DPDP Act 2023: A Compliance Checklist for Indian SMEs

The Digital Personal Data Protection Act, 2023 changes what Indian businesses must do with personal data. Most of the coverage has focused on large enterprises, but the obligations apply to any organisation that processes digital personal data – including a 30-person manufacturing firm with a customer database.

This is a practical checklist, ordered by what to do first. It is not legal advice, and you should confirm your position with counsel. What it will do is tell you where you actually stand.

1. Work out whether you are a Data Fiduciary

Under the Act, a Data Fiduciary determines the purpose and means of processing personal data. If you decide why and how customer or employee data is collected, you are one. That is most businesses.

If you process data only on someone else’s instructions, you are a Data Processor – lighter obligations, but you still need a contract that sets out what you may and may not do.

Action: list every category of personal data you hold, where it lives, and why you have it. Most SMEs discover data in four or five places they had forgotten about.

2. Check your consent mechanism

Consent must be free, specific, informed, unconditional and unambiguous, with a clear affirmative action. Pre-ticked boxes, implied consent and bundled consent buried in terms of service do not meet that standard.

• Do you have a separate consent for marketing, distinct from consent to deliver a service?
• Can a user withdraw consent as easily as they gave it?
• Do you record when, how and for what purpose consent was obtained?

Action: audit your web forms. If consent is currently implied by submitting a form, that is your first fix.

3. Publish a clear privacy notice

The Act requires a notice in clear, plain language describing what data you collect, why, how to exercise rights, and how to complain. Many Indian SME privacy policies are copied from overseas templates and describe practices the business does not actually follow – which is worse than having none.

Action: read your own privacy policy and ask whether every statement is literally true of your operations.

4. Establish data retention and deletion

Data must not be kept longer than necessary. In practice most SMEs keep everything forever because deleting feels risky.

• Define a retention period per data category.
• Make deletion actually happen – a documented process, not a good intention.
• Remember backups: if data is deleted from production but lives in 12 monthly backups, it still exists.

5. Prepare for a breach notification

You must notify the Data Protection Board and affected individuals of a personal data breach. This is where preparation separates a controlled incident from a crisis.

Action: write a one-page breach playbook now. Who decides? Who notifies? What is the 72-hour equivalent for your organisation? Who talks to affected customers? An untested playbook found during a live breach is not a playbook.

6. Put security measures in writing

The Act requires reasonable technical and organisational safeguards. In practice, an auditor or the Board will ask you to demonstrate them.

• Access control – who can reach personal data, and is that list reviewed?
• Encryption in transit and at rest.
• Logging of access to personal data.
• Vendor contracts that impose the same obligations downstream.

7. Handle children’s data separately

Processing data of children under 18 requires verifiable parental consent and prohibits behavioural tracking and targeted advertising at children. If you run an education platform, a learning app or any product used by minors, this needs its own assessment.

Where SMEs actually get stuck

In our work the blocker is rarely the statute – it is that nobody owns the problem. Data sits in an ERP, a spreadsheet, a WhatsApp group and a marketing tool, and no single person can describe the whole picture.

Start with an inventory. Everything else follows from knowing what you hold.

What DPDP compliance actually costs an SME

This is the question nobody answers directly, so here is a straight answer. For an Indian SME with under 200 staff, first-year DPDP readiness typically falls into three buckets.

Documentation and policy work is the smallest part. A data inventory, privacy notice, consent records and a breach playbook are weeks of effort, not months, provided someone internally owns it.

Technical remediation is usually the largest line. Access control gaps, unencrypted backups and missing audit logs are common findings, and fixing them is infrastructure work with real cost.

Ongoing operation is the part most budgets forget. Consent needs to be recorded and honoured, retention needs enforcing, and rights requests need answering. A one-time project that nobody operates afterwards drifts out of compliance within a year.

The practical advice: budget for operation, not just implementation. An SME that spends heavily on a readiness project and nothing on maintaining it ends up worse off than one that built simpler controls it can actually sustain.

Common mistakes we see

1. Treating it as a legal exercise. A policy pack that describes controls the business does not run is worse than no policy, because it is actively misleading.
2. Copying a foreign privacy policy. Many Indian SME sites publish GDPR-derived text describing practices the business has never performed.
3. Forgetting employee data. HR records, payroll and CCTV footage are personal data. Most inventories start with customers and stop there.
4. Ignoring the retention problem in backups. Data deleted from production but retained in twelve monthly backups has not been deleted.
5. No named owner. Compliance without accountability decays quietly until an incident forces the issue.

How to start this quarter

You do not need a programme to begin. Four things produce most of the early value.

Week one: list every system holding personal data and who can reach it. Most SMEs find four or five they had forgotten.

Week two: read your own privacy policy line by line and mark every claim that is not literally true. That list is your remediation plan.

Week three: fix your consent capture on the forms that matter most – usually signup, contact and marketing.

Week four: write the one-page breach playbook. Who decides, who notifies, who speaks to customers.

That is a credible first quarter for an SME, and it is achievable without a consultant or new tooling.

Frequently asked questions

Does the DPDP Act apply to a small business?

Yes. There is no general small-business exemption. Certain obligations are calibrated to scale, but the core duties – lawful basis, notice, security and breach notification – apply regardless of headcount.

Do we need a Data Protection Officer?

Only Significant Data Fiduciaries must appoint one. If you are not designated as such, you still need clear internal ownership – someone accountable for data protection, even if the title is not DPO.

What happens if we do not comply?

The Act provides for financial penalties that can be substantial, and for large data breaches significantly so. Beyond penalties, the commercial risk is customer and partner audit – enterprise buyers increasingly require suppliers to demonstrate compliance.

Next step

If you are unsure where you stand, start with a data inventory and a gap assessment against the seven points above. Talk to our team about a DPDP readiness review, or call +91 97315 99227.