Does the DPDP Act apply to startups in India?

The question every founder asks first has a short answer with one honest caveat.

What the application section says

Section 3 of the Act applies it to the processing of digital personal data within the territory of India, whether collected in digital form or collected on paper and digitised later. It also reaches processing outside India connected to offering goods or services to people within India. The exclusions in the section are about the nature of the processing, such as purely personal or domestic use by an individual, not about the size of the organisation.

Personal data means any data about an individual who is identifiable by or in relation to that data. A startup with users, customers or employees holds exactly that.

Size does not appear in section 3

There is no revenue threshold, headcount threshold or startup exception in the application section. Nothing in the rules on file gives small companies an automatic carve out either. The Act does let the Central Government notify exemptions for classes of Data Fiduciaries in future, and that is worth watching, but an exemption that may be notified is not an exemption you hold today.

What startups actually get: time

The main operational duties in the Rules arrive with lead time: the group containing notices, security safeguards, breach intimation and retention computes to May 2027, a date that is interpretation until officially confirmed. That runway is the real startup advantage, and it rewards building the plan early while the product is still small enough to change cheaply.

What to do

Run the applicability check to settle your position with a traceable answer, then build one company plan. The startup guide shows where the framework usually bites a small company first.