--- title: "DPDP Act for Startups: What Founders Must Do | bharat.digital" description: "What the DPDP Act and DPDP Rules 2025 mean for Indian startups: consent, notices, breach reporting and the deadlines, in plain English." url: "https://bharat.digital/explainers/dpdp-act-for-startups/index.md" canonical: "https://bharat.digital/explainers/dpdp-act-for-startups/" updated: "2026-11-02T08:30:14+05:30" language: "en-IN" site: "bharat.digital" --- A bharat.digital explainer # What the DPDP Act means for startups India's data protection law is now being switched on in phases. What a young company has to do, and by when. The Digital Personal Data Protection Act, 2023 (Act 22 of 2023) received assent on 11 August 2023. It applies to digital personal data processed in India, and to processing outside India when it is connected to offering goods or services to people in India. The government notified the Digital Personal Data Protection Rules, 2025 on 13 November 2025, along with a schedule that brings the law into force in three steps. ## The timeline - **From 13 November 2025:** definitions, the Data Protection Board of India and its procedures. The Board itself was established the same day. - **One year after publication, in November 2026:** the provisions on Consent Managers, the registered entities that help people give, manage and withdraw consent. Consent Managers must be companies incorporated in India. - **Eighteen months after publication, in May 2027:** the core duties of every business that handles personal data, people's rights, and penalties. ## What you will have to do In the Act's language your company is a *Data Fiduciary* and your users are *Data Principals*. The main duties are: - **Ask properly.** Consent must be free, specific, informed, unconditional and unambiguous, given through a clear affirmative action. Each request needs a standalone notice in plain language that lists the data you collect and the purpose. - **Let people change their mind.** Withdrawing consent must be as easy as giving it. - **Use data only for the purpose given,** and erase it when that purpose is served, unless a law requires you to keep it. - **Protect it.** You must take reasonable security safeguards. The Rules expect measures such as encryption or masking, access control, logging and monitoring, with logs kept for at least one year. - **Report breaches.** Tell affected users without delay, and tell the Data Protection Board without delay, with a detailed report within 72 hours of becoming aware. - **Answer requests.** Users can ask to access, correct, update or erase their data and nominate someone to act for them. The Rules set a maximum of 90 days to respond. - **Treat children's data with care.** Anyone under 18 is a child under the Act. You need verifiable consent from a parent or lawful guardian, and tracking, behavioural monitoring and targeted advertising aimed at children are not allowed. ## Is there relief for startups? Section 17(3) lets the central government exempt some Data Fiduciaries, startups included, from the notice requirement, from parts of section 8 and from sections 10 and 11. That only applies once the government notifies which entities qualify, so check for a notification before relying on it. Larger platforms can also be named *Significant Data Fiduciaries*, with extra duties such as a Data Protection Officer in India, impact assessments and independent audits. ## What it can cost The Board can impose penalties of up to ₹250 crore for failing to take reasonable security safeguards, up to ₹200 crore for failing to report a breach or breaking the rules on children's data, and up to ₹50 crore for other breaches of the Act or Rules. Appeals go to TDSAT. ## A sensible order of work Map what personal data you hold and why. Rewrite consent notices and build a working withdrawal flow. Put security basics and logging in place. Write a breach response plan with the 72 hour deadline in mind. Set up a contact point for user requests. May 2027 is closer than it looks for a product team. ## Read the full text For every section of the Act and every rule, with the official wording, a plain English explanation and compliance countdowns, see [dpdpr.in](https://dpdpr.in/), an independent reference to the DPDP Act and Rules. Its [compliance checklist](https://dpdpr.in/guides/compliance-checklist/) and [deadlines page](https://dpdpr.in/deadlines/) follow the same official dates. ## Sources 1. [The Digital Personal Data Protection Act, 2023 (MeitY)](https://www.meity.gov.in/static/uploads/2024/06/2bf1f0e9f04e6fb4f8fef35e82c42aa5.pdf) 2. [Digital Personal Data Protection Rules, 2025, G.S.R. 846(E) (MeitY)](https://www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf) 3. [Commencement notification, G.S.R. 843(E) (Gazette of India)](https://egazette.gov.in/WriteReadData/2025/267647.pdf) 4. [PIB, Government notifies DPDP Rules, 14 November 2025](https://www.pib.gov.in/PressReleasePage.aspx?PRID=2190014) Last reviewed 29 October 2026. Written by bharat.digital from the official sources above.