Does it apply to me
Does DPDP apply to my small business?
- Short answer
- Yes. The DPDP Act has no small business exemption and no turnover or headcount threshold. If you handle the digital personal data of people in India, the baseline applies to you. Size affects how much work compliance takes, not whether the law reaches you.
The Act turns on what you do with personal data, not on how big you are. A two person firm that collects customer names and phone numbers is a Data Fiduciary in exactly the way a large company is.
What size does change is proportionality. A small business has fewer systems, fewer vendors and fewer purposes, so getting to a defensible position is genuinely quicker. It is not exempt, it is just smaller in scope.
The obligations that apply from the start are notice, a lawful basis for every purpose, reasonable security, a way to handle rights requests, a grievance route, contracts with anyone processing data for you, and a breach response.
Where this comes from
- Section 4 and Section 8, DPDP Act 2023
The mistake people make
Assuming an exemption exists because one exists in other laws. Several Indian statutes carry small business carve outs. This one does not.