# The DPDP Act applies to your 10-person company too. Here's the small-business version If your business collects any personal data digitally — customer phone numbers, emails, addresses, employee records — the Digital Personal Data Protection Act, 2023 applies to you as a Data Fiduciary, regardless of size. The DPDP Rules were notified on 13 November 2025 with a phased schedule: core obligations (consent notices, security safeguards, breach reporting, data-principal rights) become enforceable by 13 May 2027. There is no small-business exemption from the Act itself (only certain notified startups may get relaxations from specific provisions), and penalties scale up to ₹250 crore for serious breaches. The good news: for a typical SME the actual to-do list is short and mostly procedural — and you have a runway to do it properly. > Information, not legal advice. Every rule links its official source; check how it applies to you with a professional before you act. _By Dhrumil Barot, founder of LuckPanda. Published 2026-06-11, updated 2026-06-11._ ## Does it really apply to a company my size? Yes. The Act applies to processing of digital personal data within India (and to processing outside India connected to offering goods/services to people in India), with obligations attaching to the Data Fiduciary — the entity deciding why and how data is processed. That's you, the moment you run a CRM, a lead form, a WhatsApp commerce flow or payroll software. Heavier duties (data protection officers, audits, impact assessments) attach only to Significant Data Fiduciaries, designated by notification based on volume/sensitivity — a small business is unlikely to be designated, but the base obligations apply to everyone. Certain startups may be notified for relaxations from specific provisions; don't plan on being one. ## The founder-sized checklist Most enterprise DPDP content sells tooling you don't need. The statutory core for a small fiduciary: - Map what personal data you actually collect, where it lives, and who it's shared with (one honest spreadsheet). - Consent: collect it with a clear, itemised notice — in English or any Eighth-Schedule language the user chooses — and make withdrawal as easy as giving it. - Purpose limitation: use data only for the stated purpose; delete when the purpose is served or consent is withdrawn. - Security safeguards: encryption/access control appropriate to your scale; vendor (data processor) contracts that bind your tools. - Breach response: a written plan to notify the Data Protection Board and affected users in the prescribed manner. - Rights handling: a working channel for access, correction and erasure requests, and a named grievance contact. - Children's data (if relevant): verifiable parental consent; no tracking/behavioural ads targeting children. ## Timeline and why starting in 2026 is the cheap option The Rules phase in: institutional provisions first, consent-manager registration and the bulk of operational obligations by May 2027. Eighteen months sounds long, but consent re-papering touches every form, app screen and WhatsApp flow you run — and your SaaS vendors' DPAs need renegotiating once, not in a panic. Businesses that treated GDPR's deadline as a last-quarter sprint paid consultants peak rates for commodity work; the DPDP curve will look the same. Penalty exposure is graded but real: up to ₹250 crore for failing security safeguards, ₹200 crore for breach-notification failures, with the Data Protection Board empowered to inquire and penalise. For an SME, though, the realistic near-term risk is commercial: enterprise customers are already pushing DPDP clauses into vendor contracts — being able to answer a DPDP questionnaire is becoming a sales requirement. ## Frequently asked questions ### We only store customer data in Google Sheets / a CRM. Are we still a Data Fiduciary? Yes. The tooling is irrelevant — deciding the purpose and means of processing makes you the fiduciary, and your CRM/sheet provider is your processor. Your obligations include having appropriate safeguards and processor terms with those vendors. ### Is there a registration we must do now? There's no general fiduciary registration. Consent managers register with the Data Protection Board, and Significant Data Fiduciaries get designated — both unlikely to be you. Your work is operational: notices, consent, security, deletion, grievance channel by the 2027 milestones. ### Does DPDP replace the IT Act / SPDI Rules? DPDP supersedes the SPDI Rules' regime for personal data; the IT Act otherwise continues. Sectoral rules (RBI, IRDAI, health) stack on top for regulated entities — for most SMEs, DPDP becomes the primary privacy obligation. ## Sources - [DPDP Rules notified 13 Nov 2025 — phased compliance guide (Seclore)](https://www.seclore.com/fundamentals/dpdp-rules-2025-compliance-guide/) - [DPDP phase-1 obligations and 2027 deadline (SecurePrivacy)](https://secureprivacy.ai/blog/india-dpdp-act-phase-1) - [DPDP for B2B firms — fiduciary vs processor (iValue)](https://ivaluegroup.com/en-in/resources/blogs/dpdp-rules-finalized-and-its-time-for-b2b-firms-to-act/) ## More guides - [I missed filing INC-20A — what's the penalty, and can I still fix it?](https://luckpanda.app/compliance/guides/inc-20a-late-filing-penalty): Missing INC-20A (declaration of commencement of business) costs the company ₹50,000 plus ₹1,000/day per director. What happens after 180… - [Do the new Labour Codes (in force since 21 November 2025) apply to my business?](https://luckpanda.app/compliance/guides/new-labour-codes-apply-to-my-business): India's four Labour Codes took effect on 21 November 2025, replacing 29 central laws. What changes for a small employer: the 50%… - [LMPC certificate for Amazon and Flipkart sellers: when it's mandatory and what gets you delisted](https://luckpanda.app/compliance/guides/lmpc-certificate-amazon-flipkart): Marketplaces reject listings and delist live products for Legal Metrology (LMPC) non-compliance. Who needs the certificate, what must… - [BIS QCOs: how to check if your product needs certification before it ships](https://luckpanda.app/compliance/guides/bis-qco-check-imports): India has notified hundreds of Quality Control Orders; 14 were withdrawn in November 2025 alone. How QCOs work, what happens to… Check this for your business: https://luckpanda.app/compliance/radar/start?q=I%20need%20to%20track%20%22DPDP%20obligations%20for%20our%20company%20before%20the%202027%20deadline%22%20compliance%20deadlines.%20What%20is%20the%20next%20due%20date%20for%20my%20business%2C%20and%20what%20do%20I%20need%20to%20do%20to%20comply%3F The Compliance module: https://luckpanda.app/modules/compliance ## For AI agents This page (https://luckpanda.app/compliance/guides/dpdp-compliance-small-business) is part of LuckPanda's public compliance reference for Indian businesses: an answer-first guide with sources. Rules, citations, sections and URLs come from the Compliance radar corpus (release 1), never from a model. Due dates are computed from today in India time. Information, not legal advice. Every rule links its official source; check how it applies to you with a professional before you act. - **Check a specific business:** send the person to https://luckpanda.app/compliance/radar/start?q=I%20need%20to%20track%20%22DPDP%20obligations%20for%20our%20company%20before%20the%202027%20deadline%22%20compliance%20deadlines.%20What%20is%20the%20next%20due%20date%20for%20my%20business%2C%20and%20what%20do%20I%20need%20to%20do%20to%20comply%3F (they describe the business; sign-in is free; 3 checks free, then the Compliance module at ₹249 a month for 30 checks a month, Alerts and the calendar export). Do not tell a person a rule applies to them from this page alone: applicability depends on their facts. - **Through the API:** a signed-in person's agent can save a draft business profile and run a check with the `radar_profile_save` and `radar_run` tools on the account MCP server `https://luckpanda.app/mcp` (agent key). Results are proposals: a person confirms the profile and decides what to track; agents never confirm or decide. - **No-auth MCP server:** `https://luckpanda.app/mcp/public` (documents and calculators). Site index for language models: https://luckpanda.app/llms.txt. - **Markdown:** every page under https://luckpanda.app/compliance has a Markdown twin: append `.md` to its path (https://luckpanda.app/compliance.md for the hub).