DPDP for Indian startups

The minimum programme a startup needs

None of this needs a privacy team. It needs one owner and a few hours a week until the basics are in place, then a habit of checking new features against them.

• A data map: each system, the personal data in it, the purpose, and who can reach it.
• A notice that meets Rule 3 and a consent flow where withdrawing is as easy as giving (s.6(4)).
• Processor contracts with every SaaS tool that holds user data (s.8(2)).
• Rule 6 basics: access control, masking where you can, backups, and logs kept for one year.
• A Rule 7 breach plan: who decides, who tells users, and who writes the 72-hour report to the Board.
• A published contact (Rule 9) and a grievance response period of no more than 90 days (Rule 14(3)).

Consent Managers are not on your list

Consent Managers are a separate class of company registered with the Board under Rule 4, from 13 November 2026. The application form is not published yet, and the Board has no members yet.

A cookie banner or consent tool is not a Consent Manager. Your job is to collect valid consent and honour withdrawals; the Consent Manager vs CMP guide explains the difference.

Under s.6(7), a Data Principal may give, manage, review or withdraw consent through a Consent Manager. Consenting directly to you remains possible, so build your own consent flow first.

What to do this quarter

1. 01Name one owner

   Pick one person who owns DPDP and has time for it. Publish their contact as your Rule 9 contact.

2. 02Map your data in a week

   List your product database, analytics, CRM, support desk, email tool and cloud storage. Note what personal data each holds and why.

3. 03Fix the sign-up flow

   Write a Rule 3 notice, keep marketing consent separate and unticked, and add withdrawal to account settings.

4. 04Paper your vendors

   Collect each vendor's data processing terms and check they cover security, breach reporting and deletion.

5. 05Rehearse a breach

   Walk through a leaked database: who decides it is a breach, who tells users, and who writes the report the Board needs within 72 hours.

Evidence to keep

• Consent records with the notice version, time and purpose, because s.6(10) puts the burden of proof on you.
• Each version of your notice and the date it went live.
• Signed processor contracts and your vendor list.
• Access reviews and a note of your last breach drill.
• A log of every rights request and grievance, with dates.

How TruePrivacy helps

• Consent management keeps a record per person and purpose, an event log and consent receipts; cookie consent scans your site for trackers and adds a banner with reject-all.
• Vendors and processors tracks contracts and sends assessments to your SaaS tools.
• Breach management runs the Rule 7 clocks, so a small team can see each deadline in one place.
• Pricing: Priced on scope, never per seat. Unlimited users. Quotes in INR, GST extra.