DPDP Act for Small Business: Privacy Notice, Consent and What to Do Now

If you keep customer phone numbers on WhatsApp, an order list in Excel or patient records on a computer, India's Digital Personal Data Protection Act, 2023 (DPDP Act) applies to you. The DPDP Rules, 2025 were notified in November 2025, and most duties apply about 18 months later, around May 2027.

Your main duties

• Give a clear notice: what data you collect, why, and how people can contact you or withdraw consent.
• Get proper consent: a clear yes, never a pre-ticked box. Saying no later must be as easy as saying yes.
• Use data only for the purpose: a delivery number is not a marketing list without a separate yes.
• Keep it safe: passwords, limited access, backups and logs.
• Report breaches to the Data Protection Board and the people affected.
• Delete it when done, unless a law (like tax law) needs you to keep it.
• Answer requests to see, correct or erase data, within the time you publish.

Start with a privacy notice

Our free privacy notice generator makes a plain-English notice for your website and a short version for your counter or WhatsApp in a minute. Nothing you type is stored.

Penalties

Penalties can be very large: up to ₹250 crore for failing to keep reasonable security safeguards. Small businesses are unlikely to face the maximum, but a simple plan now avoids trouble later.

Get the full kit

The DPDP Privacy Kit has six Word templates (notices, consent wording, breach plan, vendor clauses, staff policy) and Excel registers for your data, requests and breaches, with a 10-step plan.

General information as of 2026, not legal advice. For large data volumes, children's or health data, speak to a lawyer.