Does the DPDP Act apply to a proprietorship or small firm?
There is no size or legal-form exemption — here is how a small firm is covered.
Why size doesn't matter
The Act defines a Data Fiduciary as anyone who alone or with others decides the purpose and means of processing personal data. A one-person consultancy that keeps client contact details in a spreadsheet meets that definition just as a large company does. Parliament deliberately avoided a small-business exemption because the harm from misused personal data does not shrink with the size of the business holding it.
What a small firm actually has to do
The obligations are the same in kind, lighter in scale: give a clear notice and obtain valid consent, use the data only for the stated purpose, keep it no longer than needed, protect it with reasonable safeguards, honour access and correction requests, and be ready to report a breach. For most small firms this is a defined, one-time clean-up followed by light upkeep — not a permanent overhead.
The realistic risk
The Data Protection Board can impose penalties running into crores for serious security failures, but the more common real-world risk for a small firm is a customer complaint or a B2B client demanding evidence of compliance before signing. Getting the basics in place protects you from both.
Frequently asked questions
Is there a turnover limit below which DPDP doesn't apply?
No. The Act sets no turnover, revenue or employee threshold. The government may later notify lighter obligations for certain classes of fiduciary, but no business should assume it is exempt by default.
I only have a few customers — am I still covered?
Yes. Even a handful of records containing names, phone numbers or emails counts as processing personal data, which brings you within the Act as a Data Fiduciary.
What's the first thing a small business should do?
Run a quick applicability check and a basic data inventory — list what personal data you hold and why — then fix your notice, consent and retention. That covers most of your exposure.
See exactly how DPDP applies to you
Run the free DPDP Applicability Checker to confirm your status and get a prioritised first step.
Check DPDP Applicability (Free)