Skip to main content

Guide

DPDP Act: first steps for small and mid-sized businesses

Where a small or mid-sized business should start with India's DPDP Act, 2023 and Rules, 2025: data mapping, notices, safeguards, breaches and rights.

Author
Akash Sengar
Published
5 October 2026
Reading time
2 min

By Akash Sengar · · 2 min read

What the Act covers

The Digital Personal Data Protection Act, 2023, with the Digital Personal Data Protection Rules, 2025, governs how organisations (data fiduciaries) process digital personal data in India, and outside India when it relates to offering goods or services to people in India. It gives individuals (data principals) rights and sets duties for organisations: process personal data only with valid consent or for a legitimate use, give clear notices, keep reasonable security safeguards, notify the Data Protection Board and affected people after a breach, and get verifiable parental consent for children's data. Penalties under the Act go up to ₹250 crore. The Rules commence in phases: Data Protection Board provisions from 13 November 2025, consent managers from 13 November 2026, and most duties on data fiduciaries (notices, safeguards, breach reporting, rights) from 13 May 2027. Start now; the data map alone takes months.

Six first steps

01Mapyour data02Fixnotices and consent03Putsafeguards in place04Preparefor breaches05Handlerights requests06Keepit current
Six first steps, in order. Each builds on the one before; the data map comes first because every other step depends on it.
  1. Map your data. List what personal data you hold (customers, employees, applicants, vendors), where it lives, why you hold it and who can access it. This becomes your data inventory and processing register.
  2. Fix notices and consent. For each purpose, confirm you rely on valid consent or a legitimate use. Rewrite notices in plain language. Check whether any children's data comes in.
  3. Put reasonable safeguards in place. MFA, least-privilege access, encryption, backups and logging on the systems that hold personal data.
  4. Prepare for breaches. Write down who decides, who notifies the Data Protection Board and affected people, and how. Practise it once.
  5. Handle rights requests. Publish a contact and a simple process for people to exercise their rights.
  6. Keep it current. Review the inventory, vendor contracts and retention periods as systems change.

Why this order

You can't write an accurate notice, secure the right systems or answer a rights request without knowing what data you hold and where. The data map takes the longest, but it makes every later step faster.

Who should own it

Name one person accountable for data protection, even in a small firm. They don't need to do everything themselves, but they should keep the records, track actions and be the point of contact for rights requests and incidents.

Next steps

Take our free DPDP readiness self-check to see where you stand by area, then read the DPDP standard page for what the Act and Rules ask for.

This guide is general guidance, not legal advice.

[02]Contact

Let's build what's next.

Tell us about your infrastructure, security or automation goals. We reply with questions, then a written plan with scope and next steps.

Email
info@cloudcyber.co.in
Response
Usually within one business day
Location
Worldwide

What happens next

  1. 01

    Reply

  2. 02

    Discovery call

  3. 03

    Proposal

We use these details to reply to your enquiry and, if you allowed advertising cookies, to measure which ads lead to enquiries. Our Privacy Notice explains retention and your rights.

This page is general guidance, not legal advice. Last reviewed October 2026.