DPDP Compliance for Startups
A practical DPDP Act checklist for Indian startups and digital businesses, from the first sign-up flow to the first enterprise security review.
This guide covers what changes for a startup. For the full program, step by step, see the DPDP compliance guide.
Key Takeaways
- The DPDP Act has no exemption by size. Section 17(3) lets the Central Government exempt notified startups from some duties, and until a notification covers yours, plan for every duty.
- Rules 3 and 5 to 16 of the DPDP Rules 2025, which set out most Data Fiduciary duties, take effect on 13 May 2027.
- Start with a data inventory, a Rule 3 notice, consent purpose by purpose, contracts with your SaaS vendors and a breach plan.
- A DPO is required only of a Significant Data Fiduciary, but every startup must publish a contact who can answer questions about its processing.
- A documented program is what investor diligence and enterprise security reviews ask to see.
DPDP Act Basics for Startups
Does the DPDP Act Apply to Your Startup?
If your startup processes digital personal data in India, or offers goods or services to people in India from abroad, the DPDP Act applies. There is no threshold by revenue, headcount or number of users.
Section 17(3) lets the Central Government exempt notified Data Fiduciaries, including startups recognized under the government's startup criteria, from the notice duty, the accuracy and erasure duties in section 8(3) and 8(7), the Significant Data Fiduciary duties and the right of access. An exemption applies only once a notification covers your class of startup, so plan for every duty until then.
The Significant Data Fiduciary duties apply only if the Central Government notifies you as one, weighing factors such as the volume and sensitivity of the personal data you process. Every other duty, from notice and consent to security and breach intimation, applies to you, and Rules 3 and 5 to 16 of the DPDP Rules 2025, which set out most of them, come into force on 13 May 2027.
Minimum Viable DPDP Compliance for Startups
A startup can cover the core duties without a privacy team. These eight items are the floor, and each one is cheaper to build into the product now than to retrofit after launch.
Checklist:
- List the personal data you collect, why, where it is stored and who can access it
- Show a notice at sign-up that itemizes the personal data and purposes, with links to withdraw consent, exercise rights and complain to the Board (Rule 3)
- Take consent purpose by purpose, with no pre-ticked boxes, and keep a record of who agreed to what and when
- Add a parent check to any flow a child can reach, and keep tracking and targeted ads away from children
- Encrypt personal data, control access, keep access logs for a year and take backups (Rule 6)
- Sign a data processing contract with every SaaS vendor that touches personal data
- Publish a contact for privacy questions and a way to make a rights request, and answer grievances within 90 days
- Write a one-page breach plan: who decides, who tells the Board and users, and how you meet the 72-hour report
Consent and Notices for SaaS and App Businesses
Building Consent Into the Product
For a startup, consent is the most visible duty because it sits in the user experience. Consent has to be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the personal data each purpose needs. Pre-ticked boxes, bundled consent and consent buried in the terms of service all fail that test.
Present each purpose separately and let users agree to each one on its own. Use plain language. Make withdrawal as easy as giving consent, ideally from a privacy page inside the app. Keep a record of which notice each user saw and what they agreed to, because if consent is ever questioned, you have to prove it.
ConsentIQ captures consent purpose by purpose on your website or app, keeps a digitally signed record of each consent, and checks parents through DigiLocker.
Writing Notices Users Can Read
Users must have the option to read the notice in English or any language of the Eighth Schedule to the Constitution (section 5(3)). Have translations reviewed, because machine translation of legal terms can mislead.
The notice has to describe the personal data, the specific purposes, the goods or services the processing enables, and how a user can withdraw consent, exercise rights and complain to the Data Protection Board. ComplyIQ drafts a notice from the processing activities in your RoPA and translates it into the 22 scheduled Indian languages.
Vendor and Processor Checklist
Your SaaS Stack Is Your Processor List
Every tool that stores or handles personal data for you, from the CRM and email platform to analytics, the support desk, payments and cloud hosting, is a Data Processor. The startup stays responsible for what they do with that data (section 8(1)), and may use them only under a valid contract (section 8(2)).
Checklist:
- List every vendor that touches personal data, and what data each one holds
- Sign a data processing agreement with each vendor that binds it to reasonable security safeguards (Rule 6)
- Make sure each vendor erases your users' personal data on your instruction (section 8(7))
- Require each vendor to tell you about a breach quickly enough for you to meet the Rule 7 notices
- Record where each vendor stores data, and check it against any transfer restriction the government notifies (section 16)
- Review the list whenever you add a tool or renew a contract
When Your Startup Is the Data Processor
A B2B SaaS startup is often a Data Processor for its customers: they are the Data Fiduciaries, and you process their users' personal data on their behalf. The Act puts the duties on them, and they pass the work to you by contract. A customer may use you only under a valid contract (section 8(2)), has to write its security safeguards into it (Rule 6), has to have you erase its data on instruction (section 8(7)), and depends on you to hear about a breach in time to meet its own Rule 7 notices.
Expect each enterprise customer to send a data processing agreement and a security questionnaire built on those points. Read the breach-reporting clause closely before you sign, because the deadline it sets is the one you will be held to.
Data Security on a Budget
Essential Security Measures
The DPDP Act requires reasonable security safeguards to prevent a personal data breach, and Rule 6 sets the minimum: encryption, masking or tokenization; access control; logs and monitoring that detect unauthorized access; backups; one year of logs; and security terms in vendor contracts. For a startup that means good basics, applied consistently.
Encrypt personal data at rest and in transit (TLS 1.2 or later in transit, AES-256 at rest). Require multi-factor authentication for administrative and developer access. Give each person access only to the personal data their role needs. Use cloud providers with built-in security controls and compliance certifications. Patch systems and dependencies promptly, test your backups, and run regular vulnerability scans. Most of this costs little beyond engineering time.
Checklist:
- Enable encryption at rest and in transit for every data store holding personal data
- Require multi-factor authentication for all administrative and developer access
- Apply least privilege to database and system access
- Turn on access logging, alert on suspicious activity, and keep the logs for one year
- Patch operating systems and dependencies on a schedule
- Run vulnerability scans every quarter
Incident Response Preparation
Breaches happen to well-run startups too. The plan needs a small response team (often the CTO and a co-founder), who decides, how you contain and investigate, and who sends the notices. The breach response workflow sets out each Rule 7 step and the 72-hour report to the Board.
Run a tabletop exercise on a likely scenario, such as a leaked API key or a misconfigured storage bucket. The usual gaps are not knowing where all personal data lives, not being able to tell which users were affected, and having no draft notices ready.
When to Name a Privacy Owner or DPO
A Contact From Day One, a DPO If You Are Notified
A Data Protection Officer is required only of a Significant Data Fiduciary (section 10). Every Data Fiduciary, startups included, must publish the business contact of a person who can answer users' questions about the processing of their personal data, and mention it in every response to a rights request (section 8(9), Rule 9).
Name that person before launch. A founder or senior leader can hold the role early on. Move it to a dedicated privacy lead once rights requests, enterprise questionnaires or sensitive data make it a weekly job.
DPDP Roadmap by Startup Stage
What to Do at Each Stage
The duties are the same at every stage. What changes is how much evidence you need and who asks for it.
| Stage | Focus |
|---|---|
| Before launch | Data inventory, the sign-up notice and consent, a privacy contact, encryption and access control |
| First paying customers | Vendor contracts, a rights request channel, the breach plan, retention by purpose |
| First enterprise deals | An evidence pack for security reviews: the record of processing, consent records, the processor list, the breach plan, and ISO 27001 or SOC 2 if buyers ask |
| Scaling | Tooling for consent and rights requests, regular audits, and a check on whether you could be notified as a Significant Data Fiduciary |
Fundraising and Enterprise Sales
Compliance in Due Diligence
Investors, particularly in B2B SaaS, review a startup's privacy posture during due diligence, and enterprise customers send security and privacy questionnaires before they sign. A documented program shortens both conversations.
Keep the record of processing, the consent records, the security measures, the vendor list and the incident response plan in one place. Those documents answer most questionnaire sections directly, and they show investors the privacy risk is managed. As you grow, certifications such as ISO 27001 or SOC 2 give independent validation that enterprise buyers increasingly expect.
Common Mistakes Founders Make
Four Avoidable Gaps
Copying a GDPR privacy policy. A DPDP notice has to itemize the personal data and purposes, name the route to complain to the Data Protection Board, and be offered in English or any language of the Eighth Schedule.
Analytics and ad SDKs that reach children. Tracking, behavioral monitoring and targeted advertising directed at children are prohibited (section 9(3)), so check what your SDKs do in any flow a child can use.
No contracts with SaaS vendors. Each one is a Data Processor, and you stay responsible for its processing.
Signing a customer's data processing agreement you cannot meet. A breach-reporting deadline shorter than your incident process can deliver puts you in breach of contract on day one.
The DPDP compliance guide covers the mistakes every program makes, whatever its size.
Tools That Help
Frequently Asked Questions
Is there a small business exemption under the DPDP Act?
There is no exemption by size. Section 17(3) lets the Central Government exempt notified startups, and other notified Data Fiduciaries, from the notice duty, the accuracy and erasure duties in section 8(3) and 8(7), the Significant Data Fiduciary duties and the right of access. Until a notification covers your startup, plan for every duty.
Can a startup founder serve as the Data Protection Officer?
A DPO is required only of a Significant Data Fiduciary (section 10). Every Data Fiduciary must still publish the business contact of a person who can answer users' questions about its processing (section 8(9), Rule 9), and a founder or senior leader can hold that role early on.
What happens if a startup has a data breach?
Tell each affected user and the Data Protection Board without delay, and send the Board a detailed report within 72 hours of becoming aware (Rule 7). Failing to take reasonable security safeguards can draw a penalty of up to INR 250 crore, and a missed breach notice up to INR 200 crore. In setting the amount, the Board weighs factors including the gravity of the breach, the mitigation taken and the likely impact of the penalty on the organization.
Related Solutions
Notices, consent, children's data, rights requests and breaches for the DPDP Act, on one inventory.