Short answer: most startups that handle customer, user or employee data must comply with the Digital Personal Data Protection Act, 2023. Under the DPDP Rules, 2025, most obligations apply from 13 May 2027. The checklist below covers what a typical startup needs, in a sensible order.
Key dates
| Date | What applies |
|---|---|
| 13 November 2025 | DPDP Rules notified; Data Protection Board provisions in force |
| 13 November 2026 | Rules on consent managers |
| 13 May 2027 | Notice and consent, security safeguards, breach reporting, retention, children's data, Significant Data Fiduciary duties, cross-border transfers |
Are startups exempt?
Not generally. The Act lets the government exempt notified classes of startups from some provisions, but there is no blanket exemption. Plan on complying unless a notification clearly covers you.
The 12-point checklist
- Map your personal data. List what personal data you collect (customers, users, leads, employees), where it comes from, where it is stored, who can access it and which vendors receive it.
- Identify the purpose of each use. Collect only what each purpose needs. This makes notices, consent and retention much simpler.
- Write a clear privacy notice. It must itemise the data and purposes, explain how to withdraw consent and exercise rights, and how to complain to the Data Protection Board — in plain language, and in English or any of the 22 Eighth Schedule languages your users need. See privacy notice drafting.
- Fix your consent flow. Consent must be free, specific, informed, unconditional and unambiguous, with a clear affirmative action — no pre-ticked boxes. Withdrawal must be as easy as giving consent.
- Check children's data. If users may be under 18, you need verifiable parental consent, and you must not track, behaviourally monitor or target ads at children, except as the Rules allow.
- Sign contracts with vendors. Cloud, CRM, payroll, analytics and marketing tools that process personal data for you need a contract with data protection terms. See data processing agreements.
- Put reasonable security safeguards in place. Encryption, access control, logging and monitoring, backups, and security terms with vendors. Failing to take reasonable safeguards carries the highest penalty — up to ₹250 crore.
- Prepare a breach response plan. You must inform the Board and affected people without delay, and send the Board a detailed report within 72 hours. CERT-In also requires many cyber incidents to be reported within 6 hours. See data breach advisory.
- Set retention periods. Delete personal data once the purpose is served or consent is withdrawn, unless another law requires you to keep it.
- Handle rights requests. Set up a simple way for people to access, correct and erase their data, nominate someone, and raise grievances — and respond on time.
- Publish a privacy contact. Show the contact details of a person who can answer questions about your data processing. A Data Protection Officer is mandatory only for Significant Data Fiduciaries — see DPO-as-a-service.
- Train the team and keep records. Short training for anyone who handles personal data, and records of consents, vendor contracts and decisions, so you can show compliance.
Penalties at a glance
| Breach | Maximum penalty |
|---|---|
| Failing to take reasonable security safeguards | ₹250 crore |
| Not notifying a breach; breaching children's data obligations | ₹200 crore |
| Breaching Significant Data Fiduciary obligations | ₹150 crore |
| Other breaches of the Act or Rules | ₹50 crore |
Where to start this month
Do the data map (point 1) and the vendor list (point 6) first — everything else builds on them. Then fix the sign-up and consent flow, because changing a live product takes the longest. Our free DPDP compliance calculator gives a quick readiness score, and a DPDP gap audit turns it into a plan.
Frequently asked questions
Does the DPDP Act apply to an early-stage startup?
Yes, if it processes digital personal data of individuals in India, including customer and employee data. There is no general size-based exemption.
When do startups have to comply?
Most obligations apply from 13 May 2027 under the DPDP Rules, 2025.
Do startups need a Data Protection Officer?
Only if notified as a Significant Data Fiduciary. Otherwise, publish the contact details of a person who can answer privacy questions.
What is the first thing a startup should do?
Map the personal data it collects and the vendors that receive it. The notice, consent, contracts and retention all follow from that map.
Can Vakil Help Desk help us comply?
Yes — from a gap audit to notices, consent flows, vendor agreements and breach planning, sized for startups. We work on economical, reasonable professional fees and share a transparent quote before starting.
