DPDP Act compliance for small businesses — sized for MSMEs, done online
The Digital Personal Data Protection Act, 2023 applies to every business in India that handles digital personal data: customer phone numbers, WhatsApp lists, employee payroll records and website leads. There is no MSME, turnover or headcount exemption, and most duties apply from 13 May 2027. SME Advisory runs DPDP readiness for small businesses online, alongside the GST, TDS and ROC calendar we already manage.
Reviewed by Regi Tom Antony, FCA, CISA (ISACA) · Law as at 2 November 2026
- DPDP Rules notified
- Nov 2025
- Consent manager phase
- 13 Nov 2026
- Core duties for every business
- 13 May 2027
- MSME or turnover exemption
- None
The 30-second applicability test
Answer five questions. One “yes” is enough: the Act applies to your business, whatever its size.
Answer the five questions
Your result appears here as you answer.
Full 15-question readiness checkWhat a small business must do — and what it can usually skip
Must do — every business
- A clear privacy notice before or when you collect data (s.5; Rule 3)
- Specific consent for marketing, separate from billing or delivery (s.6)
- Reasonable security safeguards: access control, encryption, logs, backups (s.8(5); Rule 6)
- Breach intimation to affected people and the Data Protection Board (s.8(6); Rule 7)
- Written contracts with vendors that process data for you (s.8(2))
- Erasure once the purpose ends, subject to legal retention (s.8(7))
- A published contact for data questions, and a way to handle rights requests (ss.8(9), 11–13)
- Verifiable parental consent for children’s data (s.9; Rule 10)
Usually not needed — unless notified as a Significant Data Fiduciary
- A Data Protection Officer based in India (s.10)
- An independent annual data audit (s.10)
- Periodic Data Protection Impact Assessments (s.10)
- Additional algorithmic and cross-border duties for SDFs (Rule 13)
Most MSMEs will not be notified as Significant Data Fiduciaries. Knowing what you can skip is where most of the cost saving lies.
Five everyday risks, and the fix for each
WhatsApp and SMS marketing
Numbers collected for billing are used for offers.
Fix: separate marketing consent, re-consent old lists, log opt-outs.
Read the guide →Employee data and CCTV
Payroll, KYC, PF/ESI and footage sit in open folders.
Fix: employee notice, access rules, CCTV signage and retention.
Read the guide →Vendors and apps
Tally, Zoho, payroll apps and CRMs with no data terms.
Fix: a vendor list and processor terms for each.
Read the guide →Big-customer questionnaires
Large buyers add DPDP clauses to vendor onboarding.
Fix: evidence-backed answers and a processor-side agreement.
Read the guide →Your own website
Contact forms, cookies and pixels with no notice.
Fix: form notices, consent wording and a cookie review.
Four engagement levels, each with a defined scope
Start with a Health Check, then move to the level your business needs. Scope, deliverables, timelines and fee are confirmed in a written engagement letter.
DPDP Health Check
Any business that wants to know where it stands.
- Online data interview
- Website and forms scan
- Data-flow sketch
- Gap report with a prioritised fix list
- Read-out call
DPDP Essentials
Up to about 50 staff, one website or app, a handful of systems.
- Data map and privacy notice
- Consent wording for forms, WhatsApp and email
- Employee and CCTV notices
- Vendor terms for your key apps
- Retention schedule aligned to GST, income-tax and ROC
- One-page breach plan and staff briefing
DPDP Complete
50–250 staff, several systems or branches.
- Everything in Essentials
- Wider vendor contract review
- Marketing database clean-up and re-consent plan
- Rights-request workflow
- CISA-led access and backup review
- Breach drill and board note
DPDP Care
For businesses after setup.
- Quarterly review on your compliance calendar
- New-vendor checks
- Rights requests and complaints
- Updates when MeitY or the Board issues changes
- Annual refresher for staff
How it works, anywhere in India
- Step 1
Scoping call
We understand your data, systems and customers, and agree scope in writing.
- Step 2
Data interview
A structured video session maps what you collect, where it sits and who sees it.
- Step 3
We draft, you approve
Notices, consent wording, vendor terms, retention schedule and breach plan.
- Step 4
Go live and stay current
Team briefing, then reviews on the same calendar as your GST, TDS and ROC.
Documents are exchanged through a secure portal, not WhatsApp or open email.
What DPDP looks like in your sector
Retail and showrooms
Billing numbers, loyalty lists, WhatsApp offers, CCTV.
Clinics, labs and pharmacies
Patient records, reports on WhatsApp, prescriptions.
Coaching centres and schools
Children’s data needs verifiable parental consent.
Real estate brokers and builders
Buyer KYC, NRI clients, bought lead lists.
D2C and online sellers
Checkout data, pixels, marketplaces and courier partners.
IT and services firms
Often a processor for clients: contracts and questionnaires.
Your compliance team already knows your business
- DPDP sits in the same calendar as your GST, TDS and ROC, with one owner and one reminder system.
- Retention rules come from tax and company law, so erasure never collides with a statutory record.
- A CISA-qualified reviewer checks access, backups and logs, not just the paperwork.
- One written engagement letter. Delivered online across India.
Mid-size firms, hospitals, NBFCs, edtech platforms and CA practices that need independent assurance can work with our CA firm, Regi Tom Antony & Associates.
Independent CISA-led DPDP review →CA and tax practitioners can also refer SME clients through our partner programme.
Maximum penalties under the Schedule
| Breach | Maximum penalty |
|---|---|
| Failure to take reasonable security safeguards | Up to ₹250 crore |
| Failure to notify a personal data breach | Up to ₹200 crore |
| Breach of obligations for children’s data | Up to ₹200 crore |
| Any other breach by a Data Fiduciary | Up to ₹50 crore |
These are ceilings, not tariffs. Under section 33(2) the Board weighs the nature, gravity and duration of the breach, what was done to mitigate it and whether the penalty is proportionate. Documented, reasonable steps are the best protection a small business has.
Plain-English guides for small businesses
The no-exemption explainer, the startup relief in section 17(3), and a 30-second test.
A sequenced plan a small business can run with its CA.
Data fiduciary vs data processor, and how a supplier answers.
What is allowed, what is not, and how to re-consent a list.
The employment legitimate use, security, CCTV and HR record retention.
Processor terms for Tally, Zoho, payroll, CRM and other apps.
Rule 7 intimation, the Board report and the CERT-In six-hour rule.
The real cost drivers, and what most MSMEs can skip.
Why no official certificate exists, and the evidence to keep instead.
DPDP questions small businesses ask
Get the DPDP readiness checklist and a scoping call
Tell us about your business. We email the readiness checklist (PDF) straight away and reply within one business day.
Related: Managed compliance · Payroll processing · ERP & process automation · Due diligence support
Sources: India Code: Digital Personal Data Protection Act, 2023 · PIB: DPDP Rules, 2025 notified (17 November 2025)
Updated 2 November 2026 · Regi Tom Antony, FCA, MBA (Australia), ACMA (UK), CGMA (USA), CISA (USA), Regi Tom Antony & Associates, Chartered Accountants. General information, not legal advice; privacy notices and contracts are reviewed with a partner advocate where needed.