP Rules also require Data Fiduciaries to prominently publish relevant contact information for responding to questions relating to the processing of personal data.

4. Put processor agreements in place

Many startups and MSMEs rely extensively on third-party service providers, including cloud platforms, payroll providers, customer relationship management systems, marketing platforms, recruitment and background-verification providers, accounting software and other technology vendors.

Under Section 8(2) of the DPDP Act, a Data Fiduciary may engage a Data Processor for processing personal data on its behalf for activities connected with offering goods or services only under a valid contract. Accordingly, businesses should identify vendors that process personal data on their behalf and review whether their contractual arrangements appropriately address data protection and security obligations.

This does not necessarily require renegotiating every commercial contract from scratch. A proportionate approach may involve a standard data-processing or privacy schedule that can be incorporated into vendor agreements where appropriate.

5. Build a practical personal data breach response plan

A breach response plan is one of the most important low-cost measures a small business can implement. The DPDP Act requires Data Fiduciaries to take reasonable security safeguards to prevent personal data breaches and to notify the Data Protection Board and affected Data Principals in the prescribed manner.

The DPDP Rules require a Data Fiduciary, upon becoming aware of a personal data breach, to inform affected Data Principals without delay using clear and concise communication. The notification must provide relevant information concerning the nature and extent of the breach, its likely consequences, measures taken or being taken to mitigate the effects, steps that the Data Principal can take to protect their interests, and relevant contact information.

The Data Fiduciary must also inform the Board without delay and provide updated and detailed information concerning the breach within 72 hours of becoming aware of it, unless the Board allows a longer period on a written request. This distinction is important: 72 hours is not the deadline for the initial notification to affected Data Principals. For a smaller business, a practical incident-response checklist should identify:

1. who must be informed internally when an incident is detected;
2. who has authority to contain the incident;
3. how affected systems and accounts will be secured;
4. how evidence and relevant logs will be preserved;
5. who will assess whether personal data has been compromised;
6. who will coordinate regulatory notification; and
7. who will communicate with affected individuals.

The DPDP Rules also prescribe specific security measures, including encryption or other appropriate protections, access controls, monitoring and logging, backups and appropriate contractual provisions with Data Processors.

The statutory ceiling for failure to take reasonable security safeguards is ₹250 crore, while failure to notify a personal data breach can attract a penalty of up to ₹200 crores. These are maximum statutory penalties, not automatic fines. The Board is required to consider factors including the nature, gravity and duration of the breach, the type of personal data affected, mitigation measures and the likely impact of the penalty on the entity.

6. Introduce a retention and deletion discipline

Data should not be retained indefinitely merely because digital storage is inexpensive. Section 8(7) of the DPDP Act requires a Data Fiduciary, subject to applicable legal retention requirements, to erase personal data when the Data Principal withdraws consent or when it is reasonable to assume that the specified purpose is no longer being served.

The DPDP Rules also prescribe specific retention periods for certain classes of Data Fiduciaries and purposes. For most smaller businesses, the starting point should therefore be a simple retention schedule identifying:

• what data must be retained;
• why it must be retained;
• the legal or business basis for retention;
• how long it should be retained; and
• when it should be deleted or anonymised, where appropriate.

7. Do not over-engineer Significant Data Fiduciary compliance

Not every startup or MSME will be a Significant Data Fiduciary (“SDF”). The Central Government may notify a Data Fiduciary or class of Data Fiduciaries as an SDF based on factors including the volume and sensitivity of personal data processed, risks to the rights of Data Principals, and other factors specified in the Act.

SDFs are subject to additional requirements, including the appointment of a Data Protection Officer, appointment of an independent data auditor, periodic Data Protection Impact Assessments and periodic audits.

For most smaller businesses, it may therefore be unnecessary to build an SDF-level compliance programme before there is a legal or commercial reason to do so. Instead, founders should monitor whether their sector, processing activities or data profile could bring them within the scope of an SDF notification. The principle should be simple: build for the risk the business actually has, not the risk of an enterprise that it may become years from now.

Why DPDP Compliance Is Becoming a Growing Concern for Startups and MSMEs

Three developments make data protection increasingly relevant to smaller businesses.

First, the DPDP Act establishes significant statutory penalty ceilings that are not expressed as a percentage of an entity’s revenue or linked directly to its employee headcount. At the same time, the Board must consider proportionality and the likely impact of a penalty when determining the amount of penalty to impose. For a smaller business, the financial and operational consequences of a serious breach can nevertheless be significant.

Second, privacy compliance is increasingly becoming a commercial diligence issue. Investors, acquirers, enterprise customers and business partners may ask startups to demonstrate how personal data is collected, used, stored and shared. A business that cannot answer these questions may face additional diligence requirements, contractual negotiations or remediation costs even before any regulator becomes involved.

Third, the compliance market itself can create confusion. The notification of the DPDP Rules has resulted in an increasing number of privacy products, consultants and technology solutions being marketed to businesses. While some organisations may require sophisticated compliance tooling, smaller businesses should avoid assuming that enterprise-grade technology is a prerequisite for compliance.

The more sustainable approach is to first establish the underlying processes and documentation and then invest in technology where it solves a genuine operational problem.

Where Should Startups and MSMEs Focus Their DPDP Compliance Budget?

With the substantive provisions of the DPDP framework scheduled to become operative in May 2027, businesses have an opportunity to build compliance incrementally rather than treating it as a last-minute exercise. A sensible sequence would be:

First, map the data: Complete the data inventory and identify the organisation’s principal data flows.

Second, fix the privacy notice and consent mechanisms: Ensure that individuals are clearly informed about the processing of their personal data and that consent, where required, is properly obtained and can be withdrawn.

Third, review vendors: Identify Data Processors and put appropriate contractual protections in place.

Fourth, establish rights and grievance processes: Identify the responsible person, contact point and internal workflow for handling Data Principal requests.

Fifth, prepare for breaches: Create a practical incident-response plan and establish clear internal escalation and notification responsibilities.

Sixth, implement proportionate security and retention controls: Focus on access management, appropriate technical safeguards, logging, backups, retention and deletion.

Only after these fundamentals are in place should a smaller business consider whether it needs more sophisticated privacy-management software, external audits or a larger compliance programme.

MSME classification should not be treated as a substitute for this assessment. Under the revised Udyam classification applicable from 1 April 2025, a micro enterprise is one with investment of up to ₹2.5 crore and turnover of up to ₹10 crore, while a small enterprise has investment of up to ₹25 crore and turnover of up to ₹100 crore. These thresholds are relevant for MSME classification but do not, by themselves, create a corresponding exemption from the DPDP Act.

Particular care is warranted where the business processes children’s personal data or other data that may create heightened legal or operational risks. The DPDP Act imposes additional obligations concerning children’s data, including requirements relating to verifiable parental consent and restrictions on certain forms of processing.

Businesses should also review their international data flows. Section 16 of the DPDP Act empowers the Central Government to restrict the transfer of personal data by a Data Fiduciary to specified countries or territories outside India. Accordingly, businesses using overseas cloud infrastructure, software platforms or other processors should monitor applicable notifications and contractual requirements rather than assuming that cross-border processing is either universally prohibited or universally unrestricted.

Conclusion

The DPDP Act does not require a ten-person startup to build the same compliance infrastructure as a bank or a large technology company. It does require businesses within its scope to take personal data protection seriously: to understand what personal data they hold, communicate transparently about its use, obtain consent where required, maintain appropriate safeguards, manage their vendors, respect applicable Data Principal rights and respond effectively when something goes wrong.

For startups and MSMEs, the most effective approach is therefore not to pursue “perfect” compliance from day one. It is to establish a minimum viable DPDP compliance framework that addresses the highest-risk areas first and can scale as the business grows.

A data inventory, clear privacy notice, workable consent and grievance mechanisms, appropriate Data Processor contracts, proportionate security safeguards, a breach response plan and a disciplined approach to retention can provide a practical foundation without imposing an unnecessarily heavy compliance burden. The businesses that begin this process early will have the advantage of treating DPDP compliance as a gradual operational improvement rather than an expensive regulatory scramble in the months immediately before May 2027.