DPDP Act Compliance Checklist for Small Businesses
What India’s Digital Personal Data Protection Act and the 2025 Rules mean for a company with 5 to 500 people, and the 12 steps to be ready before the main obligations apply in May 2027.
By the HaloSec security team · Updated · 11 min read
Key takeaways
- The DPDP Act, 2023 applies to almost every Indian business that holds customer or employee data in digital form. There is no general small-business exemption.
- The DPDP Rules were notified in November 2025. Most obligations, including security safeguards and breach reporting, apply 18 months later, around May 2027.
- You must notify affected people and the Data Protection Board of a personal data breach without delay, with a detailed report to the Board within 72 hours.
- Penalties go up to ₹250 crore for failing to take reasonable security safeguards and ₹200 crore for failing to report a breach.
- Most of the work is knowing what data you hold, collecting clear consent, securing it, and deleting what you no longer need.
If your business keeps a customer list, runs payroll, collects enquiries through a website form or stores CCTV footage digitally, you process personal data. India’s Digital Personal Data Protection Act, 2023 (the DPDP Act) sets out how you may collect, use, protect and delete it, and the DPDP Rules, 2025 fill in the practical detail.
Most of the rules that affect day-to-day business start around May 2027. That sounds far off, but mapping your data, rewriting notices and fixing security gaps takes most companies several months. This guide explains what the law asks of a small or mid-sized business, then gives you a 12-step checklist to work through.
Who the DPDP Act applies to
The Act covers digital personal data: any information about an identifiable person that is held digitally, or collected on paper and later digitised. It applies to processing inside India, and to processing outside India when it is connected to offering goods or services to people in India.
Three terms come up again and again:
- Data Principal: the person the data is about, such as your customer, employee or website visitor. For a child (under 18), it includes their parent or guardian.
- Data Fiduciary: the business that decides why and how the data is used. That is you.
- Data Processor: anyone who handles the data on your behalf, such as your cloud host, payroll provider, CRM or IT partner.
There is no general exemption for small businesses. The government can exempt some startups from certain duties, and a separate category of Significant Data Fiduciaries (large or high-risk processors the government designates) carries extra obligations. For most SMBs, the standard obligations in this guide apply.
The timeline: what applies when
| Date | What happens |
|---|---|
| August 2023 | The DPDP Act is passed by Parliament. |
| November 2025 | The DPDP Rules are notified. Rules setting up the Data Protection Board take effect straight away. |
| November 2026 | Rules for registering Consent Managers take effect (12 months after notification). |
| Around May 2027 | The main obligations take effect (18 months after notification): notices, consent, security safeguards, breach reporting, data retention and the rights of Data Principals. |
The CERT-In 6-hour reporting rule is separate and already in force. You do not have to wait for 2027 for that one.
The 12-step DPDP checklist
Work through these in order. The first four steps tell you how big the job is; the rest put the controls in place.
1Map the personal data you hold
List every place personal data lives: CRM, accounting software, HR and payroll, email, website forms, shared drives, WhatsApp groups, laptops, backups and paper files that get scanned. For each, note what data it holds, whose it is, why you have it, who can access it and which vendors touch it. You cannot protect, explain or delete data you do not know about.
2Decide the lawful basis for each use
Under the Act you may process personal data either with consent or for certain legitimate uses. Legitimate uses include data a person gives you voluntarily for a specific purpose (without objecting), employment purposes, legal obligations and medical emergencies. Everything else, such as marketing to existing customers, needs consent.
3Rewrite your privacy notice
When you ask for consent, you must give a notice that can be understood on its own, without reading anything else. It must list the personal data you collect and the specific purpose for each item, explain how to withdraw consent, how to exercise their rights and how to complain to the Data Protection Board. Plain language matters: a legal wall of text will not meet the standard.
4Fix how you collect consent
Consent must be free, specific, informed, unconditional and unambiguous, given by a clear action such as ticking an unticked box. Pre-ticked boxes, bundled “agree to everything” checkboxes and consent hidden in terms of service do not count. Withdrawing consent must be as easy as giving it, and you must keep a record that consent was given.
5Name a contact person and set up grievance handling
Publish the business contact details of someone who can answer questions about how you handle personal data. (Only Significant Data Fiduciaries need a formal Data Protection Officer.) Set up a simple way for people to raise complaints, and respond within the period you publish, which must not exceed 90 days.
6Be ready to honour people’s rights
Data Principals can ask for a summary of the data you hold about them and who you shared it with, ask you to correct, complete or erase it, raise a grievance, and nominate someone to act for them. Decide who handles these requests, how you verify identity and how you find all of a person’s data across your systems. Step 1 makes this possible.
7Put reasonable security safeguards in place
This is the obligation with the highest penalty. The Rules list the minimum:
- Encryption, masking, obfuscation or tokenisation of personal data.
- Access controls, so people only see the data their job needs.
- Logging, monitoring and review of who accessed what.
- Backups and measures to keep working if systems are compromised.
- Contracts that require your processors to take the same care.
In practice, for most SMBs that means centrally managed endpoint security with disk encryption and ransomware rollback, data loss prevention to stop data leaving by email, USB or personal cloud, multi-factor authentication on email and admin accounts, and tested offline backups.
8Keep logs for at least a year
The Rules require you to keep logs of personal data processing, and the personal data itself where needed, for at least one year to help detect and investigate breaches. Check that your firewall, email, endpoint and cloud logs are retained that long and are stored where an attacker cannot delete them. A Security Operations Center or managed monitoring service handles this for you.
9Write a breach response plan
If personal data is breached, you must:
- Tell each affected person without delay, in plain language: what happened, the likely consequences, what you are doing about it, what they can do to protect themselves, and who to contact.
- Tell the Data Protection Board without delay, then send a detailed report within 72 hours of becoming aware: the facts, the cause, the people affected, what you have done to contain it and any findings about who was responsible.
Decide now who leads, who calls the lawyer, who drafts the notices and how you reach customers. Keep the plan, and your incident response contact, somewhere you can reach if your own systems are down.
Do not forget CERT-In. Under CERT-In’s 2022 directions, many cyber incidents, including data breaches, ransomware and compromise of servers or email, must be reported to CERT-In within 6 hours of noticing them. A single incident can require reports to both CERT-In and the Data Protection Board, on different clocks.
10Review your vendor contracts
You stay responsible for personal data your processors handle. List every vendor from step 1 and check that each contract requires them to protect the data, use it only on your instructions, tell you quickly about any breach and delete or return the data when the contract ends.
11Set retention and deletion rules
Once the purpose is served, or a person withdraws consent, you must erase their data unless another law requires you to keep it (tax, GST and labour records often do). Write down how long you keep each type of data, then actually delete it, including old exports, spreadsheets on laptops and copies in email.
12Check children’s data and transfers abroad
If any of your users or customers may be under 18, you need verifiable consent from a parent or guardian, and you must not track, behaviourally monitor or target advertising at children. Transfers of personal data outside India are allowed unless the government restricts a particular country, so keep a list of where your cloud and SaaS providers store data.
Penalties
The Data Protection Board can impose penalties of up to:
| Breach | Maximum penalty |
|---|---|
| Failing to take reasonable security safeguards to prevent a breach | ₹250 crore |
| Failing to notify the Board or affected people of a breach | ₹200 crore |
| Breaking the rules on children’s data | ₹200 crore |
| Breaking the extra obligations of a Significant Data Fiduciary | ₹150 crore |
| Any other breach of the Act or Rules | ₹50 crore |
The Board decides the amount based on how serious the breach was, whether it was repeated, what the business gained and what it did to limit the damage. Acting quickly and having safeguards documented counts in your favour.
Where to start this month
- Week 1: name an owner for DPDP compliance and complete the data map in step 1, even roughly.
- Week 2: fix the quick wins: multi-factor authentication on email, removing ex-employees’ access, and checking that backups restore.
- Week 3: rewrite the notice and consent wording on your website forms.
- Week 4: get a security gap assessment against step 7, so you know what to budget for before 2027.
Not sure where your gaps are? A HaloSec security audit checks your endpoints, network, cloud and access controls against the safeguards the DPDP Rules expect, and gives you a prioritised, plain-language fix list. You can start with our free 3-minute check-up.
Frequently asked questions
Does the DPDP Act apply to small businesses?
Yes. The Act applies to any organisation that processes digital personal data in India, whatever its size. The government can exempt some startups from certain duties, but there is no blanket exemption for small businesses.
When does the DPDP Act come into force?
The Act was passed in August 2023 and the DPDP Rules were notified in November 2025. The Data Protection Board provisions started straight away, consent manager rules follow after 12 months, and most obligations on businesses apply after 18 months, around May 2027.
Do I need a Data Protection Officer under the DPDP Act?
Only Significant Data Fiduciaries, a category the government designates for large or high-risk processors, must appoint a Data Protection Officer based in India. Every other business must publish the contact details of a person who can answer questions about how it handles personal data.
How quickly must a data breach be reported under the DPDP Rules?
Affected individuals and the Data Protection Board must be told without delay. A detailed report, covering what happened, the likely impact and what you have done about it, must reach the Board within 72 hours of you becoming aware of the breach.
Is CERT-In reporting still required if I report under the DPDP Act?
Yes. The CERT-In directions of 2022 still require many cyber incidents to be reported to CERT-In within 6 hours of noticing them. A personal data breach may need to be reported to both CERT-In and the Data Protection Board.
What are the penalties under the DPDP Act?
The highest penalty is up to ₹250 crore for failing to take reasonable security safeguards to prevent a breach. Failing to notify a breach can cost up to ₹200 crore, as can breaking the rules on children’s data. Other breaches of the Act carry up to ₹50 crore.
This guide is general information, not legal advice. Laws and deadlines change; check the current official text before acting. First published .