DPDP Act 2023 — What Indian Startups Actually Need to Do Before 2027

Published 19 September 2026 · 8 min read · Researched by Rakesh Jaiswar, LLB student, Mumbai

India's Digital Personal Data Protection Act 2023 is not a future problem. Obligations are commencing in phases right now — and a copied Privacy Policy from 2021 does not cover what the Act actually requires. Here's what Indian startups need to have in place, plainly.

Most founders have heard of the DPDP Act. Very few have actually read it. And the most common response — "we'll deal with it when it's fully enforced" — misunderstands how phased commencement works. Several obligations are already active. Others are commencing through 2027. Waiting until everything is enforced is waiting until you're already non-compliant.

What the DPDP Act actually is — in plain terms

The Digital Personal Data Protection Act, 2023 is India's first comprehensive data protection legislation. It governs how any entity — including a startup — collects, stores, processes, and transfers personal data of Indian residents. It replaces the patchwork of data-related provisions that previously existed under the IT Act 2000 and its rules.

The commencement timeline — what's active and what's coming

The five things a startup actually needs to have in place

1. A Privacy Policy that reflects the Act — not a copied 2021 document

The DPDP Act requires a specific notice to be given to individuals before or at the time their personal data is collected. This notice must cover: what data is being collected, the purpose of processing, how the individual can exercise their rights, and how they can contact the Data Fiduciary (you). A generic Privacy Policy copied from another website — especially a foreign one — almost certainly doesn't meet these requirements. It may reference GDPR instead of the DPDP Act, name a different company in the contact details, or omit the specific rights the Act grants Indian data principals.

2. A genuine consent mechanism — not a pre-ticked box

Under Section 6 of the DPDP Act, consent must be free, specific, informed, unconditional, and unambiguous. A pre-ticked checkbox on a sign-up form is not valid consent under the Act. A buried clause in your Terms of Service is not valid consent. Consent must be given by a clear affirmative action — and you must be able to demonstrate that it was given for each specific purpose, not bundled into a single generic "I agree."

3. A Data Processing Agreement with every vendor who touches your users' data

If you use third-party services that process personal data on your behalf — a payment gateway, a cloud hosting provider, an email marketing platform, an analytics tool — those vendors are "Data Processors" under the Act, and you are the "Data Fiduciary." You are responsible for ensuring they handle data in accordance with the Act. A Data Processing Agreement (DPA) is the contractual mechanism that establishes this — it specifies what data the processor can use, for what purpose, and with what security measures.

4. A breach notification procedure

Under the DPDP Act and its Rules, a Data Fiduciary must notify the Data Protection Board and affected data principals in the event of a personal data breach. The notification timeline is tight — the draft Rules proposed a 72-hour window for initial notification to the Board, with additional information to follow. Having no documented breach response procedure means scrambling after an incident rather than responding systematically.

5. A way for users to exercise their rights

The Act gives data principals specific rights: the right to access information about their data, the right to correction, the right to erasure, and the right to nominate someone to exercise their rights in the event of death or incapacity. Your Privacy Policy must tell users how to exercise these rights, and you must have an actual mechanism to respond. An email address is sufficient for most early-stage startups — but it must be monitored, and requests must be responded to within the timeframes the Rules specify.

The penalty structure — what non-compliance actually costs

These are maximum figures — the Board is directed to consider factors including the gravity of the violation, whether it was intentional, and whether the entity took steps to mitigate harm. A first-time minor violation by a small startup is unlikely to attract the maximum. But the Act explicitly does not exempt startups from penalties on the basis of size or revenue.

What most startups are actually missing — the honest checklist

• Privacy Policy updated after August 2023 — not a pre-DPDP document
• Privacy Policy names your actual data processors (Razorpay, Netlify, etc.) specifically — not generic placeholders
• Consent mechanism on every data collection point — sign-up form, contact form, checkout
• Data Processing Agreement in place with every third-party vendor handling user data
• A documented process for responding to data principal rights requests
• A breach notification procedure — even a simple one — documented in writing
• If you have any users under 18: explicit parental consent mechanism in place
• Cross-border data transfer: confirmed that each country/vendor you transfer data to is on the permitted list (or has appropriate safeguards)

Cross-border data transfers — a specific risk for SaaS founders

If you use cloud infrastructure or SaaS tools based outside India — which almost every Indian startup does — you are transferring personal data cross-border. The DPDP Act permits this to countries notified by the Central Government as having adequate data protection standards. The list of permitted countries has not yet been fully published as of September 2026 — this is a live area to watch. In the interim, using major US and EU cloud providers (AWS, Google Cloud, Azure) through their standard DPA agreements is the most defensible position available.

Sources: Digital Personal Data Protection Act, 2023; DPDP Rules 2025 (notified); MeitY consultation documents. Penalty figures from Schedule to the DPDP Act 2023. This article reflects the position as of September 2026 — commencement notifications and Rules may be updated; verify current status before relying on specific timelines.

This article is general legal education, not advice on your specific situation. Consult an enrolled advocate for specific compliance questions.

Researched and verified by Rakesh Jaiswar, LLB student, Mumbai — 19 September 2026.