Does the DPDP Act apply to a small business?

If you handle the digital personal data of people in India, it applies to you. The Rules carry narrower exemptions for certain classes of data fiduciary and certain purposes, which is one of the first things worth checking against your own operations.

What actually changes on 13 November 2026?

The Data Protection Board can inquire into complaints and impose penalties from that date, and registration opens for Consent Managers under Rule 4.

The substantive obligations apply in full: notice, consent, data principal rights, retention, cross-border transfer and breach reporting. That is eighteen months after the Rules were notified.

Is DecodeFolks a law firm?

No. DecodeFolks decodes the problem and connects you to independent privacy counsel and DPDP practitioners. Any legal advice comes from them, under their own engagement with you.

We already ran a GDPR project. Is that enough?

It is a strong start and it is not a substitute. Notice and consent, children's data, and the Consent Manager route all carry India-specific requirements that a GDPR programme does not cover.

What do I get for joining the waitlist?

One email when your sector's cohort opens, and the readiness decode free when it does. No newsletter.

What if a customer asks you to delete their data?
Nobody can say where all of it lives.

That single request now has a law behind it, a regulator behind the law and a date on the calendar. For most businesses the honest answer today is a week of searching, five systems and a guess.

Take the readiness check

Only 25 days left to be ready

Inbox · todayUnanswered

"Please delete all the personal data you hold about me."

a customer, exercising a right the Act gives them

Which systems hold itUnknown

Which vendors have copiesUnknown

Who replies to thisUnassigned

What the DPDP Act is

A consent law for personal data, with a regulator and a calendar

The Digital Personal Data Protection Act, 2023 governs the digital personal data of people in India. Four things in it decide how much work you have.

01Scope

It covers digital personal data

Anything that identifies a person and sits in a digital system. Customers, employees, leads, applicants, patients.

02Your role

You are a Data Fiduciary

You decide why the data is collected, so the duty sits with you. Vendors who process it for you are Data Processors, and you stay answerable for them.

03Their rights

People can ask, correct and erase

Access, correction, erasure and a published grievance channel. Every right is a request someone in your business has to answer.

04Enforcement

A Board, and fixed dates

The Data Protection Board of India inquires into complaints and imposes penalties. The Rules set when each duty starts.

Statutory timeline

13 NOV 2025

Rules notified

13 NOV 2026

Penalties begin, Consent Managers register

13 MAY 2027

Full compliance

What it costs to get wrong

The Act sets the ceiling in the Schedule, not in guidance.

Up to ₹250 cr

Failure to take reasonable security safeguards to prevent a breach

Up to ₹200 cr

Failure to notify a personal data breach to the Board and to affected people

Up to ₹200 cr

Failure on the additional duties owed when children's data is involved

Up to ₹150 cr

Failure on the additional duties of a Significant Data Fiduciary

Up to ₹50 cr

Any other breach of the Act or its Rules

Maximums the Data Protection Board may impose under the Schedule to the DPDP Act, 2023. Separate failures are assessed separately.

Where businesses get stuck

None of this shows up as a legal problem at first.

It shows up as six ordinary operational habits, each one reasonable on the day it started.

No list of where customer data lives

It is in the CRM, the WhatsApp exports, three spreadsheets and a vendor dashboard nobody has opened since 2023.

The consent notice came with the website

Written for cookies, in one language, by an agency that has since moved on. It is still the thing your customers agree to.

Nobody owns the answer

Legal thinks it is IT. IT thinks it is legal. The founder thinks it is next quarter's problem.

A deletion request would take a week

You can pull up a customer's orders in a minute. Finding every copy of their personal data is a different job entirely.

Vendor contracts predate the Act

The processors handling your data are still on terms written before any of this existed, and nobody has reopened them.

Unclear whether the bigger rules apply

Significant Data Fiduciary duties land on some businesses and not others. Nobody has told you which side of that line you sit on.

Who advises you

A practitioner who has done DPDP for a business like yours

You see who they are, what they have shipped and what they charge before you book. You pick.

Privacy counselD2C, fintech

Notice and consent, end to end

11 years, data protection practice

Rewrote consent notices and grievance processes for eight D2C and lending businesses.

Ex-DPOSaaS, B2B

Data maps and vendor registers

Former DPO, mid-market SaaS

Built the system inventory and processor register for a 200-person SaaS across four countries.

Security practitionerHealth, edtech

Safeguards and breach drills

CISO advisory, 9 years

Ran breach-notification drills and closed the safeguards gaps flagged in audit.

Identity and practice credentials verifiedDPDP work evidenced, not claimedRates published before you bookRated by the businesses they advised

Readiness check

Find out where you stand in two minutes

Tick only what is true right now. Nothing is sent anywhere, and the count travels with you into the waitlist form.

We have a list of every place customer data is stored

Our consent notice states the purpose in plain language

It is available in the languages we actually sell in

One named person answers data questions, and their contact is published

We can find and delete one customer's data on request

We know which vendors process personal data on our behalf

Those vendor contracts carry data protection obligations

We have a written breach drill: who is told, by whom, by when

Your count

0of 8

Nothing ticked yet. Start with the data map: everything else depends on knowing what you hold.

FAQ

What business owners ask first

Get ready to a DPDP position you can defend.

The DPDP cohort opens sector by sector. Tell us where you stand, get your exposure decoded free, then choose the practitioner who advises you.

DecodeFolks is not a law firm and this page is not legal advice. Advice comes from independent practitioners you choose and engage directly.

What if a customer asks you to delete their data? Nobody can say where all of it lives.