DPDP Act compliance for small business isn't optional, and there's no size-based exemption in the rules as notified. Most of the practical duties start in mid-May 2027, 18 months after the DPDP Rules were published. If your website, app, CRM or HR sheets hold customer or staff details, you have roughly six months to fix how you collect, store and delete that data.
We get this question a lot, usually from owners who saw a headline about ₹250 crore penalties. Customer numbers sit in a WhatsApp export, employee PAN copies live in someone's Gmail, and the contact form emails leads to three people. From May 2027 that won't do.
When do the DPDP Rules apply?
The DPDP Rules, 2025 Gazette notification is dated 13 November 2025. The Data Protection Board rules applied at once, consent managers come in after one year, and Rules 3 and 5 to 16, which hold almost everything a business has to do, apply eighteen months after publication. The government's PIB explainer says 14 November 2025, so plan for mid-May 2027 rather than one exact day.
In February 2026, a note by law firm S.S. Rana & Co. on Chambers and Partners reported a MeitY proposal to cut the window to 12 months, which would move the date to 13 November 2026. The note isn't clear whether that covers every business or only Significant Data Fiduciaries, and we found no Gazette amendment when we last checked on 26 October 2026.
Does it apply to a small business?
Almost certainly. Any business that decides why and how digital personal data is processed is a Data Fiduciary. Section 17(3) of the DPDP Act, 2023 lets the government exempt some classes, including recognised startups, from a few sections, but that only happens by notification, and we haven't seen one. B2B firms are covered too: your dealer's contact person and your own staff are individuals.
What does DPDP Act compliance for small business actually involve?
| Rule | What it requires | What it means for your software |
|---|---|---|
| Rule 3: Notice | A standalone notice listing each data item and its purpose | Rewrite forms and sign-up screens, not just the privacy policy |
| Rule 6: Security | Encryption or masking, access control, logs, backups | Role-based logins, audit logs kept for a year, tested backups |
| Rule 7: Breach | Tell affected people without delay; detailed report to the Board within 72 hours | A written breach plan and a way to message every affected user |
| Rule 8(3) and Section 8(7): Retention | Keep personal data and logs for at least a year; erase once the purpose is served, unless a law needs it kept | Deletion jobs that respect retention periods set by other laws |
| Rule 9: Contact | Publish who answers data questions | A named contact on the website and app |
| Section 8(2) of the Act: Processors | Use vendors only under a valid contract | Data clauses in your hosting, CRM and agency agreements |
The PIB explainer adds that access, correction and erasure requests must be answered within ninety days. And Rule 3 says withdrawing consent should be about as easy as giving it, so a one-click opt-in with a "write to us" opt-out won't pass.
What are the penalties?
According to the PIB explainer, failing to take reasonable security safeguards can draw up to ₹250 crore. Failing to report a breach, or breaking the rules on children's data, can draw up to ₹200 crore each, and other violations up to ₹50 crore. Those are ceilings. For an SME, the likelier trouble is a complaint on the Board's portal and no records to show what you did.
Free consultation
Planning something like this?
Tell us what you need. After a short call we send a written scope, timeline and fixed quote.
Do we have to store data in India?
Not by default. Section 16 of the Act lets the government block transfers to countries it notifies; until then overseas hosting is allowed, though Section 16(2) keeps any stricter Indian law in force. We still suggest an Indian cloud region, so a future list doesn't force a migration.
How much does DPDP compliance cost?
There's no official figure. It depends on:
- How many places hold personal data: website, app, CRM, ERP, HR, Excel and WhatsApp exports
- Whether your software has role-based access and audit logs already, or needs them added
- Consent capture and withdrawal on every form and app screen
- Building retention and deletion rules into the database
- Legal review of notices and vendor contracts (a lawyer's job, not a developer's)
A recent app with roles and logs needs far less work than an old site with one shared admin login. We quote after looking at the system; our pricing page explains how.
Common mistakes we're seeing
- Copying a privacy policy template and calling it done. The Rules want a notice at the point of collection.
- Deleting everything to be safe. Rule 8(3) wants at least a year of logs, and it defers to other laws, like your tax record rules, where they need longer.
Our HR portal case study was for a 500-employee enterprise, bigger than most readers here, where employees sent claims by email with scanned receipts, HR kept eligibility in spreadsheets, and there was no audit trail. Smaller firms have the same mess with fewer rows.
Before you decide what to fix first
- List every system and spreadsheet that holds personal data, and who can open it.
- Check each collection point (forms, app sign-ups, WhatsApp) for a clear purpose notice.
- Turn on access roles and logging in your main systems.
- Test a backup restore, then write a one-page breach plan.
- Ask your hosting, CRM and marketing vendors for data processing terms.
- Name one person to handle data requests and publish their contact.
How Codelix handles this
We're a software company, not a law firm, so get your notices and contracts checked by a lawyer. Our part is the software: audit logs, access roles, consent screens, deletion jobs and hosting, kept running after launch under our security and maintenance service. We'll sign an NDA before we look at your data.
