Startups & SMEs
DPDP Act for Startups and SMEs: Exemptions and a Practical Plan
By Kaivan Tech · Published 4 November 2026 · Updated 4 November 2026 · Checked against the official Act and Rules
Short answer
Yes, the DPDP Act applies to startups and SMEs: it has no size threshold. Section 17(3) lets the Central Government exempt notified classes of Data Fiduciaries, including DPIIT-recognised startups, from Sections 5, 8(3), 8(7), 10 and 11, but the exemption applies only once a notification names them, and none had been issued as of October 2026. Even then, consent, security safeguards, breach reporting and children’s-data rules would still apply.
- Size threshold
- None: small businesses are covered
- Possible startup exemption
- Section 17(3), only if notified
- Provisions it could disapply
- Sections 5, 8(3), 8(7), 10 and 11
- Never exempted by 17(3)
- Consent, security safeguards, breach reporting, children’s data
What Section 17(3) says
Section 17(3) allows the Central Government, having regard to the volume and nature of personal data processed, to notify certain Data Fiduciaries or classes of them, including startups, as fiduciaries to whom specific provisions do not apply. A “startup” here means a private limited company, partnership firm or LLP incorporated in India and recognised as a startup under the criteria notified by the department responsible for startups (DPIIT).
| Provision | What it requires | Can 17(3) exempt it? |
|---|---|---|
| Section 5 | Notice to Data Principals | Yes, if notified |
| Section 8(3) | Accuracy and completeness when data is used for decisions or shared | Yes, if notified |
| Section 8(7) | Erasing data once the purpose is served | Yes, if notified |
| Section 10 | Significant Data Fiduciary duties (DPO, audits, DPIA) | Yes, if notified |
| Section 11 | Right to access information about one’s data | Yes, if notified |
| Section 6 | Valid consent and easy withdrawal | No |
| Section 8(5)–(6) | Security safeguards and breach intimation | No |
| Section 9 | Children’s data and verifiable parental consent | No |
| Sections 12–13 | Correction, erasure and grievance redressal | No |
Is any startup exempt today?
No. The exemption works only through a notification that names the class of Data Fiduciaries and the provisions disapplied. Secondary sources tracking the Gazette reported that no Section 17(3) notification had been issued as of October 2026. Until one is, startups and SMEs should plan for the full Act from 13 May 2027, and check MeitY and the Official Gazette for any notification.
A lean DPDP plan for startups and SMEs
- List every place you collect personal data: website forms, app sign-ups, WhatsApp, CRM, HR files
- Remove data you do not need, and set a retention period for the rest
- Add short notices and unticked consent boxes at each collection point
- Make withdrawal and rights requests possible through one simple form or email address
- Turn on encryption, two-factor login and access logs in the tools you already use
- Write a one-page breach plan with the 72-hour Board report and CERT-In’s 6-hour rule
- Add DPDP clauses to contracts with vendors that process data for you
- If you sell to under-18s, design verifiable parental consent before launch
Need this done in your own systems?
Kaivan Tech assesses websites, apps and business systems against the DPDP Act and Rules, then implements the fixes: consent and notice flows, rights workflows, logging, retention and breach readiness.
See our DPDP compliance servicesFrequently asked questions
Does the DPDP Act apply to small businesses?+
Yes. The DPDP Act, 2023 has no turnover or size threshold; any business processing digital personal data of people in India is a Data Fiduciary, with most obligations applying from 13 May 2027.
Are startups exempt from the DPDP Act?+
Not automatically. Section 17(3) lets the Central Government exempt notified classes of Data Fiduciaries, including DPIIT-recognised startups, from Sections 5, 8(3), 8(7), 10 and 11, but only through a notification, and none had been issued as of October 2026.
Which DPDP obligations can never be exempted for startups under Section 17(3)?+
Section 17(3) cannot disapply consent requirements (Section 6), security safeguards and breach intimation (Section 8(5) and 8(6)), children’s-data rules (Section 9), or correction, erasure and grievance rights (Sections 12 and 13).
What is the cheapest way for an SME to start DPDP compliance?+
Map where personal data enters the business, delete what you do not need, add notices and consent at each form, set up one channel for rights requests and grievances, and switch on encryption, two-factor login and access logs in existing tools.
Related guides
Sources
This guide explains the law in general terms and is not legal advice. Have a qualified Indian legal professional confirm how the Act and Rules apply to your organisation.