Industry guide
DPDP for Startups
No startup exemption notification under section 17(3) of the Act was found in the MeitY library or India Code at the 2 October 2026 check. What startups get is time: the main operational duties arrive with lead time, which rewards building the plan early.
What does the DPDP framework mean for Startups?
Being small is not by itself an exemption: section 17(3) lets the Central Government exempt notified Data Fiduciaries, startups included, from some duties, but it commences on 13 May 2027 (computed date, interpretation until officially confirmed) and no such notification was found in the MeitY library or India Code at the 2 October 2026 check. Use the lead time: settle applicability with a traceable answer, build the security floor early, and design retention and erasure timers from day 1.
How to read this page. The obligations belong to your organisation, not to a role or a sector. Everything here is practical emphasis: which official duties this audience usually leads or feeds into, with links to the official text. Finishing one function's work never makes the company compliant by itself.
Where the framework usually bites first
Applicability firstSection 3, official text →
Most Indian startups processing user data digitally will be in scope; settle that question once with a traceable answer.
Security floorRule 6, official text →
The minimum safeguards list is the cheapest to build while the product is young.
Retention from day oneRule 8, official text →
Erasure timers and log retention are far easier to design in than to retrofit.
Tools for this sector
Tool
Applicability Checker
Find out whether the DPDP framework likely applies to your organisation and processing.
Open
Tool
Compliance Plan
Generate 1 company level action plan and see the work for your role first.
Open