Does the DPDP Act Apply to My Small Business? (2026 Guide)

Who does the DPDP Act apply to?

The Act applies to the processing of digital personal data within India, whether the data was collected digitally or collected on paper and digitised later. It also reaches processing outside India where it is connected with offering goods or services to people in India. The business that decides why and how data is processed is the Data Fiduciary, and it carries the obligations.

Size is not part of the test. A two-person consultancy that keeps client details in Google Workspace is a Data Fiduciary just as a listed company is. What changes with size is how much work compliance takes, not whether the Act applies.

Purely personal or domestic use is outside the Act, as is personal data that the individual has made publicly available, or that someone is legally required to publish. These exclusions rarely help a trading business, because customer, employee and lead data is collected for business purposes.

What counts as personal data for a small business?

Personal data is any data about an individual who can be identified from it or with other information. For a small business that usually means customer names, phone numbers and addresses, WhatsApp chats, email lists, website enquiries, employee and payroll records, KYC copies, CCTV footage of identifiable people, and contact details of individual suppliers.

Data about a company is not personal data in itself, but the names, phone numbers and emails of the people you deal with at that company are. A B2B business therefore still holds personal data, even if every customer is a company.

A practical test: if losing the file or spreadsheet would let someone contact, identify or embarrass a real person, treat it as personal data and include it in your data map.

Is there any exemption for MSMEs or startups?

There is no exemption for MSMEs. Udyam registration, turnover below a threshold or a small headcount does not take a business outside the Act.

Section 17(3) allows the Central Government, having regard to the volume and nature of personal data processed, to notify certain Data Fiduciaries, including startups, to whom section 5 (notice), section 8(3) and 8(7) (accuracy and erasure), section 10 (Significant Data Fiduciary duties) and section 11 (right to access information) will not apply. As at November 2026 no such notification has been issued.

Even if a startup is notified in future, consent, reasonable security safeguards, breach intimation, grievance redressal and the rules for children’s data would still apply. Planning on the basis of an exemption that may never come is a risk most founders should not take.

What changes if my business is small?

The Act places extra duties only on Significant Data Fiduciaries, which the Government notifies under section 10 based on factors such as the volume and sensitivity of data and risk to individuals. Those duties include a Data Protection Officer based in India, an independent data auditor and periodic impact assessments. Most MSMEs will not be notified.

A small business still needs the core set: a clear notice, valid consent where consent is the basis, reasonable security safeguards, a breach plan, contracts with vendors that process data, erasure when the purpose ends and a contact for data questions.

The proportionate route is to size each control to your systems. A business with one website, Tally and a payroll app needs a short notice, a handful of vendor terms and a one-page breach plan, not an enterprise privacy programme.

When do the obligations start?

The DPDP Rules, 2025 were notified in November 2025 with a phased timeline. Provisions on the Data Protection Board took effect at once, the consent manager framework follows twelve months later, and the core duties on notice, consent, security, breach intimation, children’s data and individual rights apply eighteen months after notification, from 13 May 2027.

In January 2026 MeitY consulted on shortening the eighteen-month window for some duties. As at November 2026 no amendment had been notified, so 13 May 2027 remains the working date; check for changes before you finalise a plan.

Data mapping and vendor reviews usually take longest, so a small business that starts in late 2026 has comfortable time. One that starts in April 2027 does not.

Quick test: does the Act apply to you?