Does your startup need to comply with the DPDP Act 2023? Yes. Here is what you must do, what most founders get wrong, and how to get compliant without a legal team or a large budget.
The short answer: yes, if you collect any personal data from Indian users.
The DPDP Act 2023 does not have a revenue threshold, employee count threshold, or startup exemption. Any entity — a two-person app startup, a bootstrapped SaaS, an early-stage EdTech — that collects name, email, phone, payment details, or any other identifier from Indian users is a Data Fiduciary under the Act.
The only potential future exception: The Central Government may notify reduced obligations for certain categories of Data Fiduciaries. Until such rules are published, all businesses should treat full compliance as the baseline.
If your startup is incorporated overseas but has Indian users (common for Singapore-incorporated or Delaware-incorporated Indian startups), the Act's extra-territorial scope still applies. Processing digital personal data of Indian residents brings you within the law's reach.
Your privacy policy must disclose: what data you collect, the purpose, how long you retain it, who you share it with (including cloud providers, analytics tools, payment processors), how users can withdraw consent, and how they can submit a data rights request. A generic policy does not meet DPDP requirements.
Time to fix: 30 minutes using CompliSeal's policy generator.
The DPDP Act requires a consent notice before collecting personal data — not just a privacy policy linked in the footer. On your sign-up form, contact form, or checkout page, users must see what data is being collected and why, before they submit. Pre-ticked checkboxes and bundled consent are invalid.
Time to fix: 1 hour — add a consent notice to your forms and install the consent banner SDK.
You must appoint a Grievance Officer and publish their name and contact details on your website. A co-founder, CTO, or any senior employee qualifies. No special certification is required. The officer must respond to complaints within 48 hours and resolve them within 7 days.
Time to fix: 15 minutes — add a section to your privacy policy and website footer.
Indian users can request to access, correct, or erase their personal data. You need a mechanism to receive and process these requests — at minimum, a dedicated email address or web form. You must acknowledge within 48 hours and complete within 7 days.
Time to fix: CompliSeal's DSAR workflow provides a public intake form, SLA tracking, and email notifications.
If your systems are breached and user data is exposed, you must notify the Data Protection Board and affected users within 72 hours. This requires knowing who to notify, what to say, and how. A one-page breach response plan and notification draft takes 30 minutes to prepare — and much longer to put together under pressure after a breach.
Time to fix: Use CompliSeal's breach response module to generate a ready-to-use notification draft.
Investor due diligence: DPDP compliance is appearing on Series A and later-stage due diligence checklists. Indian and foreign investors in data-heavy sectors (HealthTech, FinTech, EdTech) are asking for evidence of compliance. Non-compliance can delay or complicate funding rounds.
For most early-stage Indian startups, baseline DPDP compliance takes 1 to 2 working days:
Products with multiple data flows, children's features, or significant data sharing may take 1 to 2 weeks for full documentation and process implementation.
Most early-stage startups will not be designated as Significant Data Fiduciaries. SDFs face additional obligations including a resident DPO, periodic DPIA, and audit. The Central Government designates SDFs based on volume and sensitivity of data. Until you receive a designation notice, the focus should be on baseline obligations.
See exactly which DPDP checkpoints your startup is currently failing. Free scan, no credit card.
Scan My Startup's Website FreeWithout a tool, legal fees for a DPDP compliance gap assessment start at ₹75,000 to ₹3,00,000 depending on the firm. With CompliSeal:
The Pro plan covers the cost of a single legal consultation hour and provides ongoing assurance rather than a point-in-time review.