DPDP Compliance Checklist for Small Businesses in India (2026)

The Digital Personal Data Protection Act 2023 and the DPDP Rules 2025 change how every Indian business collects, uses, shares and deletes personal data. Most of the duties start on 13 May 2027. That sounds far away until you count the work: a data inventory, a new privacy notice, consent records, vendor contracts, a breach plan, retention rules and a way to answer requests from customers and staff. This checklist breaks that work into eight blocks. Every item names the section or rule it comes from, so you, your CA or your advocate can check it against the official text.

Who the DPDP Act applies to

The Act applies to the processing of digital personal data in India, whether it was collected online or on paper and digitised later, and to processing outside India connected with offering goods or services to people in India. The business that decides why and how personal data is processed is the Data Fiduciary. There is no turnover or headcount threshold. A five-person CA firm with client PAN details in Tally, a clinic with patient records, a coaching centre with student phone numbers and a D2C brand with a Shopify customer list are all Data Fiduciaries.

Personal data is any data about an individual who can be identified by or in relation to it: names, phone numbers, email addresses, PAN, Aadhaar, bank details, addresses, health records, CCTV footage, payslips, attendance logs. Unlike some foreign laws, the Act has no separate category of “sensitive” data; everything is personal data, though the harm from losing health or financial data will weigh in any penalty. Your employees' data counts as much as your customers'. The only carve-outs that matter to most businesses are data used for purely personal or domestic purposes and data the person has made public themselves.

Section 17(3) lets the Government exempt certain classes, including startups, from some provisions. As of October 2026 no such exemption has been notified, and even if one is, the consent, security, breach and grievance duties sit outside it. Plan as if every item below applies to you.

The dates that matter

The DPDP Rules were notified on 13 November 2025. Consent Manager rules apply from 13 November 2026 and only affect businesses that want to become Consent Managers. Everything in this checklist applies from 13 May 2027. Separately, the CERT-In Directions have bound every body corporate, including firms and sole proprietorships, since 2022, and MSMEs since 25 September 2022. The Data Protection Board had no Chairperson or Members as of October 2026, so nobody is penalising anyone under the DPDP Act yet; the months until May 2027 are for getting ready. The full table, with links to each gazette, is on our DPDP and CERT-In dates page.

The checklist, in eight blocks

Work through the blocks in order. The first one feeds all the others: you cannot write a notice, sign vendor contracts or plan retention for data you have not listed. Rule and section numbers refer to the DPDP Rules 2025 and the DPDP Act 2023 as published by MeitY.

1. Data inventory and security safeguards

Comes from: Rule 6 of the DPDP Rules; Act s.8(5)

Everything else depends on knowing what personal data you hold. Rule 6 then sets a minimum list of “reasonable security safeguards” for that data. Failing to take them carries the Act's highest ceiling, ₹250 crore, which is why this block comes first.

• List every place personal data lives: website forms, CRM, accounting and billing software, HR files, email, WhatsApp groups, shared drives, spreadsheets and paper files you scan.
• For each data set, note whose data it is (customers, staff, patients, students, vendors), why you hold it, where it is stored and who can open it.
• Encrypt, mask or tokenise personal data where you can: full-disk encryption on laptops, masked Aadhaar and card numbers, encrypted backups. (Rule 6(1)(a))
• Control access to the systems that hold it, with one login per person and access by job role. (Rule 6(1)(b))
• Switch on access logs, review them, and keep the logs and data needed to investigate unauthorised access for one year. (Rule 6(1)(c) and (e))
• Back up so the business can keep working if data is destroyed or locked. (Rule 6(1)(d))

2. Privacy notice

Comes from: Rule 3 of the DPDP Rules; Act s.5

Wherever you ask for consent, you have to give a notice first or at the same time. Rule 3 sets what the notice must contain. A generic privacy policy copied from another site rarely passes, because the Rule asks for your own data and your own purposes, item by item.

• Write the notice so it can be understood on its own, not as a clause buried in your terms of service. (Rule 3(a))
• Give an itemised list of the personal data you collect, in clear and plain language. (Rule 3(b)(i))
• State each purpose and the goods, services or uses it makes possible. (Rule 3(b)(ii))
• Include the link and any other means by which a person can withdraw consent, exercise their rights and complain to the Data Protection Board. (Rule 3(c))
• Offer the notice in English or any language in the Eighth Schedule to the Constitution, for example Hindi, Tamil or Marathi. (Act s.5(3))
• Plan a notice for customers who consented before the Act commenced, to be sent as soon as reasonably practicable. (Act s.5(2))

3. Consent and withdrawal

Comes from: Act s.6 (with s.7 for uses that need no consent)

Consent under section 6 has to be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action and limited to the data the purpose needs. Pre-ticked boxes and “by using this site you agree” banners do not meet that standard.

• Replace pre-ticked boxes and bundled consents with a separate, unticked choice for each purpose. (s.6(1))
• Ask only for the data each purpose needs; drop fields you collect “just in case”. (s.6(1))
• Make withdrawing consent as easy as giving it: if consent took one tap, withdrawal cannot need a letter. (s.6(4))
• When someone withdraws, stop processing within a reasonable time and make your vendors stop too. (s.6(6))
• Keep records of each notice shown and each consent given, with date, time and version: in a dispute the business has to prove both. (s.6(10))
• Mark which processing relies on a legitimate use under section 7 instead of consent, such as data a customer gave you voluntarily for a purchase, or employment purposes for staff. (s.7)

4. Children's data

Comes from: Act s.9; Rules 10 to 12 and the Fourth Schedule

Under the Act a child is anyone under eighteen. Coaching centres, schools, clinics, edtech apps and any D2C brand with teenage customers need this block. Rule 10 sets how parental consent is verified, and Rule 12 with the Fourth Schedule sets narrow exemptions. The ceiling for breaching the children's duties is ₹200 crore.

• Find out whether any of your customers, users or students are under 18, and where their data enters your systems.
• Get verifiable consent from a parent before processing a child's data, and check that the parent is an identifiable adult, using details you already hold or a virtual token from an authorised entity such as DigiLocker. (s.9(1), Rule 10)
• Switch off tracking, behavioural monitoring and targeted advertising directed at children, including ad and analytics tools on pages children use. (s.9(3))
• Check whether you fall in an exempt class (Part A of the Fourth Schedule: clinical establishments and healthcare professionals, allied healthcare professionals, educational institutions, crèches and child day-care, and child transport providers) or an exempt purpose (Part B), and note the conditions. An educational institution, for example, is exempt only for tracking and behavioural monitoring for its educational activities or the safety of enrolled children. (Rule 12)
• Whatever the exemption, never process a child's data in a way likely to harm the child's well-being. (s.9(2))

5. Processors and vendors

Comes from: Act s.8(1) and s.8(2); Rule 6(1)(f)

Your payroll provider, CRM, cloud host, email marketing tool and IT support firm all process personal data for you. The Act calls them Data Processors, and section 8(1) keeps you responsible for what they do, whatever the contract says.

• List every vendor that stores or touches personal data on your behalf, including free tools staff signed up for themselves.
• Put a valid contract, ideally in writing, in place with each one. (s.8(2))
• Make sure each contract requires the vendor to take reasonable security safeguards. (Rule 6(1)(f))
• Make sure each contract lets you tell the vendor to stop processing and to erase data when consent is withdrawn or the purpose is over. (s.6(6), s.8(7)(b))
• Check that the vendor keeps processing logs for at least a year, as Rule 8(3) expects of processing done on your behalf. (Rule 8(3))

6. Breach plan with the three clocks

Comes from: Rule 7 of the DPDP Rules; Act s.8(6); CERT-In Direction (ii)

A personal data breach now starts three separate clocks. One is already running: the CERT-In Directions require reporting listed cyber incidents within 6 hours. From 13 May 2027 Rule 7 adds two more. The ceiling for failing to give breach intimation is ₹200 crore.

• Clock 1, now: report listed cyber incidents to CERT-In within 6 hours of noticing them, at incident@cert-in.org.in or 1800-11-4949, and register a point of contact with CERT-In. (CERT-In Directions (ii) and (iii))
• Clock 2, from May 2027: tell each affected person without delay, in plain language, what happened, the likely consequences for them, what you are doing, what they can do to protect themselves, and who to contact. (Rule 7(1))
• Clock 2 also covers the Board: send it a description of the breach, its nature, extent, timing, location and likely impact, without delay. (Rule 7(2)(a))
• Clock 3: within 72 hours, send the Board a detailed report covering the facts and reasons, mitigation, any findings about who caused it, steps to prevent a repeat, and a report on the notices sent to affected people. (Rule 7(2)(b))
• Write the templates, contact lists and decision owner now, and run a short drill so the clocks are not learned during a real incident.

7. Retention and deletion

Comes from: Act s.8(7); Rule 8 and the Third Schedule

Keeping data forever is no longer the safe default. Section 8(7) requires erasure when consent is withdrawn or the purpose is no longer served, unless another law requires you to keep it. Rule 8(3) pulls the other way for one year: personal data, traffic data and processing logs have to be kept for at least a year from the processing.

• Set a retention period for each data set, tied to its purpose and to any law that sets a longer period, such as tax, labour or KYC records.
• Erase personal data when consent is withdrawn or the purpose is over, whichever comes first, unless a law requires you to keep it, and make your vendors erase it too. (s.8(7))
• Keep personal data, associated traffic data and processing logs for at least one year from the date of processing, then erase them unless another law requires longer. (Rule 8(3))
• Check whether you are in a Third Schedule class: e-commerce entities with at least two crore registered users in India, online gaming intermediaries with at least fifty lakh, or social media intermediaries with at least two crore. Only they face the three-year inactivity erasure and the 48-hour warning. Most small businesses are not. (Rule 8(1) and (2))

8. Rights, grievances and a contact person

Comes from: Rules 9 and 14; Act ss.8(9), 8(10) and 11 to 14

People whose data you hold get rights to access, correction, completion, updating and erasure, grievance redressal and nomination. Rule 14 tells you what to publish so they can use them, and Rule 9 asks for a named point of contact.

• Publish, prominently on your website or app, the business contact details of a person who can answer questions about how you process personal data, and include them in every reply to a rights request. (Rule 9, s.8(9))
• Publish how a person can make a rights request and what identifier you need to recognise them, such as a customer ID or registered mobile number. (Rule 14(1))
• Set up a way to handle requests for access, correction, completion, updating and erasure, and log each one. (ss.11 and 12)
• Publish your grievance response period, no more than 90 days, and put the people and tools in place to meet it. (Rule 14(3), s.13(2))
• Offer a way for a person to nominate someone to exercise their rights if they die or become incapable. (Rule 14(4), s.14)

What to do first: 10 to 50 staff versus 50 to 500

The duties are the same at every size. What changes is how much of the work one person can carry and how many systems and vendors you have to cover.

10 to 50 people

One owner, usually the founder, a partner or the office manager, can run this in a few weeks of part-time effort.

1. This week, CERT-In basics. Name a point of contact for CERT-In, put incident@cert-in.org.in and the 6-hour rule into a one-page incident plan, and check that your email, firewall and key systems keep 180 days of logs.
2. Weeks 1 to 2, inventory. One spreadsheet: data set, whose data, purpose, where it lives, who has access, which vendor touches it, how long you keep it.
3. Weeks 3 to 4, notice and consent. Rewrite the privacy notice against Rule 3, fix your website and app forms, and start keeping consent records.
4. Month 2, vendors and security. Collect contracts for every vendor on the inventory, add security and erasure terms where they are missing, and switch on MFA, encryption and backups.
5. Month 3, the rest. Breach templates for all three clocks, a retention table, a contact person published on the website, a rights-request inbox, and a published grievance response period of no more than 90 days.

50 to 500 people

At this size, data sits in many departments and the vendor list runs into dozens. Treat it as a project.

1. Name an owner and a small working group from HR, finance, sales, IT and operations, with a monthly review until May 2027.
2. Map data by department, not by system: recruitment, payroll, customer onboarding, marketing, support, CCTV and visitor logs each get their own row.
3. Run a contract programme. Rank vendors by the volume and sensitivity of data they hold and add DPDP terms to the riskiest first.
4. Build a consent and rights workflow into your CRM or ticketing tool instead of a shared inbox, so every request has an owner, a deadline and a log.
5. Drill the breach plan. A two-hour tabletop exercise that walks through the 6-hour CERT-In report, the notices to affected people and the 72-hour Board report will expose the gaps faster than any document review.
6. Test your security independently. CERT-In's MSME guideline recommends an annual vulnerability assessment by an independent party; see our explainer on the 15 CERT-In controls.

What the Syentrix Compliance Check does with this list

The checklist above is the human-readable version of what our Compliance Check runs. You upload your privacy notice, policies, vendor contracts and incident plan, or answer questions in English, Hindi, Hinglish or eight other Indian languages. It then marks each clause of the DPDP Act, the DPDP Rules, the CERT-In Directions and the 15 CERT-In controls for MSMEs as met, partly met, not met, not applicable or evidence needed, quoting the text from your document that each verdict rests on. You get a prioritised fix list, the three breach clocks side by side and, on the full plan, a PDF pack an auditor can work from.

It is a readiness tool designed around the official texts, not legal advice, not an audit and not a certificate. Where your documents are silent it says so rather than guessing. The interview plan is ₹1,499 a month and the full plan with uploads is ₹5,999 a month, plus GST.

Frequently asked questions

Does the DPDP Act apply to small businesses?

Yes. The Act has no turnover or headcount threshold. Any business that processes digital personal data in India, including customer, staff or patient data that was collected on paper and later digitised, is a Data Fiduciary. Section 17(3) allows the Government to exempt some classes, such as startups, from certain provisions, but no such exemption had been notified as of October 2026.

When do small businesses need to be ready for DPDP?

Most DPDP duties, including notice, consent, security safeguards, breach intimation, children's data, retention and rights, apply from 13 May 2027. The CERT-In Directions, including 6-hour incident reporting and 180-day log retention, already apply to MSMEs and have done since 25 September 2022.

Does a small business need a Data Protection Officer?

Only a Significant Data Fiduciary must appoint a Data Protection Officer, and no business had been notified as one as of October 2026. Every other business must publish the contact details of a person who can answer questions about how it processes personal data, and include them in every reply to a rights request.

Is employee data covered by the DPDP Act?

Yes. Staff names, PAN, Aadhaar, bank details, payslips and attendance records are personal data. Section 7 lets an employer process them for employment purposes without separate consent, but security safeguards, breach intimation, vendor contracts and retention duties still apply.

What are the penalties under the DPDP Act?

The Act sets ceilings once its penalty provisions commence on 13 May 2027: up to ₹250 crore for failing to take reasonable security safeguards, up to ₹200 crore each for failing to give breach intimation or breaching children's data duties, up to ₹150 crore for Significant Data Fiduciary duties, and up to ₹50 crore for any other provision. The Board weighs the nature of the breach and how promptly the business acted. As of October 2026 the Board had no members.

Do paper records count under the DPDP Act?

The Act applies to personal data in digital form, including data collected on paper and digitised later. A paper register that is never scanned or typed into a system falls outside it, but most businesses digitise almost everything at some point, so plan as if all of it is covered.

General information, not legal advice. This checklist was reviewed on 14 October 2026 against the DPDP Act 2023, the DPDP Rules 2025 and the CERT-In Directions of 2022 as published by MeitY and CERT-In. Laws and notifications change; check the official text, and speak to an advocate before relying on any item for a legal decision.