The DPDP Act, quietly — what a small Indian startup actually has to do
The rules landed. Most of the coverage is for enterprises. Here's the checklist for a twenty-person company that collects user data.
The Digital Personal Data Protection Act, 2023 finally has teeth, and the DPDP Rules followed in late 2025. For Indian founders with between ten and a hundred employees, most of the legal commentary feels aimed at enterprises. This piece is for you.
Do you fall within scope?
If you process personal data of users in India, yes. That's almost every consumer-facing app and a sizeable chunk of B2B SaaS. The question isn't scope. The question is how proportionate your compliance can be.
The minimum you should have by next quarter
- A privacy notice that reads like a human wrote it, not a 2012 template.
- A consent mechanism that actually captures, logs, and timestamps the consent.
- A named Data Protection Officer (can be a co-founder for smaller teams) and a published grievance mechanism.
- A data-processing register — what you collect, why, where it sits, who touches it.
- A breach-response runbook — who decides, who calls, within what hours.
The consent trap
Section 6 requires consent to be 'free, specific, informed, unconditional, and unambiguous.' Most Indian founders ship a long privacy policy and a click-through. That survived pre-DPDP. It will not survive a Data Protection Board enquiry. You need a layered consent — an initial notice at a specific moment, with the granular consents captured at the moment they are relevant.
Third-party processors
Every data-processor relationship (analytics, email, CRM, cloud) must now sit under a written processing agreement that meets the Rules' content requirements. Your vendor contracts almost certainly do not. This is where a three-hour clean-up pays for itself.
The penalty exposure
The financial penalties range up to ₹250 crore for the most serious contraventions. For a small company the realistic range is lower — but the Board has already issued public notices, and reputation hit in diligence is the bigger cost for a Series A-stage company.
Treat DPDP the way you treated GST in 2017. It's boring, it's important, and the founders who handle it early look institutional at diligence.