Does DPDP apply to startups and small businesses?
There is no size exemption in the DPDP Act. Here is what startups and small businesses must actually do to comply.
What DPDP obligations does a typical early-stage startup have?
A typical B2C startup processing customer data has these minimum obligations: (1) A privacy notice on the website and app explaining what data is collected and why; (2) Consent mechanisms for marketing emails, push notifications, and profiling; (3) A mechanism for customers to access their data, correct it, and request deletion; (4) DPAs with SaaS vendors who process customer data (CRM, email tool, analytics, payment processor); (5) A documented breach response plan; and (6) Basic security — encrypted databases, secure APIs, access controls. These can be implemented by a 5-person team in 2–4 weeks.
Can a startup use a generic privacy policy template to comply?
A generic template that does not reflect your actual data processing is better than nothing — but not compliant with DPDP. The privacy notice must be specific to what your company actually collects and processes. A payments startup collecting PAN and bank account data has very different notice requirements than a fitness app collecting health and activity data. Use a template as a starting structure, then customise it to describe your actual data categories, purposes, third-party sharing, and retention periods accurately.
What vendor DPAs does a typical startup need?
Most startups use: a payment gateway (Razorpay, PayU — both have DPA provisions); a cloud provider (AWS, GCP, Azure — all have standard DPAs); a CRM (HubSpot, Zoho, Salesforce — all have DPA addenda); an email marketing tool (Mailchimp, Brevo, Zoho Campaigns — check for DPA); an analytics tool (Google Analytics — Google provides a DPA); and possibly a helpdesk tool (Freshdesk, Intercom — check for DPA). Execute the DPA addendum for each tool. This takes 1–2 days if you have the right contacts at each vendor.
How should a startup handle data subject rights requests?
Initially, an email inbox (privacy@yourcompany.com or dpo@yourcompany.com) for data rights requests is sufficient. Designate one person to handle these requests. Respond within 30 days. As the company scales, build a self-service mechanism in the product (account settings with data download and account deletion). For the first 1–2 years, a manual process is operationally viable for most startups — but document your responses and timelines as evidence of compliance.
What security measures are essential for a DPDP-compliant startup?
Minimum security for a DPDP-compliant startup: encrypt your database at rest (most cloud databases offer this by default — verify it is enabled); use HTTPS for all API communications; implement multi-factor authentication for system access; use role-based access (not everyone needs access to every table); back up data securely; do not store passwords in plain text; and have a process for revoking access when someone leaves the company. These are also standard security practices that most investors and enterprise customers will ask about.
What happens if a startup is breached before it has implemented DPDP compliance?
A startup that has made no effort at DPDP compliance and then has a breach is in a poor regulatory position. The Board will assess: what was the nature of the breach? What harm did it cause? Did the company have any security measures? Did they notify promptly? The absence of basic security controls and a breach response plan are aggravating factors in penalty assessment. Even a lightweight compliance programme — privacy notice, a few vendor DPAs, basic security, documented breach response — is significantly better than nothing when a breach occurs.
Frequently asked questions
Will the Data Protection Board go after startups?
Enforcement priorities are expected to focus on large-scale, high-risk data processing initially. However, any company that: has a significant breach affecting many individuals; receives a data principal complaint that is substantiated; or processes particularly sensitive data (health, financial, children's data) may attract enforcement regardless of size. A well-funded startup that is deliberately non-compliant is a more likely enforcement target than a bootstrapped startup making good-faith compliance efforts with limited resources.
Is there a startup-specific compliance track under DPDP?
The DPDP Act does not provide a startup-specific or DPIIT-recognised startup exemption. DPIIT recognition as a startup gives certain regulatory and tax benefits — but DPDP compliance obligations are independent of startup recognition status. Some industry bodies have advocated for a startup-friendly implementation period — monitor MeitY announcements for any such accommodations as the Rules are finalised.
How much does basic DPDP compliance cost for a startup?
A lightweight but genuine DPDP compliance programme for a startup can be implemented at low cost: privacy notice and consent framework (a few days of legal or compliance work, or a structured template customisation — ₹10,000–₹30,000 with a specialist); vendor DPA execution (administrative effort, no additional cost for standard DPA addenda); basic security controls (likely already partially in place in a tech startup — specific hardening measures). A full DPDP readiness assessment and gap remediation from a specialist — ₹50,000–₹1,50,000 — is a reasonable budget for an early-stage startup with straightforward data processing.
Get your startup DPDP-ready
Niti Bharat's Founder DPDP Compliance Kit is designed for startups — lightweight privacy notice template, consent framework, vendor DPA checklist, and basic breach response plan in one package.
Get the Startup DPDP Kit