Startups collect personal data from day one: sign-ups, app users, payment details, analytics, job applicants and employees. Under the Digital Personal Data Protection Act, 2023 (DPDP Act) and the DPDP Rules, 2025, most of the obligations that matter to a startup apply from May 2027. That sounds distant, but building notices, consent flows, rights handling, vendor contracts and a breach plan into a fast-moving product takes time, and investors increasingly ask about it in diligence.

This DPDP compliance roadmap breaks the work into a practical 90-day plan that a startup can run with a small team, followed by the ongoing routines to keep compliance current.

Key Dates Under the DPDP Rules

Swipe the table sideways to see all columns.

The Act allows the government to exempt certain classes of Data Fiduciaries, including startups, from some provisions by notification. Check whether any such notification applies to you before relying on it; in the meantime, plan as if the obligations apply.

Before You Start: Who Is Responsible?

Your startup is usually a Data Fiduciary for its own users’ and employees’ data, because it decides why and how that data is processed. If you process data on behalf of business customers, for example as a B2B SaaS platform, you may be a Data Processor for that data, with obligations set by your customer contracts. Many startups are both, for different datasets. Getting this right shapes the rest of the plan.

Days 1–30: Foundation and Data Mapping

• Appoint an owner: name a person accountable for data protection (a founder, CTO or operations lead) and a contact for grievances.
• Inventory personal data: list every data category you collect (users, customers, leads, employees, applicants), where it comes from, where it is stored and who can access it.
• Map purposes and bases: for each processing purpose, record whether it relies on consent or a Section 7 legitimate use.
• List vendors: cloud hosting, analytics, CRM, email, payment gateways, support tools, HR and payroll platforms.
• Flag high-risk data: financial, health, children’s data, location and large-scale profiling.
• Check cross-border flows: note where data is stored or accessed outside India; transfers are generally permitted except to countries the government restricts.

Output by Day 30: a data inventory, a purpose and basis register and a vendor register.

Days 31–60: Notices, Consent, Rights and Contracts

• Rewrite notices: Rule 3 requires notices to be clear and standalone, with an itemised description of the personal data and the specified purposes, and a simple way to withdraw consent and exercise rights.
• Fix consent flows: consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action. Remove pre-ticked boxes and bundled consents.
• Make withdrawal as easy as giving consent, and make sure withdrawal actually stops processing.
• Set up rights handling: a process for access, correction, completion, updating and erasure requests, and nomination.
• Publish a grievance channel: Rule 14 requires grievances to be addressed within a reasonable period not exceeding 90 days.
• Define retention: a retention schedule by data category; under Section 8(7), erase data when the purpose is no longer served unless the law requires retention.
• Update vendor contracts: under Section 8(2), engage Data Processors only under a valid contract covering purpose, security, breach notification, sub-processing and deletion.

Output by Day 60: updated notices and consent flows, a rights and grievance procedure, a retention schedule and a contract update tracker.

Days 61–90: Security, Breach Response, Children and Training

• Security baseline: Rule 6 sets minimum measures, including encryption, masking or tokenisation, access controls, logging and monitoring, backups, log retention and contract terms with processors.
• Access review: restrict production data and admin consoles to those who need them; remove leavers promptly.
• Breach response plan: define how to detect, contain and assess a breach, and how to notify. Rule 7 requires informing affected individuals without delay and the Board without delay, with a detailed report within 72 hours of becoming aware.
• Children’s data: if under-18 users may sign up, implement age checks and verifiable parental consent under Section 9, and avoid tracking, behavioural monitoring or targeted advertising directed at children.
• Training: brief engineering, product, marketing, sales and support teams on what changes for them.
• Documentation: keep a compliance file with the inventory, registers, notices, consent records, policies, contracts and training records.

Output by Day 90: a documented security baseline, a tested breach plan, children’s data controls where relevant and a trained team.

Build Privacy Into the Product

For startups, the biggest risk is not a missing policy but a product that changes faster than compliance. Add a short privacy check to your product development process:

• Does the new feature collect new personal data?
• What is the purpose, and do we have a basis for it?
• Does the notice need updating?
• Which vendors will see the data?
• How long will it be kept, and how will it be deleted?

After Day 90: Ongoing Routines

Swipe the table sideways to see all columns.

What Investors Will Ask

Data protection is becoming a standard part of investor due diligence. Expect questions such as: what personal data do you hold, on what basis, where is it stored, who are your processors, have you had any breaches, and how do you handle user requests? A startup that can hand over its data inventory and compliance file answers in days rather than weeks.

Penalties at a Glance

The Schedule to the Act sets maximum penalties of up to ₹250 crore for failing to take reasonable security safeguards, up to ₹200 crore each for failing to notify a breach and for breaching children’s data obligations, and up to ₹50 crore for other breaches. The Data Protection Board determines the amount based on factors in the Act. More detail is in our DPDP Act penalties guide.

Frequently Asked Questions

Start Now, Finish Before May 2027

Ninety focused days can take a startup from no structure to a defensible DPDP programme. Map the data first, fix what users see, tighten security and vendors, prepare for breaches, and then keep it current with every release. Our 12-point DPDP readiness checklist is a useful self-test at the end of the 90 days.

This article provides general information and is not legal advice. DPDP interpretation is still developing; obtain advice on your specific processing.

Sources: Ministry of Electronics and Information Technology (DPDP Act, 2023 and DPDP Rules, 2025)