The DPDP Act for small businesses: what must be in place by May 2027
India's data protection law has no small-business exemption. The DPDP Rules 2025, notified on 13 November 2025, give every business that holds customer or staff data digitally until May 2027 to put a standalone notice, security safeguards, breach reporting and a grievance process in place. The maximum penalty for failing to take reasonable security safeguards is ₹250 crore.
Personal data in a small business sits in ordinary places: the customer list on a WhatsApp Business account, or the appointment register a clinic types into a laptop each evening. Section 3 of the Digital Personal Data Protection Act 2023 covers both, including records first made on paper and digitised later.
The Act has no exemption for small businesses, and the penalty ceilings in its Schedule, up to ₹250 crore, are the same for a ten-person firm as for a bank. The Digital Personal Data Protection Rules 2025 were notified on 13 November 2025 with an 18-month runway, about six and a half months of which remain.
When do the DPDP Act and Rules come into force?
The Act and Rules come into force in three stages from 13 November 2025, when the Ministry of Electronics and Information Technology (MeitY) issued the commencement notification, G.S.R. 843(E), and the Rules, G.S.R. 846(E). The provisions on the Data Protection Board of India took effect that day, those on consent managers follow a year later, and the obligations that matter to an ordinary business apply after 18 months, in May 2027.
| Stage | Date | What comes into force | Status, October 2026 |
|---|---|---|---|
| Immediate | 13 November 2025 | Sections 1(2), 2, 18 to 26, 35, 38 to 43, 44(1) and 44(3); Rules 1, 2 and 17 to 21 | In force; no Board members appointed |
| One year | 13 November 2026 (12 November on some counts) | Sections 6(9) and 27(1)(d); Rule 4, on consent managers | Pending |
| Eighteen months | 13 May 2027 (12 May on some counts) | Sections 3 to 17 (except 6(9)), 27 to 34 (except 27(1)(d)), 36, 37 and 44(2); Rules 3, 5 to 16, 22 and 23 | Pending |
SCC Online and S.S. Rana & Co read the later dates as the 13th, AZB & Partners and Acuity Law as the 12th; a business ready by 12 May 2027 is safe on either reading.
On 22 January 2026 Business Standard reported, citing unnamed sources, that MeitY had proposed cutting the 18 months to 12 for certain provisions applying to significant data fiduciaries, a category it said would cover large technology and social media firms and most large financial institutions. It said the ministry had also proposed making the one-year retention of data and logs operational within 90 days of amended rules. MeitY did not reply. The paper quoted IT Minister Ashwini Vaishnaw as saying in November 2025, "We are in touch with the industry to further compress time required for compliance."
As of October 2026 we have found no notification giving effect to the report, and the Removal of Difficulties Order of 5 October 2026 (S.O. 5458(E)) made two wording corrections, to Sections 9(1) and 10(2)(c)(ii), and moved no date.
Does the DPDP Act apply to small businesses?
Yes, from May 2027. Section 3 applies the Act to digital personal data processed in India, whether collected in digital form or in non-digital form and digitised later, and to processing outside India connected with offering goods or services to people in India. It sets no turnover or headcount threshold.
The business that decides the purpose and means of processing is the data fiduciary, the person the data is about is the data principal, and a vendor processing it on the business's behalf is a data processor. Section 3(c) excludes an individual's personal or domestic processing and data made public by the person or by someone legally obliged to publish it, so a shopkeeper's personal phonebook is outside the Act and the same numbers in the shop's billing software are inside it.
Section 17(3) allows the government, "having regard to the volume and nature of personal data processed", to exempt notified classes, "including startups", from Section 5, Sections 8(3) and 8(7), and Sections 10 and 11. It had issued no such notification as of October 2026, and King, Stubb & Kasiva wrote in September 2026 that the provision "should not be treated as a blanket exemption" and that MSME status gives none.
Significant data fiduciaries, notified under Section 10 on factors such as the volume and sensitivity of their data, must appoint a data protection officer based in India and an independent data auditor. Rule 13 adds an impact assessment and audit once in every twelve months. Personal data may be sent to another country unless the government restricts transfers there under Section 16, subject to Rule 15. As of October 2026 no significant data fiduciary had been notified and no country restricted.
What does the DPDP Act require of a ten-person business?
From May 2027 it needs a lawful ground for each use of personal data, a standalone notice, security safeguards, contracts with its processors, a breach procedure, erasure when the purpose ends, a published contact and grievance process, and verifiable parental consent for children's data.
Consent or a legitimate use
Section 4 permits processing only with consent or for a legitimate use under Section 7. Consent must be "free, specific, informed, unconditional and unambiguous with a clear affirmative action" (Section 6(1)), a standard a pre-ticked box will struggle to meet, and once it is withdrawn the business and its processors must stop within a reasonable time (Section 6(6)). Section 7(a) covers data a person volunteers for a specified purpose, such as a phone number given for delivery updates, unless she has told the business she objects. Section 7(i) covers processing "for the purposes of employment", which in our reading includes payroll. Sending offers to an old customer list is a different purpose, and in our view it needs consent. For consent obtained before May 2027, Section 5(2) requires a notice "as soon as it is reasonably practicable".
A standalone notice
Section 5 requires a notice of the data and purpose and of the person's rights, in English or any language in the Eighth Schedule to the Constitution. Under Rule 3 it must "be presented and be understandable independently of any other information", which a clause buried in the terms and conditions will not satisfy. The minimum content is "an itemised description of such personal data" and the purpose, with a specific description of the goods, services or uses involved. The notice must also link to where the person can withdraw consent as easily as she gave it, exercise her rights and complain to the Board.
Reasonable security safeguards
Rule 6(1) sets the minimum for the safeguards Section 8(5) requires: encryption, obfuscation, masking or virtual tokens; access control; logs, monitoring and review; and backups and other measures for continued processing. It also lists one-year retention of logs and personal data (unless another law requires otherwise), provisions in processor contracts, and technical and organisational measures. S.S. Rana & Co noted in November 2025 that the Rules list these instead of requiring ISO standards, "favouring small organizations and startups with limited resources". In a ten-person office that means encrypted laptops and phones, individual logins, logging switched on, and a backup someone has restored.
Contracts with data processors
Section 8(1) keeps the business responsible when a processor does the work, and Section 8(2) allows a processor "only under a valid contract". Every vendor handling personal data for the business, such as a payroll provider or a marketing agency, needs one.
Erasure and retention
Section 8(7) requires erasure, by the business and its processors, once consent is withdrawn or the purpose is no longer served, unless a law requires retention, and Section 12(3) lets the person ask for it. Rule 8(3) sets a floor for the purposes in the Seventh Schedule: personal data, associated traffic data and processing logs must be kept for at least one year from the date of processing. The three-year inactivity rule in Rule 8 and the Third Schedule applies only to e-commerce entities and social media intermediaries with at least 2 crore registered users in India and online gaming intermediaries with at least 50 lakh. We advise a written retention schedule giving a period and a reason for each category of data.
A named contact and a grievance process
Section 8(9) and Rule 9 require the business to publish prominently on its website or app the contact details of its data protection officer, if it has one, or of a person who can answer questions about its processing. It must repeat them in every response to a rights request. The grievance mechanism required by Section 8(10) and Rule 14(3) must have a published response period of not more than 90 days, and a person must use it before going to the Board (Section 13(3)). Sections 11 to 14 add rights to a summary of the data held, correction and erasure, grievance redressal and nomination.
Children and persons with disability
Section 9 requires verifiable consent from a parent or lawful guardian before processing the personal data of anyone under 18, and bars "tracking or behavioural monitoring of children or targeted advertising directed at children". Under Rule 10 the business must check that the parent is an identifiable adult, using details it holds, details provided voluntarily or a virtual token from an authorised entity. Rule 11 requires a check that the lawful guardian of a person with disability was appointed by a court, a designated authority or a local level committee. The Fourth Schedule, read with Rule 12, lifts the consent and tracking limits for clinics and healthcare professionals treating a child, educational institutions tracking pupils for education or safety, crèches, and the transport they engage. In our reading a coaching class that targets advertisements at students under 18 gets no such relief.
How quickly must a data breach be reported under the DPDP Rules?
From May 2027, Rule 7 requires the business to tell each affected person and the Board "without delay", and to send the Board a detailed report "within seventy-two hours of becoming aware of the breach, or within such longer period as the Board may allow". A 2022 direction of CERT-In, the Indian Computer Emergency Response Team, already requires listed cyber incidents to be reported to it within six hours.
Rule 7 has no size threshold, and Section 2(u) counts accidental disclosure or loss of access as a breach, so a lost laptop holding customer records can qualify. Each person must be told what happened, the likely consequences, the mitigation under way, what she can do and whom to contact; the 72-hour report adds causes and remedial steps.
SITA told Air India on 25 February 2021 of an attack on SITA's passenger service system, TechCrunch reported; the breach, which Air India disclosed in May 2021, covered about 45 lakh passengers' records, including passport and credit card data. Inc42 reported in April 2024 that a hacker using the name ShopifyGUY claimed to hold data on more than 75 lakh boAt customers; boAt said it had launched an investigation. In September 2024 a hacker using the name xenZen claimed to hold data on over 3.1 crore Star Health customers, a claim Reuters could not verify. The insurer said there was "no widespread compromise"; MediaNama reported on 10 October 2024 that Star Health had since confirmed the breach.
The CERT-In direction of 28 April 2022, issued under Section 70B(6) of the Information Technology Act, covers body corporates among others. Besides the six-hour report it requires system logs to be kept for a rolling 180 days within Indian jurisdiction, though its FAQs allow storage abroad if the logs can be produced in reasonable time. Non-compliance is punishable under Section 70B(7) with imprisonment of up to a year, a fine of up to ₹1 lakh, or both.
Section 44(2) of the DPDP Act omits Section 43A of the IT Act, on compensation for failing to protect sensitive personal data, and leaves Section 70B untouched. Until May 2027 Section 43A and the 2011 rules made under it still apply, and in our reading CERT-In's direction continues after that alongside Rule 7. Logs kept for a year satisfy both CERT-In's 180 days and Rule 6(1)(e)'s one year.
What are the penalties under the DPDP Act?
The Schedule to the Act sets maximum penalties from ₹10,000 to ₹250 crore, and from May 2027 the Board decides the actual amount under Section 33 after an inquiry.
| Breach | Provision | Maximum penalty |
|---|---|---|
| Failure to take reasonable security safeguards | Section 8(5) | ₹250 crore |
| Failure to notify the Board or affected persons of a breach | Section 8(6) | ₹200 crore |
| Breach of the additional obligations for children | Section 9 | ₹200 crore |
| Breach of a significant data fiduciary's additional obligations | Section 10 | ₹150 crore |
| Breach of a voluntary undertaking accepted by the Board | Section 32 | Up to the amount for the original breach |
| Any other breach of the Act or the Rules | Schedule, item 7 | ₹50 crore |
| Breach of a data principal's duties | Section 15 | ₹10,000 |
Section 33(1) allows a penalty only if the Board finds the breach "significant", and only after "an opportunity of being heard". Section 33(2) makes it weigh factors including "the nature, gravity and duration of the breach", the timeliness and effectiveness of mitigation, and the likely impact of the penalty on the person.
Who enforces the DPDP Act, and what happens after a complaint?
The Data Protection Board of India enforces the Act, and from May 2027 a person can complain to the Board once she has used the business's own grievance process. The Board was established on 13 November 2025, but as of October 2026 it had no appointed chairperson or members.
MeitY invited applications on 6 May 2026 for a chairperson and four members. LiveLaw reported on 1 August 2026: "Yet as of this month, the Board has no appointed Chairperson and no appointed Members." On 12 August 2026 Jitin Prasada, Minister of State for Electronics and IT, told the Lok Sabha that a search-cum-selection committee would fill the posts, and named no appointee; we have found no appointment announced since.
From May 2027 the Board can direct urgent remedial steps after a breach and inquire into complaints; Rule 19 gives it six months to finish an inquiry, extendable by up to three months at a time. It can also refer the parties to mediation (Section 31), accept a voluntary undertaking (Section 32) or impose a penalty. Appeals go to the Telecom Disputes Settlement and Appellate Tribunal within 60 days (Section 29), filed digitally (Rule 22).
What is a consent manager, and does a small business need to become one?
A consent manager is a company registered with the Board that acts as "a single point of contact" (Section 2(g)) for a person's consents, and a small business has no obligation to become one. Under Rule 4 and the First Schedule, which apply from November 2026, an applicant must be an Indian company with a net worth of at least ₹2 crore. None had been registered as of October 2026.
What should a small business do between now and May 2027?
Start with a data inventory and requests to vendors, which depend on other people's answers, and finish with a rehearsed breach plan.
| Month | Work | Provisions |
|---|---|---|
| November 2026 | Map where personal data sits (WhatsApp, spreadsheets, software, email, staff files), who can open it and which vendors hold copies; ask vendors for their processing terms; switch on logging | Sections 3, 8(1), 8(2); CERT-In direction |
| December 2026 | Record the lawful ground for each use; flag children's data; delete what has no purpose or legal reason to be kept | Sections 4, 6, 7, 9 |
| January 2027 | Write the notice and the consent and withdrawal flows, in English and your customers' Eighth Schedule languages | Section 5; Rule 3 |
| February 2027 | Encryption, access by role, logs kept for a year, tested backups | Section 8(5); Rule 6 |
| March 2027 | A valid contract with every processor; a written retention schedule | Sections 8(2), 8(7); Rule 8(3) |
| April 2027 | Publish the contact person and grievance response period; rehearse the six-hour CERT-In and 72-hour Board reports | Sections 8(6), 8(9), 8(10); Rules 7, 9, 14 |
| May 2027 | Send the notice to existing customers; be ready by 12 May | Section 5(2) |
One named person should own the inventory and run the breach plan; a data protection officer is required only of a significant data fiduciary, under Section 10.
Frequently asked questions
When does the DPDP Act come into force for businesses?
The main obligations apply 18 months after the commencement notification and Rules of 13 November 2025: 13 May 2027 by SCC Online's count and 12 May 2027 by AZB & Partners', so we advise being ready by 12 May. Consent manager provisions start in November 2026, and as of October 2026 we had found no notification changing either date.
Is there a DPDP exemption for startups or small businesses?
No exemption exists for size, turnover or MSME status. Section 17(3) lets the Central Government exempt notified classes, including recognised startups, from Sections 5, 8(3), 8(7), 10 and 11, but it had issued no such notification as of October 2026, and the security duty in Section 8(5) is outside that list.
What is the penalty for a data breach under the DPDP Act?
The maximum is ₹250 crore for failing to take reasonable security safeguards (Section 8(5)) and ₹200 crore for failing to notify the Board or affected people (Section 8(6)). From May 2027, under Section 33, the Board can impose a penalty only for a significant breach and after a hearing, weighing its gravity, the mitigation and the penalty's likely impact.
How many hours do you have to report a data breach in India?
From May 2027, under Rule 7 of the DPDP Rules 2025, the Board and each affected person must be told without delay and the Board must get a detailed report within 72 hours of the business becoming aware of the breach. CERT-In's 2022 direction already requires listed cyber incidents to be reported within six hours.
Does a small business need a data protection officer under the DPDP Act?
No. Only a significant data fiduciary must appoint one, based in India, under Section 10, and none had been notified as of October 2026. From May 2027 every business must publish, and repeat in each reply to a rights request, the contact details of a person who can answer questions about its processing (Section 8(9) and Rule 9).
What must a DPDP consent notice contain?
From May 2027, Section 5 and Rule 3 require the notice to be understandable on its own, in clear and plain language, in English or an Eighth Schedule language. It needs an itemised description of the personal data, the purpose and a specific description of the goods, services or uses, and a link to withdraw consent as easily as it was given, exercise rights and complain to the Board.
Sources
Digital Personal Data Protection Act 2023, Sections 2 to 17, 27 to 33 and 44 and the Schedule; MeitY notifications G.S.R. 843(E) (commencement) and G.S.R. 846(E) (Digital Personal Data Protection Rules 2025), both of 13 November 2025; Digital Personal Data Protection (Removal of Difficulties) Order 2026, S.O. 5458(E) of 5 October 2026; MeitY circular of 6 May 2026 on Board appointments; Lok Sabha Unstarred Question No. 3960, 12 August 2026; CERT-In direction of 28 April 2022 under Section 70B(6) of the Information Technology Act; Business Standard, 22 January 2026; LiveLaw, 1 August 2026; notes by AZB & Partners, S.S. Rana & Co (Bar and Bench), Cyril Amarchand Mangaldas and Acuity Law (all November 2025), King, Stubb & Kasiva (Legal 500, 22 September 2026), Nishith Desai Associates (25 May 2022) and Khaitan & Co; SCC Online (14 November 2025 and 15 October 2026); TechCrunch, 23 May 2021, on Air India; Inc42, 9 April 2024, on boAt; Reuters (September 2024) and MediaNama (10 October 2024) on Star Health.