DPDP Act Compliance for Small Businesses: Shops, Clinics, Coaching Centres and Startups

Yes, the Digital Personal Data Protection Act, 2023 applies to a small shop, clinic, coaching centre or startup if it processes personal data in digital form, such as customer phone numbers in a billing app, patient records on a laptop or a WhatsApp list of students. There is no exemption based on size or turnover; only purely personal or domestic use is outside the Act. The DPDP Rules, 2025 were notified in the Gazette on 13 November 2025, and the main duties (notice, consent, security, breach reporting, rights) apply from 13 May 2027, so this is the window to get ready.

Does DPDP really apply to a small business?

The Act calls the business a “Data Fiduciary”: anyone who decides why and how personal data is processed. Size does not matter. Some everyday examples:

• Dr Khan’s clinic in Lucknow stores patient histories and prescriptions on a computer. Covered, and health data needs extra care.
• A coaching centre in Patna collects student names, school details and parents’ numbers through a Google Form. Covered, and most students are children.
• A two-person startup in Bengaluru runs an app with sign-ups. Covered.
• A shopkeeper who writes udhaar in a paper register and never digitises it is outside the Act, because it applies to digital personal data. Once that register is photographed or typed into a spreadsheet, it is covered.

The Act does allow the Central Government to exempt certain classes of Data Fiduciaries, including startups, from some provisions by notification. Do not assume such an exemption applies to you unless it has been notified for your class.

The commencement timeline, explained

The Rules came in three phases. Rules on the Data Protection Board took effect immediately on 13 November 2025. Rules on consent managers (registered platforms through which people can give and withdraw consent) take effect 12 months later. The core obligations on businesses, covering notice, consent, security safeguards, breach intimation, children’s data and data principal rights, apply 18 months after notification, from 13 May 2027.

Changing a website, billing app, vendor contracts and staff habits takes months, so start now.

A practical DPDP checklist for small businesses

1. Map your data. List what personal data you collect (names, numbers, addresses, ID copies, health details), where it sits (phone, laptop, cloud, WhatsApp, apps) and who can see it.
2. Give a clear notice. Before or when asking for consent, tell people in plain language what data you collect, for what purpose, how they can withdraw consent, exercise their rights and complain to the Board. Withdrawal should be about as easy as giving consent. A DPDP-ready privacy policy is the usual starting point.
3. Take proper consent. Consent must be free, specific, informed, unconditional and unambiguous, by a clear affirmative action. Pre-ticked boxes and “by using this site you agree” lines will not do. Some processing is allowed without consent under “certain legitimate uses” (s.7), for example where a person voluntarily gives data for a specified purpose and has not objected.
4. Use data only for the stated purpose. If the clinic took a phone number to send appointment reminders, using it later for a festival sale campaign of a partner pharmacy needs fresh consent.
5. Put security safeguards in place. Rule 6 sets minimums: encryption, masking or similar techniques, access control, logs to detect unauthorised access, backups, and security terms in contracts with vendors (your Data Processors). In practice: two-factor login, limited staff access, no patient files on personal WhatsApp.
6. Prepare for a breach. If data is leaked or accessed without authorisation, inform affected persons and the Data Protection Board without delay, and send the Board a detailed report within 72 hours.
7. Erase when the purpose is over. Once the purpose is served and no law requires you to keep the data, delete it, and tell your vendors to delete it too.
8. Publish a grievance contact. Display the business contact details of a person who can answer questions about personal data, and set up a way to handle complaints. Requests by data principals must be answered within the time set by the Rules (up to 90 days).
9. Be careful with children’s data. A child under the Act is anyone below 18. Processing a child’s data needs verifiable consent of a parent or lawful guardian, and tracking, behavioural monitoring and targeted advertising directed at children are not allowed, subject to exemptions in the Rules (for instance, limited exemptions for educational institutions and clinical establishments).

Penalties: what is at stake

The Data Protection Board imposes penalties after an inquiry, under the Schedule to the Act. The highest is up to ₹250 crore for failing to take reasonable security safeguards to prevent a breach. Failing to notify a breach, or breaching the obligations on children’s data, can each attract up to ₹200 crore. These are maximums; the Board weighs gravity, duration, type of data, repetition and mitigation when fixing the amount.

Common mistakes small businesses make

• Copying a large company’s privacy policy that does not match what the business actually does.
• Collecting Aadhaar copies or full date of birth “just in case” when the service does not need them.
• Sharing customer lists with marketing agencies without consent or a written contract.
• Keeping old patient or student records forever on an unsecured laptop.

Who should learn DPDP now

Owners of clinics, coaching centres, shops and startups; office managers and HR staff who handle employee data; CA and CS professionals advising MSMEs; and law students and young lawyers who want a practice area with steady demand from 2027. The DPDP certificate course is a certificate of completion issued by Lexfolio; it is not a professional qualification, but it gives a structured grounding in the Act and Rules.

Frequently asked questions

Is my kirana shop covered if I take UPI payments?

If you store customer names, numbers or other personal data digitally for your business, you are a Data Fiduciary. Purely personal or domestic use is the only general exclusion.

When do I have to comply?

The main obligations on businesses apply from 13 May 2027, 18 months after the Rules were notified on 13 November 2025.

Do I need a Data Protection Officer?

A Data Protection Officer is mandatory only for Significant Data Fiduciaries notified by the government. A small business still has to publish contact details of a person who can answer data questions.

Is a coaching centre handling students’ data affected by the child rules?

Yes. Students under 18 are children under the Act, so verifiable parental consent is needed unless an exemption in the Rules applies.

Quick quiz

Sources

• Digital Personal Data Protection Act, 2023: ss.2, 3, 4, 5, 6, 7, 8, 9, 10, 17, 33 and the Schedule
• Digital Personal Data Protection Rules, 2025, notified 13 November 2025 (including rules on notice, security safeguards, breach intimation, retention and verifiable parental consent)

This page is for education and general information, not legal advice for a specific case. Law as on 29 October 2026.