DPDP Act for small businesses: what to do before 2027
The short answer
If your website or app collects personal data from people in India, even a name and phone number in an enquiry form, the DPDP Act applies to you. It sets no minimum size. Most of its duties start on 13 May 2027: a plain notice before you ask for consent, an easy way to withdraw it, security safeguards with a year of logs, breach reports, a published contact and grievances answered within 90 days. Start by listing what personal data you collect and where it goes.
- For
- Owners of a website or app that collects personal data from people in India
- You leave with
- The dates, what the law asks of your site, and a to-do list in order
- Time
- 6 min read
On this page
India's Digital Personal Data Protection Act, 2023 (the DPDP Act) and its Rules decide how a business may collect and use personal data. This post covers what they ask of an ordinary business website or app, in the order we would tackle it. We checked every point against the Act and the Rules on MeitY's site on 27 October 2026. It is not legal advice; ask a lawyer how it applies to you.
The dates that matter
The Act and the Rules were both notified on 13 November 2025. They start in three steps: a few parts at once, consent managers after one year, and almost everything else after eighteen months (G.S.R. 843(E) for the Act, Rule 1 for the Rules).
| Date | What starts |
|---|---|
| 13 November 2025 | The Data Protection Board and how it works |
| 13 November 2026 | The rules for registering consent managers (section 6(9), Rule 4) |
| 13 May 2027 | Almost everything a business does: notice, security, breach reports, retention, children's data and people's rights (most of the Act, and Rules 3 and 5 to 16) |
These are the dates as notified. Check MeitY's site before you plan around them, in case the government changes them.
Does it apply to you?
- It covers digital personal data. Data collected online, or collected on paper and typed in later (section 3). An enquiry form, a WhatsApp list, a customer spreadsheet and an app's user table all count.
- Size does not matter. There is no minimum turnover or number of users. The government can exempt some businesses from a few duties, but only by notification (section 17(3)).
- You are responsible for your suppliers. In the Act's words you are the Data Fiduciary: you decide why and how the data is used. Your developer, host, CRM and email tool are Data Processors working for you. You stay responsible for what they do with it (section 8(1)), and you need a valid contract with each one (section 8(2)).
What the law asks of your website or app
| Duty | What it means in practice | Where it is |
|---|---|---|
| A notice | Before you ask for consent, show a plain notice that stands on its own: an itemised list of the personal data and what each piece is for | Rule 3, section 5 |
| Real consent | Consent is a clear action by the person, for a specific purpose, limited to the data that purpose needs | Section 6(1) |
| Easy withdrawal | Withdrawing consent must be as easy as giving it. Link to it from the notice | Section 6(4), Rule 3 |
| People's rights | Publish how people ask to see, correct or erase their data, and what you need to identify them | Rule 14(1) |
| Grievances | Publish how long you take to answer a grievance. It cannot be more than 90 days | Rule 14(3) |
| A contact | Publish the business contact of a person who can answer questions about the data | Rule 9 |
| Security | Encryption or masking, access control, logs and monitoring, backups, and security terms in your contracts with processors | Rule 6 |
| Logs kept a year | Keep the personal data, traffic data and logs of processing for at least one year, then erase them unless another law needs them | Rule 8(3) |
| Erasure | Erase data once its purpose is served or consent is withdrawn, unless a law needs you to keep it | Section 8(7) |
| Breaches | Tell each affected person without delay, and the Board without delay, with a detailed report within 72 hours | Rule 7 |
| Children | Anyone under 18 is a child. Get verifiable consent from a parent before you process a child's data. Some kinds of business and some purposes are exempt, so check whether yours is | Section 2(f), section 9, Rules 10 and 12 |
Large platforms carry more. E-commerce and social media platforms with at least two crore registered users in India, and online gaming platforms with at least fifty lakh, must erase inactive users' data after three years and warn them 48 hours before (Rule 8 and the Third Schedule).
A to-do list, in order
- Map your personal data. Every form, sign-up, checkout, chat, spreadsheet and tool: what you collect, why, where it is stored, who can see it and which suppliers touch it.
- Drop what you do not need. Every field you remove is one less thing to protect, explain and erase.
- Write the notice for each purpose, in plain words, and show it where you ask for consent.
- Build consent and withdrawal into the product, so a person can say yes and later change their mind in the same number of steps.
- Set up requests and grievances: a form, a person who owns it, and a published response time of 90 days or less.
- Tighten security: who can log in to what, encryption, backups you have restored at least once, and logs you keep for a year.
- Update supplier contracts so each processor commits to security safeguards and erases data when asked.
- Write a breach runbook: who decides it is a breach, who writes to the people affected, who reports to the Board, and how you meet 72 hours.
- Check for children. If people under 18 may use your service, plan how a parent gives verifiable consent.
- Decide how long each kind of data stays, and erase it on schedule.
Most of this is product work, not paperwork. The notice, the consent switch, the request form and the logs live in your website or app, so plan them with whoever builds and runs it.
How we can help
- A readiness check maps your personal data and ranks the gaps by risk, from ₹15,000 and credited if you go ahead. Essentials (consent, privacy notice, request form, retention rules, breach runbook) starts from ₹45,000. Starting prices, exclusive of taxes, confirmed in a written quote. DPDP compliance.
- For The Healing Pouch we built a consent registry, data export and erasure requests into the product.
- Hardening and monitoring for your site, apps and servers, so the security safeguards are more than a policy. Cybersecurity.
Questions people ask
Does the DPDP Act apply to a small business?
Yes, if you process digital personal data in India. The Act sets no size threshold. It does let the government exempt some businesses or classes of business, including recognised startups, from a few duties, but only by a notification (section 17(3)). Unless one covers you, plan to comply.
Do I need a Data Protection Officer?
Only a Significant Data Fiduciary, a business the government names for the volume or sensitivity of its data, must appoint one (section 10). Everyone else must publish the business contact details of a person who can answer questions about how personal data is used (Rule 9).
What is a consent manager?
A company registered with the Data Protection Board that gives people one place to give, review and withdraw their consent (section 2(g)). The rule on registering consent managers starts on 13 November 2026 (Rule 4). Your own consent and withdrawal flows are still yours to build.
What are the penalties?
The Schedule to the Act sets maximums: up to ₹250 crore for failing to take reasonable security safeguards, and up to ₹200 crore each for failing to report a breach or for breaking the rules on children's data. The Data Protection Board decides the amount in each case.
Does Round Robin give legal advice?
No. We build what the law asks into your website or app and draft documents for your lawyer to review. We do not certify compliance.
Sources
- MeitY: The Digital Personal Data Protection Act, 2023 (Act 22 of 2023)Checked 27 October 2026
- MeitY: Commencement of the DPDP Act (G.S.R. 843(E), 13 November 2025)Checked 27 October 2026
- MeitY: Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E), 13 November 2025)Checked 27 October 2026
Other companies change their prices and fees. Check the source before you rely on a figure.
Read next
Know where you stand before May 2027
Tell us what you run and what personal data it holds. We reply within one working day.