DPDPA Compliance for Start-ups: Key Legal Considerations for Businesses

As per the DPDPA’s definition clause, a ‘Data Principal’ is the individual whose data is processed. A ‘Data Fiduciary’ determines the purpose and means of processing, and a ‘Data Processor’ processes data on the fiduciary's behalf. The Act recognises only two lawful bases for processing personal data: if consent is given by the data principal herself or through a Consent Manager, or for certain legitimate uses. The obligations on Data Fiduciaries (DF) are broadly stated below:

• Notice and Consent: DFs must provide a standalone, clear consent notice to the principal that specifies the exact data collected, its purpose, retention period, recipients (if any), and provides information on grievance redressal mechanisms, including contact details of a Data Protection Officer. The consent obtained must be free, specific, informed, and unambiguous. The principal must be able to withdraw this consent at any time and the DF must honour the withdrawal

• Purpose Limitation and Data Minimisation: The data should be used only for the purpose for which consent was given, and only necessary data must be collec

• Storage Limits: Once the purpose is accomplished or consent is withdrawn, the data must be erased by both the DF and the processor, subject to legal retention requirements.

• Reasonable Security Measures: DFs must implement technical safeguards for stored personal data such as encryption, masking, virtual tokenisation, access controls, surveillance of computer facilities, and data backup to ensure data confidentiality, integrity, and availability. They should comply with the International Standard for data security, i.e., ISO/IEC 27001 for managing information security. DFs must also ensure that the Data Processors are equally bound by similar safeguards.

• Rights and Grievance Redressal: Principals have rights of access, correction, completion, updating and erasure. DFs must publish details of DPOs and establish adequate grievance redressal mechanisms that allow principals to lodge complaints regarding non-compliance and receive redressal within 90-day response timelines.

• Breach Notification: In case of a data breach, DFs must immediately notify the principals and the Data Protection Board of India (DPBI) specifying the nature, extent, timing, and location of the breach, and the mitigation measures being undertaken. They must also provide a comprehensive report on the breach to the DPBI within 72 hours.

Any start-up that collects data directly from users is a data fiduciary. They remain accountable for the data even if they hire third-party vendors for processing it. The phased implementation of the Act allows start-ups sufficient time to build their compliance structures. These systems cannot be meaningfully built overnight, and the penalties imposed could be fatal to a bootstrapped start-up. The DPDPA allows penalties of up to Rs. 250 crores for failing to take reasonable security safeguards and up to ₹200 crore for failing to notify a breach. Compliance carries real cost, but so does non-compliance.

Section 17(3) of the DPDPA lets the government exempt classes of fiduciaries, including start-ups, from some provisions such as notice, completeness, accuracy, consistency and erasure. However, this is not a blanket exemption, but only a discretionary power. Start-ups cannot and should not rely upon this exemption without an official notification.

The reasonable approach for start-ups at this stage is to establish a minimum viable DPDP compliance framework that addresses the highest-risk areas first and gradually scales, instead of aiming for perfect compliance from day one. The first step is to prepare a data inventory. A start-up should identify what personal data it collects, from whom, for what purposes, where it is stored, who can access it, which processors receive it, how long it is retained and when it is deleted. Every processing activity must be linked to a legal basis and a specified purpose, with an accompanying consent notice. A lengthy policy, pre-ticked boxes and bundled consents are inconsistent with the DPDPA’s consent requirements.

For data minimisation, they should examine every form, integration and APIs and check whether the data is actually needed. They must ensure that the data is not used for any unrelated purpose without fresh consent. They should build simple workflows for consent withdrawal, correction, access, erasure, and grievance redressal. They should identify a responsible person or team for handling and responding to non-compliance complaints within the applicable timeline, and publish their contact details.

Responding efficiently to a data breach would require them to preemptively prepare a practical incident-response checklist that identifies who is to be alerted, who can contain the incident, how logs are preserved and who handles regulator and customer communication. Founders should also monitor whether their sector, processing activities or data profile could bring them within the scope of an SDF notification.

• Children’s or Vulnerable Person’s Data: The DPDPA makes verifiable parental or guardian consent mandatory in cases of data processing of minors, persons with disabilities, or other vulnerable persons. It prohibits any processing likely to have a detrimental effect on their well-being, any tracking, behavioural monitoring and targeted advertisement aimed at them, and using their data in ways that manipulate or exploit them.

• Significant Data Fiduciaries: The Central Government may also notify a DF or a class of DFs as ‘Significant Data Fiduciaries’ (SDF) based on factors such as the volume and sensitivity of data processed, risk to individuals, and potential implications for public order, security, or national interests. SDFs are bound to appoint an India-based Data Protection Officer, and engage independent data auditors and conduct annual Data Protction Impact Assessments (DPIAs) that outline the purpose of processing, Data Principal rights, and a comprehensive assessment and mitigation of related risks.

The DPDP Act does not expect a start-up to run a big-company privacy programme from the first day. It does expect the fundamentals to be in place, and these take time to build. A start-up should map its data, redesign notices and consent flows, set up simple rights and grievance workflows, update vendor contracts, adopt a retention schedule, test its breach response, and name someone to own compliance. The core obligations apply from May 2027, so the months that remain are the time to do it.