India's data protection law covers far more businesses than most owners think. If you keep customer phone numbers in Excel, staff Aadhaar scans in a Drive folder or client PAN cards in WhatsApp, the Digital Personal Data Protection Act applies to you. Its main duties start in mid-May 2027. That sounds far away, but the work below takes a few weekends, and big clients are already asking their vendors about it.
This is a practical checklist, not legal advice. Notice and contract wording is worth getting checked by a lawyer. For trade-specific versions, see the checklists for HR, payroll and staffing firms and for CA firms.
Does the DPDP Act apply to my business?
Almost certainly, if you handle anyone's personal data for work.
- You are a Data Fiduciary if you decide why and how personal data is used (Act, section 2(i)). A "person" includes an individual, a proprietor, a firm and a company (section 2(s)).
- There is no size threshold. The Act and Rules set no turnover, headcount or record-count limit for ordinary businesses. A 10-person office with employee Aadhaar scans is covered.
- Digital means more than apps. The Act covers personal data collected digitally, and paper records that were later scanned, photographed or typed in (section 3(a)). A register that never touches a computer is outside it, but almost nothing stays on paper.
- What is left out: personal or domestic use, and data the person made public themselves (section 3(c)).
- No small-business exemption yet. Section 17(3) lets the government exempt notified classes, such as DPIIT-recognised startups, from notice, accuracy, erasure and access duties. No such notification had been issued as of 1 November 2026, and the power can never remove the security and breach-reporting duties.
Key dates
The DPDP Rules, 2025 were published on 13 November 2025 with a phased start (Rule 1; G.S.R. 843(E)).
| Phase | From | What starts | Affects a small business? |
|---|---|---|---|
| 1 | 13 November 2025 | The Data Protection Board is set up on paper | No |
| 2 | November 2026 (one year) | Registration of Consent Managers (Indian companies with ₹2 crore net worth) | No |
| 3 | Mid-May 2027 (18 months; 13 May 2027 on a plain count) | Notice, consent, security, breach reporting, erasure, contact person, children's data, rights, and the Board's power to fine | Yes |
A plan to cut the 18 months to 12 was reported in early 2026, but no amending notification followed, and a Lok Sabha answer of 12 August 2026 still describes the 18-month phase. Until May 2027, the older duty under section 43A of the IT Act still applies.
The DPDP checklist for small businesses
Tick these off as you go. Each one points to the part of the law it comes from.
- Make a data map. List every kind of personal data you hold (customers, staff, candidates, vendors), where each copy sits (WhatsApp, Gmail, Drive, Tally, laptops, phones, printouts) and who can open it. You can't protect or delete what you can't find.
- Cut what you don't need. Consent covers only data necessary for the stated purpose (section 6(1)). If a masked Aadhaar or the last four digits of an account do the job, stop collecting the full number. Our free Aadhaar copy masker runs in the browser.
- Pick the ground for each use. For each item on the map, write down whether you rely on consent or on a legitimate use in section 7: data a person gave you voluntarily for something they asked for, employment purposes, a legal duty, a court order or an emergency.
- Write a plain notice. Wherever you ask for consent, give a standalone notice: an itemised list of the data, the specific purpose, and how to withdraw consent, use their rights and complain to the Board (Rule 3). Offer it in English or any of the 22 scheduled languages the person picks (section 5(3)).
- Make withdrawal as easy as saying yes. If consent was one tap, withdrawal can't need a letter (section 6(4)). Keep a record of who agreed to what and when, because you have to prove it if challenged (section 6(10)).
- Publish a contact person. Put the name or role and the email of the person who answers data questions on your website or app (Rule 9), with your grievance response time, which can be no more than 90 days (Rule 14(3)). The Rules don't say how a business with no website meets this, so a one-page site is cheap insurance.
- Lock down access. Rule 6 lists the minimum: encryption, masking or tokens; access control; logs and monitoring that can catch unauthorised access; and backups. In practice that means one account per person, two-step verification everywhere, shared folders instead of personal WhatsApp, and removing access the day someone leaves.
- Keep logs for a year. Rule 6(1)(e) and Rule 8(3) ask you to keep access logs and the personal data for at least one year from processing, then erase them unless another law needs them kept. Check that your email, Drive or software actually records who opened what.
- Sign contracts with your vendors. Anyone who processes data for you (payroll software, a cloud CRM, an outsourced accountant, a background check agency) needs a valid contract with security terms (section 8(2), Rule 6(1)(f)). You stay responsible for what they do (section 8(1)).
- Set deletion dates. Erase data once the purpose is over or consent is withdrawn, unless a law requires you to keep it (section 8(7)), and make your vendors erase their copies too. Write one retention period per document type, put a recurring reminder in the calendar and note when you deleted.
- Write a one-page breach plan. A breach includes accidental sharing, like a salary sheet sent to the wrong group (section 2(u)). There is no minimum size. You must tell each affected person and the Board without delay, and send the Board a detailed report within 72 hours (Rule 7). Decide now who does what, and keep a message template ready.
- Check for children's data. Anyone under 18 is a child. You need verifiable consent from a parent before processing a child's data, and no tracking or targeted ads aimed at children (section 9, Rule 10). Clinics and schools have narrow exemptions in the Fourth Schedule of the Rules.
What happens if you don't
The Act's Schedule sets the maximum penalties:
| Breach | Up to |
|---|---|
| No reasonable security safeguards (section 8(5)) | ₹250 crore |
| Not reporting a breach to the Board or the people affected (section 8(6)) | ₹200 crore |
| Children's data duties (section 9) | ₹200 crore |
| Anything else in the Act or Rules | ₹50 crore |
These are ceilings, not price tags. The Board can fine only after an inquiry and a hearing, and only for a significant breach. It must weigh the gravity and duration, the type of data, repeat offences, any gain made, how fast and well you limited the damage, and the impact of the fine on your business (section 33). A business can also offer a voluntary undertaking, which ends proceedings on that matter if the Board accepts it (section 32). As of November 2026 the Board had no members appointed, and its power to inquire and fine starts only in May 2027 (PIB).
The more immediate cost is commercial. Larger clients send vendors privacy and security questionnaires, and a vendor who can't answer them loses the contract long before any regulator calls.
What a small business can skip
- Significant Data Fiduciary duties. A Data Protection Officer, independent audits and impact assessments apply only to businesses the government notifies as Significant Data Fiduciaries. None can be notified before May 2027, and the criteria point at large or high-risk processing (section 10).
- Becoming a Consent Manager. That is a registered business for managing other people's consents, open only to Indian companies with ₹2 crore net worth.
- The three-year deletion rule. Rule 8(1) and its 48-hour warning apply only to e-commerce and social media platforms with 2 crore users and gaming platforms with 50 lakh.
If you collect Aadhaar copies
Aadhaar has its own rules on top of the DPDP Act, and they apply to paper too. Under the Aadhaar (Sharing of Information) Regulations, anyone collecting an Aadhaar number or a document containing one must tell the person the purpose and whether it is mandatory, get their consent, never display it publicly, keep it secure, and not keep it longer than the purpose needs (regulations 5 and 6). A masked copy that shows only the last four digits is often enough; see masked Aadhaar vs photocopy.
Where NO SUS fits
Most small businesses leak through ordinary file sharing: ID copies in chats, payslips forwarded to the wrong group, scans left in a download folder. For that part:
- Receiving documents: clients and candidates can send files through a one-open link from nosus.foo, with no account and no phone number exchange. The full workflow is in how to collect documents from clients securely.
- Masking before sharing: the Aadhaar copy masker hides the first eight digits in your browser.
If you want a hand with the whole list (data map, notice, vendor list and breach plan) for a small office in Mumbai, email shubhamsahu@nosus.foo. It's practical setup help, not legal advice.