Does the DPDP Act apply to your small business?

A business does not need a data centre to handle personal data. A tailoring shop may keep measurements against customer names. A mechanic may store phone numbers and vehicle histories in a billing app. A home bakery may organise orders in a spreadsheet. The practical question is what happens to information about identifiable people.

As of 22 October 2026, the DPDP scope provision and most substantive duties are scheduled for the May 2027 phase. The following assessment is a preparation exercise based on section 3 of the Act and its commencement notification. Existing obligations under other applicable law still need attention.

Start with an ordinary transaction

Choose one completed order. Trace the customer’s name, phone number, address and payment reference from collection to the last place they were used. Include the owner’s phone, the billing application, the delivery partner and a downloaded spreadsheet. Do not begin by asking whether the organisation considers itself a technology company.

If information identifies a person, directly or in relation to other data, it can be personal data. If the business processes it digitally in India, section 3’s first territorial limb is relevant. Information collected on paper and digitised later is included. A small operation is not outside the framework simply because its systems are inexpensive or informal.

The test also reaches certain processing outside India connected with offering goods or services to Data Principals within India. An overseas application selling to customers in India cannot dismiss the question merely because its servers and incorporation are elsewhere.

Four checks to put on one page

1. Identify the individual. Can the information, alone or with related records, identify a customer, employee, applicant or other person?
2. Identify the digital activity. Is it collected, stored, retrieved, shared or otherwise processed through a digital system?
3. Identify the territorial connection. Is processing in India, or connected with the specified offering of goods or services to people in India?
4. Examine a specific exclusion or exemption. Record the statutory wording and the facts that support it, rather than writing “small business” in the exemption column.

These checks help define the questions. They do not replace a legal assessment where territorial arrangements, exemptions or sector rules are complicated.

A shopkeeper’s example

Imagine a hypothetical stationery shop with five employees. Walk-in cash purchases produce anonymous sales totals. Those totals may not identify any individual. The shop also runs a school-delivery service with named parents, mobile numbers and addresses in an app. That workflow requires a separate assessment.

The owner keeps staff attendance in another application. It is personal-data processing even though the people are employees rather than customers. Section 7 contains certain employment uses, but a possible processing ground is different from being outside the Act altogether. Security, access and retention questions remain part of the preparation exercise.

Finally, the owner’s private family address book is not automatically a business record. The personal or domestic exception depends on the processing being done by an individual for that purpose. Copying it into the shop’s campaign list changes the activity being assessed.

Why “we are an MSME” is insufficient

Section 17(3) allows the Government to notify relief for certain fiduciaries or classes, including qualifying startups, from specified provisions. It is an enabling power with defined limits. It does not say that every MSME, new company or sole trader is universally exempt.

Keep a copy of any notification on which the business relies and identify precisely which provisions it covers. A registration certificate establishing startup status does not, by itself, prove every condition of a DPDP exemption. Avoid treating a consultant’s slide or a news headline as the notification.

Turn the assessment into proportionate work

A small business can begin with a modest register: workflow, data items, purpose, system, vendor, access owner and retention reason. The register need not be elaborate to reveal that three staff members share an administrator password or that former delivery agents still receive customer lists.

Prioritise the workflows with more sensitive consequences, more recipients or harder-to-control copies. A simple invoice archive and a public customer-location spreadsheet require different attention. The Act does not create the same operating model for every organisation, but business size alone cannot answer the scope question.

The useful output is a documented decision for each workflow. Mark uncertain areas for review, assign an owner and keep the evidence that supports any exception. That gives a team a practical starting point without pretending either that a small business is immune or that it must immediately build an enterprise privacy department.