Sector guide · Startups
DPDP Act for startups
By Suryansh Sagar, founder of Gevox. Last updated 3 October 2026.
Yes. The DPDP Act applies to any startup that processes digital personal data in India, from the first signup. The Central Government may exempt notified startups from a few obligations under Section 17(3), but not from consent, security safeguards, breach intimation or grievance redressal.
From the Gevox Readiness Index: Nineteen of twenty websites of firms that sell DPDP advice load tracking or set cookies before consent.
Why it applies from day one
Section 3 applies the Act to processing of digital personal data within India. A waitlist form, an analytics tag, a signup flow and a CRM are all processing. There is no turnover threshold and no headcount threshold.
Section 17(3) lets the Central Government notify certain Data Fiduciaries, including startups, as exempt from Sections 5, 8(3), 8(7), 10 and 11. That is a power, not a default, and it leaves the consent standard, the security duty, breach intimation and grievance redressal fully in place.
The data a startup holds without noticing
Founders count customer records. The Act also counts everything the product and the website collect on the way: device identifiers and IP addresses sent to analytics and error-tracking tools, email addresses in a marketing list, phone numbers in a support inbox, CVs in a hiring pipeline, and every field a third-party form builder stores on the startup’s behalf.
The four obligations that bite first
- Consent before anything loads. Section 6 requires a clear affirmative action before processing; a banner that appears after the head of the page has fired analytics is too late.
- A notice that itemises. Section 5 and Rule 3 require a standalone notice listing the data, the purpose, the withdrawal route, the rights route and the Board complaint route. A template privacy policy rarely does this.
- A contract with every processor. Section 8(2) allows a Data Processor only under a valid contract. Every SaaS tool holding personal data is one.
- A published contact and a working grievance route. Sections 8(9) and 8(10), Rule 9 and Rule 14: a named contact on the site, a mechanism, an answer within ninety days at most.
First five actions, in order
- Run the free scan and read the consent and processor findings first.
- List every tool that touches personal data; that list is your processor register.
- Rewrite the notice to Rule 3; itemise, do not summarise.
- Fix the load order so consent comes before tracking, and make withdrawal one click.
- Publish a grievance contact and decide who answers it within what period.
Questions people ask
- We have under ten employees. Does the Act still apply?
- Yes. The Act has no size threshold. Section 17(3) allows the Government to notify startups as exempt from some provisions, but until notified nothing is switched off.
- We only use Google Analytics and a signup form. Is that processing?
- Yes. Collection, storage and sharing are all processing under Section 2, and the analytics tag shares IP addresses and device data with a third party.
- Do we need a Data Protection Officer?
- No, unless notified as a Significant Data Fiduciary under Section 10. You do need a published contact under Section 8(9).
Read next
The DPDP brief
One email a month. What moved in the Act, and what our scans found.
Every claim cited to its section, the same way these pages are. No product news, no roundups of other people’s blogs.