DPDP Rules: A Small-Business Preparation Checklist
In this guide
India’s Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025 with staged commencement. This article is a preparation checklist; applicability depends on the processing activity, the Act, rules and relevant exemptions.
Does it apply to a small business?
Being a small business does not by itself answer whether a particular processing activity is covered. Identify the personal data you handle and review the applicable provisions and exemptions with a qualified adviser.
The timeline that matters
The notification gives immediate commencement for specified rules, one year for rule 4 and eighteen months for rules 3, 5–16, 22 and 23. Check the official commencement text alongside the Act and later notifications before setting your compliance timetable.
Seven questions for your data inventory
- What data do you collect?
- Why do you need it?
- Who receives it?
- Where is it stored?
- How long is it retained?
- Who can access it?
- Who handles requests or incidents?
This working record supports a review; it is not a complete compliance determination.
The quiet advantage of tools that do not collect data
Collecting only necessary information can reduce the data you need to manage. Local processing can avoid a file upload, but browser storage, downloads, backups, analytics and account features still need separate consideration.
Collect less, worry less
Check each tool’s processing and storage notes before using personal data. See the free tools →
This article is general information, not legal advice. For your specific obligations, consult a qualified professional.
Frequently asked questions
Does DPDP apply to a one-person business?
A one-person business should assess its processing activities under the applicable provisions and exemptions. Size alone does not settle applicability.
When are the DPDP deadlines?
The November 2025 notification stages commencement by rule. Use the official notification and subsequent amendments to identify dates relevant to your activity.
What are the penalties?
Penalty provisions depend on the breach and applicable law. Read the Act’s Schedule and obtain advice about your circumstances rather than treating a headline maximum as a standard fine.