The DPDP Act for small businesses: 7 steps to take before 13 May 2027

छोटे बिज़नेस के लिए DPDP एक्ट: 13 मई 2027 से पहले 7 कदम

20 October 2026 · 4 min read · Satya Shield

If your business keeps customers' names, phone numbers, addresses, ID details or health records in a register, an Excel sheet, a billing app or on WhatsApp, India's Digital Personal Data Protection Act, 2023 (DPDP Act) applies to you. It doesn't matter whether you have 5 staff or 500.

The DPDP Rules, 2025 were notified on 13 November 2025, and most of the duties for businesses apply from 13 May 2027. That gives small businesses a few months to get ready. Here is what the law asks, in plain language, and seven steps you can start this week.

What the law asks of a business

Under the Act, a business that decides why and how personal data is used is a Data Fiduciary. In simple terms, a Data Fiduciary must:

• Tell people what data it collects and why, in a clear notice.
• Take consent that is free, specific and given by a clear action (an unticked box the person ticks, a signature), and let people withdraw it just as easily.
• Keep data safe with reasonable security safeguards.
• Report a data breach to the Data Protection Board of India and to the affected people.
• Delete data when it is no longer needed.
• Give people a way to see, correct and delete their data, and to complain.
• Take verifiable consent from a parent before using the data of anyone under 18.

Why it matters: the penalties

The Schedule to the Act sets penalties of up to ₹250 crore for failing to take reasonable security safeguards, and up to ₹200 crore each for failing to report a breach or failing to protect children's data. These are maximums, and the Data Protection Board decides the amount based on how serious the case is. But a single customer complaint can start an inquiry, so it's worth getting the basics right.

Seven steps to take now

1. Make a data map

Write down every place personal data enters your business (forms, WhatsApp, billing software, registers), where it is stored, and who can see it. You can't protect what you haven't listed.

2. Publish a privacy notice

A short notice, in English and Hindi or your customers' language, saying what you collect, why, who you share it with, how long you keep it, and how people can contact you. Put it on your website, on forms and at the counter.

3. Fix how you take consent

Use a consent form or checkbox that starts unticked. Keep optional purposes, like offers on WhatsApp, separate from what you need to provide your service. Keep a record of each consent.

4. Name a grievance contact

Publish a name, email and phone number that customers can use for data questions and complaints, and reply on time.

5. Lock down access

Give every staff member their own login, turn on two-step login (OTP) for email and admin accounts, and set up automatic backups. Most data leaks in small businesses start with a shared or stolen password.

6. Write a breach plan

Decide in advance who does what if a phone is lost or an account is hacked: how to contain it, and how to inform the Data Protection Board and affected customers. The Rules expect a detailed report to the Board within 72 hours.

7. Set retention periods

Decide how long you keep each type of record (some, like tax records, have their own legal periods) and delete what you no longer need. Less data means less risk.

Check where you stand in 3 minutes

Our free DPDP risk check asks 12 simple questions and shows your risk score and the top three things to fix, in English or Hindi.

Read the law yourself

The official texts are on our Resources page: the DPDP Act, 2023 and the DPDP Rules, 2025, both as published by the Government of India.

This article is general information to help small businesses understand the law. It is not legal advice. Official texts: DPDP Act, 2023 and DPDP Rules, 2025.