Vakil Help Desk News: smaller businesses and startups — including those building AI products — must comply with the DPDP Act too. We set out a practical, affordable way to get started without a large compliance team.
Vakil Help Desk News, DPDP & Data Privacy. The DPDP Act, 2023 applies to businesses of every size that handle personal data of individuals in India — not just large platforms. For startups and SMEs, including those building AI and data-driven products, the key is to start simple and build up.
Where smaller businesses struggle
Limited budgets, no dedicated privacy team, data spread across many tools, and AI models trained on personal data all make compliance feel daunting. But most of the early work is organisational, not expensive technology.
A practical starting plan
- Map your data: list what personal data you collect, why, where it is stored and who it is shared with.
- Fix your notices and consent: tell people clearly what you collect and why, and obtain consent where that is your basis for processing.
- Tighten access and security: limit who can see personal data and apply reasonable safeguards.
- Sort out vendors: put data-processing terms in place with the tools and partners that handle data for you.
- Mind your AI: know what personal data trains or feeds your models, and apply data minimisation and purpose limits.
- Plan for requests and breaches: a simple process to handle access/deletion requests and to report a breach.
Why act now
Doing this early is far cheaper than retro-fitting it under pressure, and strong data practices are increasingly a selling point with customers and investors.
What this means for you
Start small and early: map your data, fix notices and consent, tighten security, paper your vendors, and know your AI data flows — most of this needs process discipline, not a big budget. Clean data practices also build customer and investor trust. We offer startups and SMEs a right-sized DPDP starter package and ongoing support.