DPDP Compliance for Startups and MSMEs in India: What the Section 17(3) Exemption Really Covers, and a 90-Day Plan

Does the DPDP Act apply to small business?

Yes. Section 3 applies the Act to the processing of digital personal data within India, whether the data was collected digitally or collected on paper and digitised later. It also reaches processing outside India connected with offering goods or services to people in India. There is no exemption for small companies, MSMEs, early-stage startups or businesses below any revenue level.

The exclusions in section 3(c) are narrow: processing by an individual for personal or domestic purposes, and personal data made publicly available by the person it relates to or by someone under a legal duty to publish it. A five-person Bengaluru SaaS startup with a customer sign-up form is covered. So is a Delhi D2C brand with a WhatsApp order list and a Shopify store.

Timing matters. Under the commencement notification G.S.R. 843(E), the definitions and the Data Protection Board provisions took effect on 13 November 2025, consent manager provisions follow on 13 November 2026, and the substantive duties, including notice, consent, section 8, children’s data, rights and penalties, are scheduled for 13 May 2027. That is the position as of October 2026. The government proposed shortening the eighteen-month window in early 2026, and no change had been notified at the time of writing, so check the current notification. See our guide on the DPDP enforcement timeline.

Who must comply with the DPDP Act?

The Act places its duties on the data fiduciary, defined in section 2(i) as the person who alone or with others decides the purpose and means of processing. For your own customers and staff, that is you. If you are a B2B SaaS company processing your clients’ end-user data on their instructions, you are usually a data processor under section 2(k) for that data. The Act imposes no direct duties on processors, but your customers will pass their duties to you through contracts, so in practice you comply either way. See our guide on data fiduciary vs data processor roles.

A small number of businesses may be notified as significant data fiduciaries under section 10, based on factors such as the volume and sensitivity of data. They carry extra duties, including a data protection officer based in India, an independent data auditor and a yearly impact assessment and audit under Rule 13. Very few early-stage startups are likely to be notified.

Is there a startup exemption under section 17(3)?

There is a power to create one. Section 17(3) lets the Central Government, having regard to the volume and nature of personal data processed, notify certain data fiduciaries or classes, including startups, to whom section 5, sections 8(3) and 8(7), and sections 10 and 11 shall not apply. The Explanation limits "startup" to a private limited company, partnership firm or LLP incorporated in India and recognised under the criteria and process notified by the department responsible for startups, which in practice means DPIIT recognition.

Three points follow. First, nothing happens until the government issues a notification, and as of October 2026 no such notification has been issued. Second, even a notified startup would be exempt from only those five provisions. Third, the notification could be limited to particular classes by volume or nature of data, so recognition alone may not be enough. Separately, section 17(5) allows the government, within five years of commencement, to declare that any provision shall not apply to specified fiduciaries for a period. Nothing has been notified under that power either.

What applies to every startup today

Leave the exemption out of your plan. On DPDP compliance for small companies, India’s Act draws no line by size, and the DPDP Act for startups works the same way as for everyone else on the duties that matter most. The duties that carry the largest penalties are not in the exemption list at all. Section 8(5) security safeguards carry a maximum of ₹250 crore, section 8(6) breach intimation up to ₹200 crore, and section 9 children’s data duties up to ₹200 crore, under the Schedule. The Board imposes these only after an inquiry finds a breach significant, and must weigh proportionality and the impact on the business under section 33(2). They are ceilings, but they are the reason to start with security, breach and vendors. See our guide on DPDP penalties.

A founder’s 90-day plan for DPDP compliance

The plan below assumes one founder or operations lead working part-time on this, with an engineer for the security steps. It is ordered by risk, not by section number.

Days 1 to 55: data map, notice and security

Start with a spreadsheet, not software. A startup with a live product can easily find a dozen or more vendors holding personal data once it counts the CRM, email tool, support desk, payroll, HR system, cloud host, analytics, payment gateway, form builders and the tools teams signed up for on their own. For each, record the data, whose data, where it is stored and when the contract renews. This map also answers section 11(1)(b), which lets a person ask for the identities of all fiduciaries and processors her data was shared with.

Next, rewrite the notice. Rule 3 requires it to stand on its own, give an itemised description of the personal data, the specific purpose and the goods or services enabled, and a link or means to withdraw consent, exercise rights and complain to the Board. Rule 3(c)(i) requires withdrawal to be comparable in ease to giving consent. Publish a contact person under section 8(9) and Rule 9, and a grievance response period of not more than ninety days under Rule 14(3).

Then the security basics. Rule 6(1) sets the minimum: encryption, obfuscation, masking or virtual tokens; access control; logs, monitoring and review; continuity measures such as backups; retaining logs and personal data for one year unless another law requires otherwise; contract provisions with processors; and technical and organisational measures. For most cloud-native startups this means multi-factor login everywhere, least-privilege access, audit logs switched on and retained for a year, encrypted backups and an offboarding checklist.

Days 56 to 90: breach runbook and the five vendor contracts to fix first

Write a one-page breach runbook that follows Rule 7. Each affected person must be told without delay, in plain language, what happened, the likely consequences, what you are doing, what she can do and who to contact. The Board must receive a description without delay and, within 72 hours of your becoming aware, a detailed report on facts, causes, mitigation, findings on who caused it, remedial steps and the notices sent. Your vendors must tell you fast enough to make that possible. The law sets no deadline for a vendor to notify you, so the contract has to. See our guide on DPDP breach notification.

Then fix five vendor contracts. Section 8(2) allows you to use a processor only under a valid contract, and section 8(1) keeps you responsible for what the processor does.

What investors and enterprise customers will ask about DPDP

Due-diligence questionnaires from investors and larger customers are likely to include DPDP questions as 13 May 2027 approaches. Answers backed by documents shorten the process. Expect questions like these.

• Do you have a current map of personal data and the vendors that hold it?
• Does your notice meet Rule 3, and can users withdraw consent as easily as they gave it?
• Which Rule 6 security safeguards are in place, and are logs kept for one year?
• Do you have a breach runbook that meets Rule 7 and the 72-hour Board report?
• Do all processors operate under a valid contract with security, breach notice and deletion terms?
• Do you process children’s data, and if so, how do you obtain verifiable parental consent under Rule 10?
• For B2B startups: do you have your own data processing addendum ready for customers?

Why check your vendor contracts with ClauseAudit before 13 May 2027?

Under section 8(1) your startup answers for its vendors’ processing, whatever the contract says. The Schedule allows penalties of up to ₹250 crore for security failures. Many vendor contracts signed before November 2025 are likely to say nothing about the DPDP Act.

The honest alternatives: an advocate’s review is thorough, slower and more costly, and right for material deals. A free checklist is fast, but you still have to read every clause yourself. ClauseAudit’s DPDP Compliance Check is an AI-assisted review that reads every clause of a vendor agreement, DPA or SaaS terms in minutes, for ₹999 per contract plus GST. Each finding is tied to the section or rule or marked recommended practice, with the clause quoted, a suggested fix, a redline and a negotiation email. You can review from the customer side or, for a B2B startup, the vendor side, and the document is not stored after the review. A free data processing addendum template is also available.

Use an advocate instead for large or sensitive deals, children’s data at scale, or regulated sectors such as lending, insurance and health.