On this page
If you run a startup, you may have heard that the DPDP Act lets young companies off its duties. The Act has one provision that mentions startups, and it is a power the government may use. This page sets out what that power covers, which duties it could lift, which duties stay in any case, and what we have and have not seen under it. It covers the Act, the Rules and the commencement notification only. The sections on the law are cited in the Sources box. The section marked Our view is our opinion and carries no citation.
The short answer
No. The Act has no turnover, headcount or startup test. The Central Government may notify certain Data Fiduciaries, including startups, as businesses to which five named provisions do not apply. We have not seen any such notification in the texts this page relies on, and the Rules do not mention startups at all. Until a notification names your business or a class that includes it, every duty that would otherwise apply to your business still applies. The duties start on 13 May 2027.
Where the Act mentions startups
The Act has no general exemption for startups. It gives the Central Government a power, to be used having regard to the volume and nature of the personal data a business processes. The government may notify certain Data Fiduciaries or classes of Data Fiduciaries, including startups, as businesses to which a short list of provisions does not apply. Being a startup gives you nothing until that notification exists and covers you.
For this purpose the Act defines a startup as a private limited company, a partnership firm or a limited liability partnership incorporated in India, which is eligible to be, and is recognised as, a startup under the criteria and process notified by the department that handles startup matters. A sole proprietorship does not fit any of those three forms.
The five provisions a notification could lift
| What it covers | In plain words |
|---|---|
| The notice | The notice that comes with or before each request for consent |
| Accuracy | Making sure data is complete, accurate and consistent when it is likely to be used for a decision about a person, or passed to another Data Fiduciary |
| Erasure | Erasing personal data when consent is withdrawn or the purpose is no longer served, and having your Data Processor erase it too |
| Significant Data Fiduciary duties | The Data Protection Officer, the independent auditor and the impact assessments. The Significant Data Fiduciary article has the list |
| Right to information | A Data Principal’s right to a summary of the personal data processed, the processing, and who else it has been shared with |
Even a notified startup would still need a lawful purpose and consent, reasonable security safeguards, breach intimation to the Board and to each affected person, a grievance mechanism, extra care with children’s data, and a way to meet correction and erasure requests. Those provisions are not on the list.
A second power, for a limited time
Before five years from the date the Act commences, the Central Government may also declare by notification that any provision of the Act does not apply to particular Data Fiduciaries, or classes of them, for a period the notification specifies. It is not limited to startups. We have not seen a notification under it either. If one appears, it will name the provision, the businesses and the period.
Other exemptions in the Act
The Act has other exemptions, such as processing needed to enforce a legal right or claim, or processing for research, archiving or statistical purposes that is not used for any decision about a particular person and meets the standards set in the Rules. None of them turns on size or on being a startup. The applicability article sets out who the Act covers in the first place.
What this does not tell you
This page does not say whether the government will notify startups, or which ones. It does not cover startup recognition schemes, because the Act refers to them only through the department that notifies the criteria, and none of those criteria is in the texts we checked. Other laws may apply to your business as well. We did not check them. The timeline shows where each date falls.
Our view: what to do now
Our view. This is the order we would work in. Apart from the dates set out above, it makes no claim about the law.
- Plan for every duty. Plan for the case where no notification ever arrives. Work out what you would do if all of the duties applied to you on 13 May 2027.
- Check the definition once. Note whether you are a company, a partnership firm or a limited liability partnership, and whether you hold recognition as a startup. You will need both facts if a notification arrives.
- List your personal data. A short record of what you collect, why, and who else sees it is the base for the notice, the security safeguards and the breach plan.
- Watch the Gazette. Look for any notification under either power, and read which provisions, which businesses and which period it names.
Common questions
Are startups exempt from the DPDP Act?
No. The Act has no turnover, headcount or startup test. The Central Government may notify certain Data Fiduciaries or classes, including startups, as businesses to which five named provisions do not apply. Until a notification covers you, every duty that would otherwise apply to your business still applies.
What counts as a startup under the Act?
For the power to excuse startups, a private limited company, a partnership firm or a limited liability partnership incorporated in India, which is eligible to be and is recognised as a startup under the criteria and process notified by the department that handles startup matters.
Which duties could a notified startup be excused from?
The notice that goes with a consent request, making sure data is complete, accurate and consistent when it is used for a decision or passed to another Data Fiduciary, erasure when consent is withdrawn or the purpose is served, the Significant Data Fiduciary duties, and the right to information about personal data.
Do startups still have to take security safeguards and report breaches?
Yes. Security safeguards, breach intimation to the Board and to each affected person, a grievance mechanism and the rules on children’s data are not on the list a notification could lift.
Has the government notified any startup exemption?
We have not seen one in the texts this page relies on, and the Rules do not mention startups. The Act also lets the government, before five years from commencement, declare that any provision does not apply to named Data Fiduciaries for a period. Check the Gazette.
Next steps
- Check whether the DPDP Act applies to your business, free, in a few clicks
- How-to 01: Start here, in the toolkit
- How-to 02: Plan the work, in the toolkit
- The free duties list, every duty in plain words
Sources
Every section, rule and date above was checked against the official text on 7 Oct 2026.
Digital Personal Data Protection Act, 2023 (No. 22 of 2023)
Official text: the Digital Personal Data Protection Act, 2023 (MeitY, PDF)
- Section 3Application of the Act: digital personal data in India, and abroad when offering goods or services in India; no turnover, headcount or startup test
- Section 4Personal data processed only for a lawful purpose
- Section 5Notice with or before a request for consent
- Section 6(1)Consent
- Section 8(3)Completeness, accuracy and consistency of data used for a decision or shared with another Data Fiduciary
- Section 8(5)Reasonable security safeguards
- Section 8(6)Intimation of a personal data breach to the Board and each affected Data Principal
- Section 8(7)Erasure when consent is withdrawn or the purpose is no longer served, and by the Data Processor
- Section 8(10)An effective mechanism to redress grievances
- Section 9Children’s data
- Section 10Additional obligations of a Significant Data Fiduciary
- Section 11Right to obtain information about personal data
- Section 12Right to correction and erasure
- Section 13Right of grievance redressal
- Section 17(1)(a)Chapter II except 8(1) and 8(5), Chapter III and section 16 do not apply where processing is necessary for enforcing any legal right or claim
- Section 17(2)(b)Research, archiving or statistical purposes
- Section 17(3)Notified Data Fiduciaries, including startups, excused from sections 5, 8(3), 8(7), 10 and 11; meaning of startup
- Section 17(5)Within five years of commencement, any provision may be disapplied for notified Data Fiduciaries for a stated period
DPDP Rules, 2025 (G.S.R. 846(E), 13 November 2025)
- Rule 1(4)Rules 3, 5 to 16, 22 and 23 in force eighteen months from publication
- Rule 16Research, archiving or statistical purposes: standards in the Second Schedule
Notifications
Official text: commencement notification G.S.R. 843(E) (MeitY, PDF)
- G.S.R. 843(E), clause (c)Sections 3 to 5, 6 (except 6(9)), 7 to 17, 27 (except 27(1)(d)), 28 to 34, 36, 37 and 44(2) in force eighteen months from 13 November 2025
A drafting aid. Get legal advice for your situation. This article explains the published text of the Act and the Rules.
