DPDP for small businesses: what your website, CRM and WhatsApp list must do by 13 May 2027

The Digital Personal Data Protection Act was passed in August 2023, but it had no working rules until 13 November 2025, when MeitY notified the DPDP Rules, 2025 and started an 18-month clock. The Data Protection Board is already operating, which means an individual can file a complaint today.

The substantive obligations (notice, consent, security, breach reporting and the rights of individuals) become enforceable on 13 May 2027. In early 2026, MeitY consulted on shortening that window to 12 months; as of September 2026 the proposal had not been notified, and the faster timeline under discussion was aimed mainly at large "significant data fiduciaries". Plan for May 2027, and check again before you publish your new privacy notice.

Does this apply to a small business?

Almost certainly. The Act applies to anyone who decides why and how digital personal data is processed. The law calls you a data fiduciary. There is no blanket exemption for small businesses.

That covers a clinic booking app, a coaching institute's enquiry form, a D2C brand's checkout, a consultant's lead list and an employer's HR files. What small businesses are spared are the heavier duties of "significant data fiduciaries", such as a mandatory Data Protection Officer, which the government designates based on volume and risk.

The timeline

The five changes, in the order to make them

1. Find the data you actually hold

You cannot write an honest notice for data you have not located. Make a one-page list: every place personal data enters (website forms, WhatsApp, calls, walk-ins, payment gateway, job applications), every place it is stored (CRM, Google Sheets, email, phone contacts, accounting software) and every outside party it goes to (your web agency, email tool, payroll provider).

This list becomes your record of processing. For most small businesses it fits in a spreadsheet with 15 to 30 rows.

2. Rewrite your notice and consent

Unlike Europe's GDPR, India's law does not recognise "legitimate interest" as a general reason to process data. Consent is the default basis, and it must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action. A narrow list of "legitimate uses" (such as employment purposes or medical emergencies) covers specific situations, not marketing.

What that means on your website:

• A standalone notice at the point of collection. Not a link to a 4,000-word policy in the footer. It must say what data you collect, why, how to withdraw consent and how to complain.
• One consent per purpose. "Contact me about my enquiry" and "send me offers" are two checkboxes, both unticked by default.
• Withdrawal as easy as giving consent. If consent took one click, withdrawal should too.
• Existing lists need a notice. Data collected before the Act can continue to be processed if you send those people a compliant notice. Old "by using this site you agree" consent will not hold up.

The WhatsApp trap: a customer who messaged you about one order has not consented to your festive broadcast list. Separate your service conversations from your marketing list and record consent for the second.

3. Put basic security in place

Failing to maintain reasonable security safeguards carries the highest penalty in the law, up to ₹250 crore. For a small business, "reasonable" starts with:

• Two-factor authentication on email, CRM, cloud storage and your website admin
• Access limited by role, and removed on the day someone leaves
• No customer lists in personal WhatsApp or personal Google accounts
• Encrypted backups, and a vendor contract that makes your agency or SaaS provider responsible for its part (our maintenance retainer checklist covers what to ask for)
• Access and processing logs kept for at least one year, which the Rules set as a minimum retention period

4. Write the breach plan before you need it

If personal data is breached, you must inform affected individuals and the Data Protection Board, with a detailed report to the Board within 72 hours. There is no materiality threshold: a leaked spreadsheet of 200 customer phone numbers counts.

Write a one-page plan now: who decides a breach has happened, who informs the Board, who drafts the message to customers and what it must say (what happened, what data, likely consequences, what you have done, what they should do).

5. Handle requests and deletion

Individuals can ask to see a summary of their data, correct it, erase it, nominate someone to act for them, or withdraw consent. Publish one contact (an email address is enough) and resolve grievances within 90 days.

Once the purpose is served and no law requires you to keep the data, delete it. Tax and accounting records have their own retention rules, and where a sector regulator requires longer retention, the longer period applies.

Special cases

• Children: processing the data of anyone under 18 needs verifiable parental consent, and tracking or targeted advertising aimed at children is prohibited. Coaching institutes, schools and kids' brands should start here.
• Health data: clinics, diagnostic labs and health apps handle the most sensitive data most small businesses will ever hold. Treat steps 3 and 4 as urgent.
• Your vendors: your web agency, CRM, email tool and any AI support agent are data processors. You stay accountable for what they do, so your contracts must say what they may do with the data. A proper NDA or data clause beats a pasted template.

What it costs to ignore

These are maximums, and penalties can apply per violation. A small business will not be fined ₹250 crore. It may well face a complaint from one customer whose number ended up somewhere it should not have, and an investigation into how that happened.

The honest summary

For most small businesses, DPDP compliance is not a software purchase. It is a data list, a rewritten form, a two-checkbox consent, two-factor authentication everywhere, a one-page breach plan and one grievance email address. Done by March 2027, it costs a few days. Done after a complaint, it costs far more.