DPDP for a small business: 13 November is not your deadline
For an ordinary Indian business, 13 November 2026 starts only the Consent Manager registration provisions of the Digital Personal Data Protection Act, 2023; the duties that bite, and the penalties
Summary
For an ordinary Indian business, 13 November 2026 starts only the Consent Manager registration provisions of the Digital Personal Data Protection Act, 2023; the duties that bite, and the penalties under section 33, start on 13 May 2027. That leaves about seven months, and a shop, clinic or agency needs most of them to produce two documents: a privacy notice and a list of what personal data it keeps.
The situation
A client who runs a diagnostic centre forwarded me a message last week: "DPDP penalties from November, ₹250 crore, get compliant now." A vendor had sent it with a quote for software.
Half of that message is right. The Act does apply to her; it applies to anyone who keeps a customer list, an employee file or a WhatsApp enquiry log, and there is no small-business exemption. The maximum penalties are as large as the message says. The date is wrong, and the date is what makes people buy in a panic instead of doing the work in order.
The rule
The Act was brought into force in three tranches by notification G.S.R. 843(E) of 13 November 2025, the same day the DPDP Rules, 2025 were notified:
| Date | What commences | Does it touch an ordinary business? |
|---|---|---|
| 13 Nov 2025 | Definitions, and sections 18–26 constituting the Data Protection Board; Rules 1, 2 and 17–21 | No duty yet |
| 13 Nov 2026 | Section 6(9), section 27(1)(d) and Rule 4: registration of Consent Managers | Only if you want to be a Consent Manager |
| 13 May 2027 | Sections 3–17 (notice, consent, security, breach reporting, children's data, rights), sections 28–34 including section 33 penalties and section 29 appeals; Rules 3 and 5–16 | Yes, all of it |
The penalty heads in the Schedule are large and they stack: up to ₹250 crore for failing to take reasonable security safeguards (section 8(5)), ₹200 crore for failing to notify a breach (section 8(6)), ₹200 crore on children's data (section 9), and ₹50 crore for any other breach. A child is anyone under 18.
Rule 3 says what the notice must contain: an itemised description of the personal data, the specific purpose with the goods or services it enables, and a way to withdraw consent as easily as it was given, to exercise rights, and to complain to the Board.
Where people go wrong
Treating 13 November as the penalty date. Nothing a shop or clinic must do begins that day. The risk of the wrong date is not only panic. A business that "gets compliant" in a rush in October often ends up with a consultant's template it cannot explain and a notice that describes data it does not keep.
Writing the notice first. Rule 3 wants an itemised list of the data and a purpose for each item. You cannot write that until you know what you hold, where, and why. The inventory comes first; the notice is written from it.
"As long as necessary" as a retention period. It is the commonest line in the drafts I see, and it is not a period. Pick a number of months or years for each kind of record, tied to a reason: the GST record-keeping period, a medical-records rule, a contract.
Forgetting the under-18 question. A coaching class, a clinic, a gym with teenage members: each is processing children's data, which needs verifiable parental consent and a separate ₹200 crore head.
Assuming the vendor holds the risk. Your billing software, your cloud drive and your WhatsApp Business account process data for you. The breach notice is still yours to send. Know how each vendor would tell you, and how fast.
Paying for a certificate. No certificate, registration or filing makes an ordinary business "DPDP-ready". The Act asks you to do things: keep an accurate notice, honour withdrawals and corrections, protect the data, and report a breach within the time the Rules set. A document that says you are ready is worth what the inventory behind it is worth.
What to do
- List every place you keep personal data (billing, registers, phones, spreadsheets, vendors) and, for each, what fields, why, and for how long, as a real period.
- Answer the under-18 question honestly for your customers and your staff.
- Write the Rule 3 notice from that list, with a withdrawal and complaint route a customer can actually use; a WhatsApp number or the shop address will do.
- Ask each vendor, in writing, how they would detect a breach and how quickly they must tell you.
- Diarise 13 May 2027, and spend the months before it fixing security, not buying certificates.
The tool
I kept writing the same inventory and notice for small clients by hand, so I built a free readiness kit for this tier. It asks the scope questions, scores your gaps weighted to the actual penalty heads, builds the data inventory with a CSV export, and drafts a Rule 3 notice that marks every element you have not filled in rather than printing a finished-looking document with holes. It flags a retention answer that has no period in it, and it carries the corrected phase dates. It does not certify anything, it does not read your systems (every answer is yours), and it is not sized for a business the Government may notify as a Significant Data Fiduciary; it says so and refers you out. Nothing leaves your browser.
Sources
- bylaw.in — DPDP Act, 2023 commencement map under G.S.R. 843(E), 13 November 2025 — https://bylaw.in/data-protection
- DPDP Rules, 2025 — Rule 3 (notice) — https://www.dpdpa.com/dpdparules/rule3.html
- India Briefing — DPDP Rules 2025 notified — https://www.india-briefing.com/news/dpdp-rules-2025-india-data-protection-law-compliance-40769.html/
- iSpectra — DPDP penalties (the Schedule) — https://ispectratechnologies.com/hub/dpdp/dpdp-penalties.html
- Vinsys — the November 2026 Consent Manager date — https://www.vinsys.com/blog/dpdp-act-compliance-deadline-nov-2026-for-consent-manager