DPDP compliance checklist for small businesses (before 13 May 2027)
Updated 20 October 2026 · 6 min read
The main duties under the DPDP Act and the DPDP Rules apply from 13 May 2027. This checklist puts them in the order a small business can actually work through.
1. Map your data
- List each item of personal data you collect: name, phone, email, address, date of birth, payment details, device and browsing data.
- For each, write down why you collect it and where it comes from: checkout, contact form, WhatsApp, a walk-in register.
- List every tool that touches it: hosting, email, payment gateway, analytics, ad pixels, CRM, courier.
2. Publish a privacy notice
- Itemised data and purposes, withdrawal, rights and Board complaint, in plain language (Rule 3).
- A contact for questions about your data use (Rule 9).
- Keep versions, so you can show what people saw when they agreed.
Guide: what a DPDP privacy notice must contain. Tool: the free notice generator.
3. Ask before tracking
- A consent banner that loads first and holds back analytics and marketing tags until people agree.
- Reject as easy as accept, and a Privacy settings link on every page.
- Marketing opt-ins at checkout left unticked by default.
Guide: cookie consent in India.
4. Keep a record of consent
- Who agreed to what, when, and which notice version they saw.
- Records you can export and show have not been changed.
5. Tidy up your vendors
- Check each tool from step 1 has a data processing agreement or terms that cover security.
- Remove tools you no longer use, and the tags they left on your site.
6. Basic security
- HTTPS everywhere, strong passwords with two-factor login on admin accounts, limited staff access.
- Backups, and logs kept for at least a year.
7. A breach plan
- Who decides, who writes to affected people, who reports to the Board.
- A detailed report to the Board within 72 hours of becoming aware.
8. Handle requests and grievances
- Publish how people can ask for access, correction or erasure, or nominate someone.
- Reply to grievances within the time you publish, at most 90 days, and keep a log.
9. Retention
- Decide how long you keep each kind of data, and delete it when the purpose is over.
10. Existing customers and children
- Send a notice to people whose data you already hold (section 5(2)).
- If under-18s may use your service, plan for verifiable parental consent.
nodd covers steps 2 to 4 for free during early access: start free or read the setup guide.
Questions
What is the first step for DPDP compliance?
List the personal data you collect, where it comes from, why you use it and which tools and vendors touch it. Every other step, from the notice to the consent banner, depends on that list.
How much does DPDP compliance cost a small business?
The basics can cost very little: a clear notice, a consent banner, a breach plan and a simple process for requests. Tools such as nodd offer the notice, banner and consent records free during early access.
Do I need a lawyer for the DPDP Act?
For a small business with simple data use, many steps are practical rather than legal. It is still wise to have your notice and processes reviewed by a legal advisor, especially if you handle children's data or large volumes.