The DPDP Act, 2023 explained for small businesses in India
Updated 20 October 2026 · 7 min read
The Digital Personal Data Protection Act, 2023 (the DPDP Act) is India's first general data protection law. It sets out how businesses may collect and use personal data about people, and gives those people rights over it. The DPDP Rules, 2025 fill in the detail and the dates.
Who the Act covers
The Act applies to digital personal data: data about an identifiable person that is collected online, or collected offline and later digitised. It applies to processing in India, and to processing outside India when it is about offering goods or services to people in India.
There is no minimum size. If your website takes orders, bookings, enquiries or newsletter sign-ups, or runs analytics and ad tags, you handle personal data.
The key terms
- Data Principal: the person the data is about, such as your customer or website visitor.
- Data Fiduciary: the business that decides why and how the data is used. That is you.
- Data Processor: anyone who handles the data for you, such as your hosting, email or payment provider.
- Consent Manager: a registered platform that lets people give and manage consent across businesses.
- Data Protection Board of India: the body that hears complaints and decides penalties.
What a small business has to do
- Give a notice (section 5) before or when you ask for consent: what data you collect, why, and how people can withdraw consent, use their rights and complain to the Board. Rule 3 says what it must contain; see what a DPDP privacy notice must contain.
- Get valid consent (section 6): free, specific, informed, unconditional and unambiguous, given by a clear action, limited to what the purpose needs, and as easy to withdraw as to give.
- Or rely on a legitimate use (section 7): for example, when a customer gives you an address so you can deliver their order, you may use it for that delivery without separate consent.
- Keep data safe with reasonable security safeguards, and make sure your processors do too.
- Report breaches to the Board and to each affected person.
- Erase data once the purpose is served and consent is withdrawn, unless a law requires you to keep it.
- Answer rights requests: people can ask for a summary of their data, correction, completion, updating or erasure, and can nominate someone to act for them.
- Publish a contact who can answer questions about how you use personal data, and run a way to handle grievances.
- Treat children's data carefully: for anyone under 18 you need verifiable consent from a parent, and you may not track or target ads at children.
The dates
The Act received assent in August 2023. The DPDP Rules were notified in November 2025 and phase in over 18 months: the Board first, Consent Managers after a year, and the main duties for businesses on 13 May 2027.
Penalties
The Schedule to the Act sets maximum penalties per breach: up to ₹250 crore for failing to take reasonable security safeguards, up to ₹200 crore for not reporting a breach, up to ₹200 crore for breaking the rules on children's data, and up to ₹50 crore for other breaches of the Act or Rules. The Board considers how serious, how long and how deliberate the breach was.
What the Act does not do
- It does not create special categories such as health or financial data; all personal data is treated alike.
- It does not require a Data Protection Officer unless you are named a Significant Data Fiduciary.
- It does not, by default, require data to stay in India. Transfers are allowed except to countries the Government restricts.
- It does not cover personal data that the person themselves made public.
Where to start
For most small businesses, the first two steps are a clear privacy notice and a consent banner that waits for a yes before analytics and ad tags run. Follow the DPDP checklist for small businesses, or start with the free notice generator.
Questions
Does the DPDP Act apply to small businesses?
Yes. There is no size threshold. Any business that handles digital personal data of people in India is a Data Fiduciary under the Act, from a two-person online store to a clinic with a booking form. Some extra duties apply only to Significant Data Fiduciaries named by the Government.
When does the DPDP Act come into force?
The Act was passed in August 2023 and the DPDP Rules were notified in November 2025. The main duties for businesses, including notice, consent, rights and breach intimation, apply from 13 May 2027.
What is the penalty under the DPDP Act?
Penalties are set per breach in the Schedule to the Act, up to ₹250 crore for failing to take reasonable security safeguards and up to ₹200 crore for not reporting a personal data breach. The Data Protection Board decides the amount case by case.