DPDPA Compliance for Startups — Scope and Implementation
Assess Section 3 scope, the role of each entity and applicable Section 17 exemptions. Section 17(3) permits notified exemptions, including for qualifying startups, from Section 5, Sections 8(3) and 8(7), and Sections 10 and 11; startup status alone does not confer exemption. Principal substantive duties commence on 13 May 2027.
₹250 Cr
Maximum penalty under the Schedule — same for startups and conglomerates
Section 17(3)
Notified exemptions under Section 17(3), subject to their scope and conditions
Investor Due Diligence
Funding stage is not a statutory exemption or an automatic SDF designation
DPDPA by Startup Sector
Different sectors face different risk profiles. Your compliance priorities depend on what data you process, who you share it with, and whether children are involved.
SaaS / B2B Software
Risk: HighKey Triggers
Compliance Priorities
- › Data Processing Agreements (Section 8(2))
- › Sub-processor chain audit
- › Cross-border transfer mapping (Section 16)
- › Consent collection for analytics and tracking
Fintech / Lending
Risk: CriticalKey Triggers
Compliance Priorities
- › RBI data localisation + DPDPA alignment
- › Consent for credit scoring and profiling
- › Third-party data sharing controls
- › Grievance redressal (Section 13 + RBI guidelines)
HealthTech / MedTech
Risk: CriticalKey Triggers
Compliance Priorities
- › Purpose limitation for health data
- › Consent architecture for patient data
- › Lab/diagnostic partner DPAs
- › Data retention policies for medical records
EdTech / Learning Platforms
Risk: CriticalKey Triggers
Compliance Priorities
- › Verifiable parental consent mechanisms
- › Section 9(3) advertising prohibitions
- › Student data retention limits
- › Age verification systems
D2C / E-commerce
Risk: HighKey Triggers
Compliance Priorities
- › Consent for marketing communications
- › Third-party analytics (GA, Meta Pixel) DPAs
- › Customer data deletion workflows
- › Assess cookies that process personal data under Sections 3, 4 and 6; not every cookie requires consent
AI / ML Companies
Risk: HighKey Triggers
Compliance Priorities
- › Lawful basis for training data
- › Algorithmic transparency (if SDF)
- › Consent for AI-powered personalisation
- › Data minimisation in model training
6 Mistakes Startups Make with DPDPA
Copy-pasting a GDPR privacy policy
DPDPA has distinct requirements — Section 5 notices need itemised purposes, different lawful bases, and India-specific disclosures. A GDPR policy creates a false sense of compliance.
Ignoring vendor/processor obligations
Section 8(1) makes the Data Fiduciary responsible for processing undertaken by it or on its behalf; Section 8(2) requires a valid processor contract. Without proper DPAs, your startup bears the penalty risk for vendor breaches.
Bundled consent for multiple purposes
DPDPA requires purpose-specific consent (Section 6). Bundled "I agree to everything" checkboxes are not compliant and create withdrawal complications.
No breach response plan
Section 8(6) and Rule 7 require Board notification. Without a pre-built plan, your first breach becomes a compliance disaster.
Ignoring phased commencement
The Act and final Rules are notified with phased commencement. Principal substantive duties commence on 13 May 2027; assess applicable laws already in force separately.
Assuming small size means low risk
Assess Section 3 scope, the role of each entity and applicable Section 17 exemptions. Section 17(3) permits notified exemptions, including for qualifying startups, from Section 5, Sections 8(3) and 8(7), and Sections 10 and 11; startup status alone does not confer exemption. Principal substantive duties commence on 13 May 2027.
Prioritised Compliance for Resource-Constrained Teams
Foundation
- ✓ Data inventory & flow mapping
- ✓ Privacy notice rewrite (Section 5)
- ✓ Consent mechanism audit
- ✓ Grievance contact appointment (Section 13)
Infrastructure
- ✓ Vendor DPA updates (Section 8(2))
- ✓ Breach response protocol
- ✓ Rights request workflows
- ✓ Employee data processing review
Hardening
- ✓ Consent management system deployment
- ✓ Tabletop breach simulation
- ✓ Board-readiness documentation
- ✓ Compliance audit & gap reassessment
Compliance That Fits Startup Economics
AMLEGALS offers structured engagement models designed for startups — from initial gap assessments to ongoing advisory. 28 years of legal experience, scaled for your stage.
Request a Confidential Briefing
Our data privacy counsel will reach out within one working day.
Related DPDPA Resources
DPDPA Consulting India
End-to-end compliance advisory for organisations of every size.
DPDPA Gap Assessment India
Identify where your current data practices fall short of DPDPA requirements.
Consent Manager under DPDPA
Rule 4 registration and consent-architecture guidance.
DPDPA for E-Commerce
Compliance priorities for online platforms processing consumer data.
DPDPA Implementation Partner India
Phased implementation from gap analysis to Board reporting.
DPDPA Compliance Cost India
Understand the key cost heads and complexity factors.
What practitioners and boards are asking
Does DPDPA apply to startups and small businesses?
Assess Section 3 scope, the role of each entity and applicable Section 17 exemptions. Section 17(3) permits notified exemptions, including for qualifying startups, from Section 5, Sections 8(3) and 8(7), and Sections 10 and 11; startup status alone does not confer exemption. Principal substantive duties commence on 13 May 2027. AMLEGALS offers startup scaled DPDPA engagements across SaaS, fintech, healthtech, edtech, D2C, and AI sectors.