DPDP Compliance Cost for a Small Business in India: What Is Free, What Takes Time and What You Pay For

How much does DPDP compliance cost for a small business in India?

There is no fixed price, because the Act does not prescribe a compliance programme. It sets duties. The duties of a data fiduciary in section 8, the notice and consent rules in sections 5 and 6, and the penalties in section 33 are scheduled to apply from 13 May 2027 under the commencement notification G.S.R. 843(E), as of October 2026. That eighteen-month window may be shortened by notification, so check the current position before you budget around the date.

For a business of 20 to 200 people that is not notified as a significant data fiduciary, the work falls into three buckets. The table summarises them with indicative figures. Every figure is a published estimate from the source named, not a quote, and most come from firms that sell these services.

What costs nothing

The DPDP Act and the DPDP Rules, 2025 are short by Indian standards and free to read in the Gazette. An owner or operations head who reads sections 4 to 17 of the Act and Rules 3 and 6 to 15 of the Rules will understand most of what applies to them. That reading is the single most useful free step, because it lets you judge which consultant claims are real.

Templates are the second free item. A privacy notice built around Rule 3 needs an itemised description of the personal data, the specific purpose, the goods or services it enables, and how the person can withdraw consent, exercise rights and complain to the Board. A breach runbook can follow Rule 7 line by line. ClauseAudit publishes a free data processing addendum template, and see our guide on the DPDP compliance checklist for a full list of steps.

What costs staff time

For most small firms the main cost is internal hours, not invoices. The work is concrete.

• Data inventory: list every system and vendor that holds personal data of customers, staff or applicants, what data it holds and where. A Delhi D2C brand with 60 staff might find a dozen such vendors.
• Notice and consent: rewrite sign-up forms and the privacy notice to meet Rule 3, and make withdrawal as easy as giving consent, as Rule 3(c)(i) requires.
• Contact person and grievances: section 8(9) and Rule 9 require you to publish the business contact of a person who can answer questions, and Rule 14(3) requires you to publish a grievance response period of not more than ninety days.
• Breach process: decide who leads, how the vendor reaches you, and how you will inform affected people without delay and send the Board its detailed report within 72 hours under Rule 7(2)(b).
• Retention: set up deletion once a purpose is served under section 8(7), while keeping logs and related data for one year under Rule 6(1)(e) and Rule 8(3).
• Vendor contracts: confirm each processor works under a valid contract with a security provision, as section 8(2) and Rule 6(1)(f) expect.

DPDP compliance services: consultants, DPOs and software

A DPDP compliance consultant is most useful for data mapping and gap assessment if your systems are scattered, and least useful for producing generic policies you could write from a template. Tranquility Cybersecurity, a firm that sells implementation services, publishes estimates of ₹3 lakh to ₹5 lakh for full implementation at 10 to 50 staff and ₹5 lakh to ₹8 lakh at 50 to 200 staff, and says starting with no documentation adds 20 to 30 percent. As a seller of these services, it is not a neutral source. Treat these as indicative ceilings for a full engagement, not a price you must pay.

On data protection officers, the law is narrower than many sales pages suggest. Section 2(l) defines a DPO as an individual appointed by a significant data fiduciary, and section 10(2)(a) makes the appointment mandatory only for those notified as significant. Everyone else must publish the contact of a DPO if they have one, or of a person able to answer questions, under section 8(9). Inc42 reported in July 2026 that fractional DPO services are priced at ₹2 lakh to ₹8 lakh a year and in-house hires at ₹25 lakh to ₹40 lakh a year; both figures are indicative. For a 40-person company, a trained internal owner is usually enough.

DPDP compliance software ranges widely. Inc42, citing Consently, put consent management platforms at anywhere from nothing to ₹15 lakh a year (indicative). One India-focused consent and audit tool listed on AWS Marketplace shows US$299 a month for a starter plan and US$599 for a growth plan, as of 2026; treat these as indicative list prices. Do not confuse such software with a registered Consent Manager under the Act: that is a separate entity registered with the Board under Rule 4, which commences on 13 November 2026. Section 6(7) lets your customers act through one, and how far a fiduciary must integrate with consent managers is not yet settled.

Security tooling is the hardest line to price because it depends on what you already run. Rule 6(1) lists the minimum: encryption, masking or tokens; access control; logs, monitoring and review; backups; one-year log retention; contract provisions with processors; and organisational measures. Many small firms can meet much of this by switching on features in tools they already pay for, such as multi-factor login, audit logs and managed backups.

DPDP compliance for MSME budgets: three illustrative cases

These cases combine the indicative ranges above with the staff work. They are illustrations, not quotes.

A 20-person Pune payroll vendor that mostly acts as a data processor for its clients may spend almost nothing on consultants. Its priorities are a strong security posture, a clean DPA that its clients will accept, and a breach notice process. Its clients will push DPDP terms onto it, so having its own DPA ready is a sales asset.

An 80-person Bengaluru SaaS company handling customer and end-user data may spend on a short gap assessment, some legal time on its notice and DPA, and vendor contract reviews, staying well under the mid-market consultant estimate by doing the inventory itself.

A 200-person Hyderabad hospital group processes health data, possibly children’s data under section 9, and may face sector rules too. It should budget for an advocate and a security assessment, and should not rely on templates alone.

How does compliance cost compare with the penalty exposure?

The Schedule to the Act sets maximum penalties. The Data Protection Board can impose them only after an inquiry finds a breach significant, under section 33(1), and section 33(2) requires it to consider the nature, gravity and duration of the breach, the type of data, repetition, any gain made or loss avoided, mitigation and how promptly it was taken, proportionality, and the likely impact of the penalty on the person. A small firm is unlikely to face the maximum for a first, minor lapse. But the ceilings show what Parliament considers serious.

What does a single breach cost?

Penalties are only part of the picture. IBM’s Cost of a Data Breach Report 2025 put the average cost of a breach in India at ₹22 crore, an indicative survey figure. That study draws mainly on larger organisations, so a small business will usually face far less. The direct costs still add up: forensic help, legal advice, the Rule 7 notices to every affected person, the 72-hour Board report, customer churn and management time. Against that, a few lakh spent on the right controls, or a few thousand on vendor contracts, is modest.

What to spend on first

Order matters more than total. The table ranks items by risk reduction per rupee for a typical 20 to 200 person business. It is a judgment, not a formula, and a hospital or edtech firm should move children’s and health data controls up the list.

Why vendor contract review is the cheapest high-impact line item

Section 8(1) makes the data fiduciary responsible for processing done on its behalf by a processor, irrespective of any agreement to the contrary. The Schedule allows penalties of up to ₹250 crore for security failures. Many vendor contracts signed before November 2025 are likely to say nothing about the DPDP Act.

You have three honest options. An advocate’s review is thorough, slower and more expensive, and it is the right choice for material deals. A free checklist is fast, but you still read every clause and judge it yourself. ClauseAudit’s DPDP Compliance Check is an AI-assisted review that reads every clause of a vendor agreement, DPA or SaaS terms in minutes, for ₹999 per contract plus GST. Each finding is tied to the section or rule, or marked recommended practice, and comes with a suggested redline and a negotiation email. It works from either side, customer or vendor, and the document is not stored after the review.

Do not use it as a substitute for an advocate on large or sensitive deals, children’s data at scale, or contracts in regulated sectors such as banking, insurance or health.