The Founder’s Guide to the DPDP Act: Why You Need to Act Now

If you run a company and your website collects so much as an email address, a name or a phone number from an individual in India, you are officially in the regulatory spotlight. India’s Digital Personal Data Protection (DPDP) Act is no longer a distant legislative concept. With the DPDP Rules notified and a phased implementation timeline underway, founders can no longer afford to push data privacy compliance to the back burner.

Most substantive obligations for businesses are scheduled to come into force in May 2027. That might sound like sufficient time, but building compliant systems, redesigning consent flows and reviewing third-party integrations takes considerably longer than most founders anticipate.

DPDP Act has extraterritorial jurisdiction. If an organisation processes digital personal data outside India in connection with offering goods or services to individuals in India, it may also fall within the Act’s scope.

Whether you are a SaaS platform in Silicon Valley, an e-commerce store in London, or a domestic Indian startup, serving individuals in India can bring your data processing activities within the scope of this legislation.

Here is what you need to understand about the DPDP Act and, more importantly, how to prepare your startup.

A Strict but Necessary Global Standard

At first glance, the DPDP Act reads like a harsh regulatory hammer. With penalties reaching up to ₹250 crore (about $30 million USD) for certain security safeguard violations and ₹200 crore for mishandling children’s data or ignoring breach notifications, the consequences of non-compliance are significant.

However, looking at this purely as a punitive measure misses the broader picture.

From a data privacy perspective, the DPDP Act is a necessary modernisation of India’s digital ecosystem. It establishes digital accountability for organisations collecting and processing personal data, moving away from an environment where user information could be collected and used with limited transparency and accountability.

Ultimately, this regulation serves the larger good: protecting individuals’ personal data, give them greater control over how it is used, and ensure that organisations handling that information are accountable.

The Core Regulatory Shifts

To understand how to adapt, you have to understand how the regulation views your business.

If your organisation determines the purpose and means of processing personal data, it is generally classified as a Data Fiduciary. If you engage a third-party service provider to process personal data on your behalf, that provider may be classified as a Data Processor.

For example, if your startup stores customer information on AWS, uses an external email service to send notifications, and integrates an analytics platform, you remain responsible as the Data Fiduciary for ensuring that processing on your behalf complies with applicable requirements.

The law does not make concessions simply because your startup is small, has limited revenue or operates with a lean engineering team.

The Extraterritorial Reality

A dangerous misconception is that you are exempt if your company is not registered in India.

Under the Act, if you process digital personal data outside of India to offer goods or services to individuals within the country, you fall squarely under its jurisdiction.

This means a foreign SaaS platform or an international e-commerce storefront cannot assume that operating outside Indian jurisdiction automatically exempts it from the Act.

Consent Is Important, But It Is Not the Only Lawful Basis

Historically, startups often buried sweeping permissions inside dense Terms of Service and privacy policies.

The DPDP Act introduces a more structured approach. Where consent is the applicable ground for processing, it must specific, informed, unconditional and unambiguous. Individuals must also be able to withdraw their consent as easily as they gave it.

It is also important to understand that the Act does not make consent the universal legal basis for every processing activity. The practical takeaway is this: identify the purpose of every data processing activity and establish the appropriate lawful ground before collecting or using personal data.

Do not assume that including a broad permission in your Terms of Service automatically makes every subsequent use of customer data lawful.

Behavioural Tracking and Inferred Data

Collecting basic account information and subsequently using that information for analytics, behavioural insights or targeted recommendations requires careful consideration.

Behavioural tracking, such as analysing user interactions to understand preferences, habits or purchasing patterns, involves processing personal data where the information relates to an identifiable individual.

For a startup, this means being transparent about how user information is used. If you collect data to provide a basic service but also want to use it for analytics, advertising or other secondary purposes, you should identify and communicate those purposes appropriately and obtain consent where required.

The principle is simple: collecting data for one purpose should not become an open-ended permission to use it for everything else.

A Pragmatic Approach to Data Storage

Contrary to early fears, the DPDP Act does not mandate blanket data localisation.

It adopts a generally permissive approach to cross-border transfers. Act allows the Indian Government to restrict transfer of personal data to specified countries through notification.

This means startups can generally continue using global cloud infrastructure and services, provided their processing complies with the Act and any applicable restrictions or sector-specific requirements.

For example, payment-related data may be subject to separate localisation requirements under Reserve Bank of India regulations. Such requirements operate independently of the DPDP Act.

The important distinction is that permission to transfer data across borders does not automatically make the underlying processing lawful. You must still satisfy the applicable processing requirements.

The Cost of Non-Compliance

The DPDP Act brings severe financial consequences for ignoring its mandates. The penalties are specified in the Act and vary depending on the nature of the contravention.

Some of the maximum statutory penalties include:

• Failure to implement reasonable security safeguards: up to ₹250 crore.
• Failure to notify a data breach: up to ₹200 crore.
• Violations involving children’s data: up to ₹200 crore.

These are maximum statutory penalties, not automatic fines for every violation. The Data Protection Board considers the nature and gravity of the contravention and other relevant factors when determining penalties.

Actionable Suggestions for Startups

You do not need an enterprise-grade compliance department on day one, but you do need a systematic approach.

The objective should be to build privacy and data protection into your product roadmap rather than treating them as a last-minute exercise before a compliance deadline.

Here is how founders can start preparing:

1. Conduct a Ruthless Data Audit

Map exactly what personal data you collect, where it lives, and who can access it.

You cannot protect or delete what you do not know you have. Nothing meaningful can happen until you know what you have.

Create a simple personal data inventory covering:

• Categories of personal data collected.
• Purpose for collecting and processing each category.
• Where the data is stored.
• Internal teams and third-party services that can access it.
• How long the information needs to be retained.
• The applicable lawful ground for processing.

Include information collected through registration forms, contact forms, payment integrations, analytics tools, cookies and application logs where they contain personal data.

Start with a spreadsheet if necessary. You do not need expensive enterprise data discovery software to understand your data landscape.

2. Redesign Consent Flows and UI

Strip out unnecessary legalese.

When consent is the applicable ground, users should understand what information is being collected and why they are being asked to provide it.

The DPDP Rules require notices to be independently understandable, written in clear and plain language, and to include an itemised description of the personal data and the specific purposes of processing.

Your notice should also explain how individuals can withdraw consent and exercise their rights or raise grievances.

A lengthy privacy policy hidden in the footer is not a substitute for an appropriate notice at the point where consent is being obtained.

Design your interfaces so that:

• Consent is specific to the stated purpose.
• Different purposes are not unnecessarily bundled together.
• Optional processing is distinguishable from what is necessary to provide the requested service.
• Withdrawing consent is as straightforward as giving it.
• Users can find information about exercising their rights.

3. Establish Purpose and Retention Limits

Stop hoarding personal data just in case you might need it someday.

You should collect and process personal data only for specified purposes supported by an applicable lawful ground.

Once the purpose is no longer being served, personal data should generally be deleted unless its retention is necessary for compliance with another applicable law or another permitted basis applies.

Build retention and deletion policies into your database architecture rather than depending entirely on manual intervention.

Define:

• How long inactive user accounts are retained.
• When temporary uploads and processing files are deleted.
• How long support conversations are retained.
• What happens to customer information after account deletion.
• Which records must be retained to meet statutory or regulatory requirements.

There is an important distinction between deleting data when its purpose is fulfilled and retaining information where the law requires it.

The DPDP Rules also prescribe specific retention requirements for certain processing logs and categories of data. Your retention schedule should account for these requirements rather than implementing a blanket delete-everything policy.

4. Build a Data Breach Response Plan

A data breach is not just an information security incident. It can trigger statutory notification obligations.

If a data breach occurs, you are legally required to notify the Data Protection Board and affected users without delay, followed by a detailed report within 72 hours.

Do not wait until an incident happens to decide how to communicate with customers. Create a documented incident response plan that includes:

• Who is responsible for identifying and escalating a breach.
• How the scope and impact of an incident will be assessed.
• How affected users will be identified and notified.
• Who will communicate with the Data Protection Board.
• Templates for initial notifications and subsequent updates.
• Steps to contain the incident and prevent recurrence.

For a small startup, a straightforward, tested incident response process is far better than having no process at all.

5. Establish Grievance Redressal and User Rights Mechanisms

The Act gives individuals rights relating to their personal data, including access to information, correction, completion, updating and erasure, subject to applicable conditions.

It also requires Data Fiduciaries to establish an effective grievance redressal mechanism.

This does not mean every startup must necessarily appoint someone with the formal designation of a Grievance Officer. But someone within your organisation should own this responsibility.

Establish a visible mechanism through which users can:

• Request information about their personal data.
• Request correction of inaccurate information.
• Request erasure where applicable.
• Raise privacy-related grievances.
• Understand how and when their requests will be addressed.

Publish appropriate business contact information on your website or application. The Rules also require the contact information of the Data Protection Officer, where applicable, or another person capable of answering questions about personal data processing.

Do not treat these requests as ordinary customer support tickets that can be ignored indefinitely. They are part of your statutory responsibilities.

6. Lock Down Your Security Baseline

You are responsible for implementing reasonable security safeguards to protect personal data. For a startup, this does not necessarily mean investing in an expensive security platform. It means establishing sensible security practices from the beginning.

Start with:

• Role-based access controls and least-privilege permissions.
• Multi-factor authentication for privileged accounts.
• Logging and monitoring of access to personal data.
• Regular backups and recovery procedures.
• Secure development and deployment practices.
• Periodic access reviews and vulnerability assessments.

The DPDP Rules also specify security measures such as encryption, obfuscation, masking or tokenisation, access controls, monitoring, backups and appropriate contractual safeguards.

Remember that these obligations extend to processing undertaken on your behalf by Data Processors.

7. Review Your Third-Party Vendors and Processors

Most startups depend on external services for hosting, payments, analytics, email delivery, customer support and authentication.

These integrations often process personal data on your behalf. Using a third-party provider does not automatically transfer your data protection responsibilities to that provider.

As a Data Fiduciary, you should understand:

• What personal data each vendor receives.
• Why the vendor needs that information.
• Where the information is stored and processed.
• Whether the vendor uses the information for additional purposes.
• What security measures the vendor implements.
• How data is returned or deleted when the service relationship ends.

Review your vendor agreements and ensure appropriate contractual provisions are in place for processing personal data, including reasonable security safeguards.

A simple vendor inventory and periodic review can go a long way towards reducing unnecessary exposure.

8. Pay Special Attention to Children’s Data

If your product processes personal data belonging to individuals under 18, additional obligations apply.

The Act generally requires verifiable parental consent before processing a child’s personal data. It also restricts tracking or behavioural monitoring of children and targeted advertising directed at them.

The Rules provide certain exemptions and conditions for specified categories of Data Fiduciaries and processing activities. These are not blanket exemptions that every startup can assume will apply.

If your product is designed for children, used by children or likely to attract a significant number of under-18 users, this area deserves particular attention during product design.

9. Understand Cross-Border Data Transfers

If your startup uses AWS, Azure, Google Cloud or other international service providers, you do not necessarily need to move your entire infrastructure to India.

The DPDP Act generally permits cross-border transfers, subject to government-notified restrictions and other applicable laws. But do not confuse permission to transfer data with permission to process it without safeguards.

Ensure that your vendor arrangements, security practices and underlying processing activities comply with the applicable requirements. Also review sector-specific regulations that may impose separate data storage or localisation obligations.

The Road Ahead

The May 2027 deadline may feel distant, but retrofitting databases, reviewing vendor agreements, redesigning consent flows and implementing retention policies takes significant engineering and operational effort.

For a small startup, the sensible approach is to begin with visibility: understand what data you collect, why you collect it, where it goes and who has access to it. Then build the necessary controls into your product and operational processes.

Demonstrating responsible data practices is not just about avoiding penalties. It is about earning user trust, building reliable products and demonstrating that your startup is ready to operate in an increasingly privacy-conscious digital economy.

Privacy is no longer something you can simply document in a policy. It is something you need to engineer into your product.