DPDP Applicability by Company Size India

Quick Answer

DPDP Applicability by Company Size India helps Indian organisations understand and meet their obligations under the Digital Personal Data Protection Act 2023. The DPDP Act applies to all organisations processing digital personal data of Indian citizens, with penalties up to ₹250 crore for violations. Enforcement is expected from May 2027 — use this tool to identify your compliance gaps and take action before the deadline.

Quick AnswerUnlike GDPR or CCPA, DPDP Act 2023 has NO revenue threshold or minimum data volume exemption. Any organisation processing personal data of Indian residents must comply — from a solo-founder startup to a multinational corporation.

DPDP Compliance Checklist

Startups (1-10 employees): DPDP applies if you collect customer email, phone, or any personal data
SMEs (11-200 employees): DPDP applies — implement consent management, privacy policy, and grievance officer
Mid-market (201-2000 employees): Full DPDP compliance required — consider DPO appointment even if not mandatory
Large enterprise (2000+ employees): Full compliance + watch for SDF designation
E-commerce/SaaS: DPDP applies from day one of collecting user data
Brick-and-mortar: DPDP applies if you collect customer data digitally (POS, loyalty apps, website)
Government/PSU: DPDP applies — government entities are data fiduciaries
NGOs/Nonprofits: DPDP applies — donor and beneficiary data is covered
Foreign companies: DPDP applies if you process Indian residents' data — even from outside India
Sole proprietors: DPDP applies if you process others' personal data for commercial purposes

Download Full Compliance Guide (Free)

Get the complete sector-specific checklist, risk areas, and 30-day action plan — delivered to your inbox.

Frequently Asked Questions

Is there a minimum company size for DPDP compliance?+

No. DPDP Act 2023 applies to all organisations processing personal data of Indian residents, regardless of size. There is no SME exemption.

Does a company with only B2B clients need DPDP compliance?+

Yes. B2B companies still process personal data of their client employees, vendor contacts, and their own staff. All this data is covered by DPDP.

What is the minimum DPDP compliance for a small startup?+

At minimum: a privacy policy, explicit consent at data collection, a grievance mechanism, and basic security measures. NitiBharat's free tools can help you start.

Related DPDP Tools

DPDP Readiness Score Privacy Gap Analysis Vendor Risk Scorecard DPDP Maturity Assessment DPA Generator DPIA Builder

Quick Answer

DPDP applicability company size India — Complete DPDP Compliance Guide

DPDP Compliance Checklist

Download Full Compliance Guide (Free)

Frequently Asked Questions

Related DPDP Tools

Need Expert DPDP Help?

The Sunday DPDP Brief