The DPDP Act for startups: what it asks for and where to start

This guide is for founders and engineering leads at startups that handle personal data of people in India, whether the company is based in Bengaluru or Boston. By the end you will know what the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 ask of you, which dates matter, and a sensible order of work before the main obligations apply. It reflects the position as of October 2026 and is general guidance, not legal advice.

On this page

• What the DPDP Act is and who it applies to

• The timeline: what applies and when

• What the Act asks of a Data Fiduciary

• Significant Data Fiduciaries and consent managers

• Penalties and the Data Protection Board

• A practical plan for the months before May 2027

• How NexusVoid helps

What the DPDP Act is and who it applies to

The Digital Personal Data Protection Act, 2023 is India’s first general data protection law. The Act is short and leaves much of the detail to rules, which arrived as the Digital Personal Data Protection Rules, 2025, notified by the Ministry of Electronics and Information Technology (MeitY) on 13 November 2025.

A few terms matter. A Data Principal is the person the data is about. A Data Fiduciary decides why and how personal data is processed. A Data Processor processes it on a fiduciary’s behalf. Most startups are fiduciaries for their users, customers and employees, and rely on many processors: hosting, email, analytics, support and payments.

The Act applies to digital personal data processed in India, including data collected offline and later digitized. It also reaches processing outside India connected with offering goods or services to people in India, so a US company with Indian users is in scope. It differs from GDPR in useful ways: data the person has made publicly available is excluded, there is no separate sensitive data category, and there is no general legitimate interests basis. You rely on consent or on one of the specific legitimate uses the Act lists.

The timeline: what applies and when

The Rules phase in over 18 months from notification. The obligations most startups care about are not in force yet, but the runway is shorter than it looks.

One caution. In January 2026 MeitY consulted on shortening the 18-month window to 12 months for some obligations. As of October 2026 we have not found an amendment in the Gazette, so 13 May 2027 stands. Plan as if it could move earlier, and check the Gazette before relying on any date.

What the Act asks of a Data Fiduciary

These are the core duties from May 2027. Most are good practice you would want anyway.

Notice and consent

Consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the data needed for the purpose. Pre-ticked boxes and bundled consent fail that test, and withdrawing must be as easy as giving. Your notice should stand on its own, use plain language, itemize the personal data and purpose, and explain how to withdraw consent, exercise rights and complain to the Board. Not everything needs consent: the Act lists legitimate uses, such as data a person voluntarily gives for a specific purpose, certain employment purposes, medical emergencies and legal obligations.

Retention and erasure

Use data only for the stated purpose. Erase it when that purpose is served or consent is withdrawn, unless a law requires you to keep it, and make processors erase it too. The Rules set a three-year inactivity period for certain large e-commerce, online gaming and social media platforms, with at least 48 hours’ notice before erasure.

Reasonable security safeguards

You must protect personal data in your possession or under your control, including data held by processors. The Rules list what that includes: encryption, masking or tokenization; access control; logging and monitoring to detect unauthorized access; backups; keeping relevant logs for at least a year; and contracts that bind processors to the same. This is where SOC 2 and ISO 27001 work overlaps most.

Breach notification

After a personal data breach, tell each affected person without delay, in plain language: what happened, the likely impact, what you are doing and what they can do. Tell the Board without delay too, then file a detailed report within 72 hours of becoming aware, or longer if the Board allows it on request. There is no materiality threshold, so every breach needs a decision.

Rights, children and processors

People can ask what data you hold and ask you to correct, complete, update or erase it, and can nominate someone to act for them. Publish a privacy contact and run a grievance process; the Rules expect responses within 90 days. A child is anyone under 18: you need verifiable parental consent, and may not track, behaviorally monitor or target ads at children. You remain responsible for your processors and may only engage them under a valid contract.

Significant Data Fiduciaries and consent managers

The government can designate Significant Data Fiduciaries based on factors such as the volume and sensitivity of data and the risk to people’s rights. Few early-stage startups will be designated, but enterprise customers in banking, insurance, healthcare and large consumer platforms may be, and their duties flow down to vendors. A Significant Data Fiduciary must:

• Data Protection Officer: appoint one based in India, responsible to the board of directors or similar governing body.

• Independent data auditor: appoint one to evaluate compliance.

• Annual DPIA and audit: complete both every twelve months and report key findings to the Board.

• Algorithmic due diligence: check that technical measures, including algorithmic software, are not likely to risk people’s rights.

• Localization where specified: keep categories of personal data the government specifies within India.

Consent managers are different. They are Indian companies, registered with the Board, that run platforms where people give, review and withdraw consent across many fiduciaries. Registration opens on 13 November 2026, and using one is optional. The practical point for startups: make sure your consent records could accept a withdrawal that arrives through one.

Penalties and the Data Protection Board

The Data Protection Board of India enforces the Act. It was established in law in November 2025 and is designed as a digital office, with complaints and hearings run online. It inquires into breaches and complaints, can direct urgent remedial measures and imposes penalties. Appeals go to the Telecom Disputes Settlement and Appellate Tribunal. MeitY invited applications for its Chairperson and Members in May 2026, so check whether appointments have been announced.

These are ceilings, not fixed fines. The Board weighs the nature, gravity and duration of the breach, repetition, harm and mitigation. The penalty provisions start with the main obligations in May 2027. The nearer pressure is commercial: enterprise customers already ask DPDP questions in vendor reviews.

A practical plan for the months before May 2027

About seven months remain. Here is a workable order for a small team with no privacy hire.

1. Map your personal data: each system, what fields, whose data, why you hold it and which processors touch it. A spreadsheet is fine.

2. Assign a basis to each use: consent or a named legitimate use. Drop data you cannot justify.

3. Rewrite notices and consent flows: standalone and itemized notices, unbundled consents, easy withdrawal, versioned consent records. Have a lawyer review the wording.

4. Close the security basics: encryption, least-privilege access with MFA, central logs kept for a year, tested backups, no secrets in code.

5. Write and rehearse a breach runbook: who decides, who drafts notices, how you reach users and file with the Board inside 72 hours.

6. Make rights requests workable: a published contact, an owner, identity checks and tracking against 90 days.

7. Update processor contracts with security, breach and erasure terms.

8. Set a retention schedule and automate deletion where you can.

If you already work toward SOC 2 or ISO 27001, steps 4, 5 and 7 are mostly done. Notices, consent, rights and retention are the new work.

How NexusVoid helps

NexusVoid runs your security program for you, like an autonomous CISO, and DPDP readiness comes out of that work rather than a separate project. The safeguards the Act requires are the same controls customers and auditors ask about, so we handle them once.

Aegis maps DPDP onto the same shared controls as SOC 2 and ISO 27001, tailors policies to your company, collects evidence automatically from your cloud, GitHub, identity provider and devices, and keeps your risk register and vendor list current. Argus starts from the outside like an attacker, then works inward through code, dependencies, cloud and secrets to find where personal data could leak, and opens fixes as pull requests. Striker runs a pentest when you need independent proof.

We do not write your privacy notice or give legal advice. Pair us with a lawyer for that.

Frequently asked questions

Is the DPDP Act in force yet?

Partly. It is coming into force in phases from 13 November 2025. The Data Protection Board provisions apply now, consent manager registration starts on 13 November 2026, and most obligations on businesses, including notice, consent, security, breach reporting and user rights, apply from 13 May 2027. MeitY has consulted on bringing some dates forward, so watch the Gazette.

We are a US company. Does DPDP apply to us?

If you offer goods or services to people in India and process their digital personal data, yes, even with no entity or servers in India. If your team in India processes only non-Indian residents’ data under a contract with a foreign company, a partial exemption may apply, though security duties remain. Get advice on your setup.

Does SOC 2 or ISO 27001 make us DPDP compliant?

No, but it covers a large part. Both build the security safeguards, access control, logging, vendor management and incident response DPDP expects. Neither covers consent, notices, purpose limitation, erasure or user rights the way DPDP requires. Treat those as additional controls on top of your security program.

Do we need a Data Protection Officer?

Only Significant Data Fiduciaries must appoint a Data Protection Officer based in India. Every other fiduciary must still publish contact details for someone who can answer questions about its processing. In a startup that is often a founder or engineering lead, with a shared inbox someone actually reads.

How fast must we report a breach?

Affected people and the Board must be told without delay. A detailed report to the Board is due within 72 hours of becoming aware, unless the Board allows longer on request. With no size threshold, decide in advance who assesses an incident and who files.

If you want a second opinion on where you stand against DPDP, or a plan that covers it alongside SOC 2 or ISO 27001, talk to a founder. Book a call at /contact and we will walk through your data map with you.