DPDP Act for startups: what applies from day one
Which duties a startup carries from its first user, which only arrive with scale, what the section 17(3) exemption power does and does not do, and the cheapest way to get ready.
Last updated 22 October 2026
Does the DPDP Act apply to startups?
Yes. The DPDP Act has no size threshold: a startup that processes digital personal data is a Data Fiduciary from its first user. Section 17(3) lets the Central Government exempt notified startups from a few duties, but no such exemption appears in the DPDP Rules, 2025, so plan to comply in full.
Where the DPDP Compliance Suite is today
The Perimattic DPDP Compliance Suite is in development. It is not yet live or for sale, and the features on this page are planned, not shipped.
Sign upWhich DPDP duties apply to a startup from its first user?
The Digital Personal Data Protection Act, 2023 (Act No. 22 of 2023) applies to anyone processing digital personal data in India, and to processing outside India connected with offering goods or services to people in India (section 3). There is no turnover, headcount or user threshold. A pre-revenue app with a hundred beta users is a Data Fiduciary in the same way a listed company is.
What changes with size is not whether the Act applies but which extra duties switch on. The table splits the two.
| Duty | Where it comes from | When it matters for a startup |
|---|---|---|
| Lawful ground: consent or a listed legitimate use | Section 4, sections 6 and 7 | From the first user |
| Notice before or with each consent request | Section 5; Rule 3 | From the first user |
| Withdrawal as easy as giving consent | Section 6(4); Rule 3(c)(i) | From the first user |
| Reasonable security safeguards, including logs kept for a year | Section 8(5); Rule 6 | From the first user |
| Breach intimation to users and the Data Protection Board | Section 8(6); Rule 7 | From the first user |
| Published contact person and a grievance system | Sections 8(9), 8(10) and 13; Rules 9 and 14 | From the first user |
| Verifiable parental consent; no tracking or targeted ads at children | Section 9; Rule 10 | As soon as any user may be under 18 |
| Erasure after three years of inactivity, with 48 hours’ warning | Rule 8; Third Schedule | Only for e-commerce and social media at 2 crore registered users, or online gaming at 50 lakh |
| Data Protection Officer, independent audit, annual DPIA | Section 10; Rule 13 | Only if the government notifies you as a Significant Data Fiduciary |
None of these duties is enforceable yet. Sections 3 to 17 of the Act, which contain all of them, come into force on 13 May 2027 under the commencement order published on 13 November 2025 (G.S.R. 843(E)), and the operational rules behind them, Rules 3 and 5 to 16, start the same day, eighteen months after the Rules were published (DPDP Rules, 2025, Rule 1). A startup that builds the basics into its product now avoids retrofitting them into a larger codebase later.
Can the government exempt startups from the DPDP Act?
It can, partly. Section 17(3) says the Central Government may, having regard to the volume and nature of personal data processed, notify certain Data Fiduciaries or classes of Data Fiduciaries, including startups, to whom these provisions will not apply:
- section 5, the notice that must accompany or precede a consent request;
- section 8(3), the duty to keep data complete, accurate and consistent when it drives a decision or is shared;
- section 8(7), the duty to erase data once consent is withdrawn or the purpose is served;
- section 10, the extra duties of a Significant Data Fiduciary; and
- section 11, the Data Principal’s right to a summary of her data and of who it was shared with.
For this purpose a startup is a private limited company, partnership firm or LLP incorporated in India that is eligible for, and holds, startup recognition under the criteria notified by the Central Government department that handles startups.
Two things matter in practice. First, this is a power to exempt, not an exemption: it takes effect only through a notification, and the DPDP Rules, 2025 do not contain one. Second, even a notified startup would still need a lawful ground for processing, would still owe security safeguards and breach intimation, would still be bound by the children’s data rules in section 9, and would still have to handle correction, erasure and grievance requests. Do not build a product on the assumption that an exemption is coming.
What personal data does a typical SaaS or app startup handle?
Most early-stage products touch the same handful of data flows. Mapping them is the first real compliance task, because every later duty, from the notice to the breach plan, depends on knowing what you hold and who else holds it for you.
| Data flow | Your role | DPDP duty to plan for | Section or rule |
|---|---|---|---|
| Sign-up: name, email, phone, password hash | Data Fiduciary | Notice listing each item and its purpose; consent limited to what the service needs | Sections 5 and 6(1); Rule 3 |
| Product analytics and session recording | Data Fiduciary; the analytics vendor is your processor | A lawful ground, a processor contract, and only the data the stated purpose needs | Sections 6(1) and 8(2) |
| Marketing emails and retargeting | Data Fiduciary | Separate, specific consent that can be withdrawn as easily as it was given | Section 6(1) and 6(4) |
| Customer data inside a B2B SaaS | Data Processor for your customer | Follow the customer’s instructions and contract; erase when told to | Sections 8(1), 8(2) and 8(7)(b) |
| Cloud hosting, email delivery, support desk | Their customer (you remain the Fiduciary) | A valid contract that includes security safeguards | Section 8(2); Rule 6(1)(f) |
| Employee and contractor records | Data Fiduciary | Legitimate use for employment purposes, still with security and breach duties | Section 7(i); section 8(5) |
Who are your processors?
A Data Processor is anyone who processes personal data on your behalf (section 2(k)): your cloud host, email service, CRM, support desk, analytics tool and any outsourced developer with production access. Section 8(1) keeps you responsible for what they do, whatever your contract says, and section 8(2) lets you use them only under a valid contract. When a user withdraws consent, section 6(6) requires you to make your processors stop too. Some vendors, such as a payment provider, may act as Data Fiduciaries in their own right for parts of what they do, so the contract should say which role each party plays.
What are the cheapest first steps for a startup?
None of the following needs a privacy team or paid software. Together they cover most of what an early-stage product needs before the operational rules take effect.
| Step | What to do | Why |
|---|---|---|
| 1. List what you collect | One sheet: each data field, where it is stored, why you need it, which vendor touches it | Every other duty starts here |
| 2. Cut what you do not need | Drop fields and permissions the product does not use | Consent covers only data necessary for the stated purpose (section 6(1)) |
| 3. Rewrite the notice | Itemise the data, state each purpose, link to withdrawal, rights and complaints | Rule 3 sets the minimum contents |
| 4. Split consent | Separate service consent from marketing consent; add a one-click opt-out | Withdrawal must be as easy as consent (section 6(4)) |
| 5. Turn on logging and encryption | Access logs kept for a year, encryption at rest, role-based access, backups | Rule 6 lists these as minimum safeguards |
| 6. Name a contact and a grievance route | A published email and a stated response period of no more than 90 days | Rules 9 and 14(3) |
| 7. Write a breach runbook | Who decides, who tells users, who reports to the Board within 72 hours | Rule 7 |
| 8. Check your vendor contracts | Security clauses, erasure on termination, notice of breaches to you | Section 8(2); Rule 6(1)(f) |
The stakes are set in section 33 and the Schedule to the Act. The highest band, for failing to take reasonable security safeguards, may extend to two hundred and fifty crore rupees; failing to notify a breach, and breaching the children’s data duties, may each extend to two hundred crore rupees; any other breach of the Act or Rules may extend to fifty crore rupees. Section 33(2) requires the Board to consider proportionality and the likely impact of a penalty on the person, among other factors.
How will the Perimattic DPDP Compliance Suite help startups?
The Perimattic DPDP Compliance Suite is planned software to help Indian businesses comply with the DPDP Act and Rules. For startups, the planned features most relevant are:
- A personal-data inventory that maps what you collect, where it lives and why.
- A notice builder for Rule 3 notices, in English and Eighth Schedule languages.
- Consent capture and records, with withdrawal as easy as giving consent.
- A rights-request tracker for access, correction, erasure, nomination and grievances.
- A breach response workflow for user intimations and Board reports under Rule 7.
- A processor and vendor register with contract tracking.
Status: The Perimattic DPDP Compliance Suite is in development; none of this is available to use yet. Using it will not by itself guarantee compliance. Sign up to tell us how your product handles personal data.
General guidance, not legal advice. Checked against the DPDP Act, 2023 and DPDP Rules, 2025 on 22 October 2026.
More on DPDP compliance
The DPDP Act for startups, answered
Are startups exempt from the DPDP Act?
Not today. Section 17(3) of the Act lets the Central Government notify certain Data Fiduciaries, including startups, to whom section 5 (notice), section 8(3) (accuracy), section 8(7) (erasure), section 10 (Significant Data Fiduciary duties) and section 11 (right of access) will not apply. The DPDP Rules, 2025 contain no such exemption, so until a notification is actually issued, every duty applies to startups as to anyone else.
Is a B2B SaaS startup a Data Fiduciary or a Data Processor?
Usually both. For the personal data your customers upload and control, you process on their behalf, which makes you their Data Processor under section 2(k). For your own sign-ups, sales leads, staff and marketing lists, you decide the purpose and means, which makes you a Data Fiduciary under section 2(i). Your contracts and your data inventory should keep the two apart.
When do the DPDP Act and Rules start applying to a startup?
The Rules were published in the Gazette on 13 November 2025. Rules 1, 2 and 17 to 21 took effect that day, Rule 4 on Consent Managers takes effect on 13 November 2026, and the operational rules a startup has to follow, Rules 3 and 5 to 16 on notices, security, breaches, erasure, children and rights, take effect eighteen months after publication (13 May 2027). Sections 3 to 17 of the Act, which contain the duties themselves, come into force the same day under G.S.R. 843(E).
Want DPDP compliance built around how your business handles data?
Sign up to tell us what personal data you handle, follow the build and be first to try the DPDP Compliance Suite when it opens.
Sign up