Yes. The DPDP Act applies to any organization processing the digital personal data of individuals in India, regardless of its size, turnover, or employee count. There is no blanket exemption for startups or small businesses.
That said, Section 17 allows the Government to notify certain classes of Data Fiduciaries for relief from specific obligations, such as parts of the notice or retention requirements. These exemptions don't extend to core responsibilities like implementing reasonable security safeguards or reporting personal data breaches.
With the substantive provisions of the Act becoming enforceable from 13 May 2027, this is the right time for organizations of every size to establish privacy processes and prepare for compliance.
See how the miniOrange DPDP Compliance for SMBs helps organizations meet DPDP requirements.
