DPDP Act readiness for Indian MSMEs: a phased plan to May 2027

Background

The Digital Personal Data Protection Act, 2023 sets the rules for processing digital personal data in India. The Digital Personal Data Protection Rules, 2025 fill in the operational detail and phase the obligations in. Provisions setting up the Data Protection Board took effect on notification. Consent manager provisions follow after about a year. Most of the obligations a business will feel day to day, including notices, security safeguards, breach intimation, data principal rights and retention, apply from May 2027.

The Act does not exempt businesses by size. A clinic with patient records, a distributor with a customer list in Tally, a school with student data, a D2C brand with a Shopify or ShopenUp store and an employer running payroll all process personal data. The government can exempt certain classes of data fiduciary, including startups, from some provisions by notification, so check what has actually been notified before you rely on it.

For an MSME the hard part is finding the time and money to act on it alongside running the business.

Approach

This paper is based on analysis of public documents and the practices we use in delivery. We read the Digital Personal Data Protection Act, 2023 (India) and the Digital Personal Data Protection Rules, 2025, and where helpful the CERT-In Directions of 28 April 2022 under section 70B(6) of the Information Technology Act, 2000, which already apply to many businesses for cyber incident reporting. We then mapped those obligations to the steps we use when helping organisations prepare, including through our TrustOS platform.

Timelines are given as they stand in the Rules as notified. If the government amends them, the sequence still holds even if the dates move.

Findings

1. Most MSMEs do not know where their personal data is

Personal data in a small business is spread across Tally or another accounting system, a CRM or spreadsheet, email, WhatsApp groups, payroll files, CCTV recordings, visitor registers that later get scanned, and the systems of vendors such as payroll processors and courier companies. Without a list, no notice can be accurate and no breach can be assessed.

2. Consent is not always the right basis, and notices are often missing

The Act allows processing on consent and on certain legitimate uses, including some employment purposes and uses required by law. Many businesses either ask for consent where they do not need it or rely on it without giving the itemised notice the Act and Rules require. A clear notice in plain language, available in English and the languages your customers use, is one of the most visible things you will produce.

3. Vendors are processors, and contracts rarely say so

When a payroll provider, cloud host or marketing agency processes personal data for you, you remain responsible as the data fiduciary. Most existing vendor contracts do not cover data processing duties, security standards, breach notice or deletion at the end of the contract.

4. Security safeguards are the highest stakes item

The Act and Rules require reasonable security safeguards, and the Act's schedule sets the highest penalties, up to INR 250 crore, for failing to take them to prevent a personal data breach. The Rules describe measures such as encryption or masking, access control, logging and monitoring, and keeping logs for a minimum period. For many MSMEs the practical gaps are shared logins, no multi factor authentication, unencrypted laptops and backups, and no record of who accessed what.

5. Breach handling needs a plan before the breach

The Rules require you to tell the Data Protection Board and each affected data principal without delay, and to send the Board a detailed report within 72 hours of becoming aware of the breach. A business that has never rehearsed this will struggle to meet it while also dealing with the incident itself.

6. Rights requests need a route, even if few arrive

Data principals can ask for information about processing, correction, completion and erasure, and can nominate someone to act for them. The Rules expect you to publish how to make such requests and to respond within a set time. Volume will be low for most MSMEs, but a request with no owner will miss its deadline.

A framework

We call this Map, Notice, Secure, Respond, Prove. The five phases are sequenced for a business starting in late 2026, with a target of being ready well before May 2027.

Phase 1: Map (October to December 2026)

• List every system, file store, paper process and vendor that holds personal data.
• For each, record what data, whose data (customers, employees, patients, students, visitors), why it is held, the legal basis, who can access it and how long it is kept.
• Identify children's data, which needs verifiable parental consent, and any data sent outside India.
• Name one person who owns data protection, even part time.

Exit check: a single register the owner can read in ten minutes.

Phase 2: Notice (January to February 2027)

• Write notices for each group of data principals, itemising the data and purposes, how to withdraw consent and how to complain.
• Fix consent capture at each point: website forms, store checkout, WhatsApp opt ins, onboarding forms.
• Make withdrawal as easy as giving consent.
• Review and amend vendor contracts to cover processing instructions, security, breach notice and deletion.

Exit check: every collection point shows the right notice, and every vendor holding personal data has a signed data processing clause.

Phase 3: Secure (February to April 2027)

• Turn on multi factor authentication for email, accounting, CRM and cloud storage.
• Remove shared logins and give each person their own account with only the access they need.
• Encrypt laptops, phones used for work and backups.
• Turn on access logging and keep logs for the period the Rules require.
• Set retention rules and delete data you no longer need.

Exit check: an internal walkthrough confirms each control is on, with screenshots or exports as evidence.

Phase 4: Respond (March to April 2027)

• Write a one page breach plan: who decides, who informs the Board, who informs affected people, what template they use.
• Run a tabletop exercise with a realistic scenario, such as a lost laptop with the customer list on it.
• Set up a route for rights requests, with an owner and a log.

Exit check: the team has rehearsed a breach once and a test rights request has been handled from receipt to reply.

Phase 5: Prove (April to May 2027)

• Collect the register, notices, contracts, control evidence, breach plan and request log in one place.
• Schedule a review every six months and after any major change, such as a new system or vendor.

Exit check: you can show a customer, auditor or the Board what you do and why, within a day.

Recommendations

1. Start with Map this quarter. It is cheap, needs no tools beyond a spreadsheet, and every later phase depends on it.
2. Fix security basics early. Multi factor authentication and individual accounts cost little and address the highest risk item.
3. Use templates, then adapt. Notices and vendor clauses can start from a template. They do need to match your actual data.
4. Do not over collect. The simplest compliance step is to stop collecting data you do not use.
5. Keep it proportionate. A twenty person business does not need the programme of a bank. It needs the five phases done properly.
6. Watch for notifications. Exemptions, significant data fiduciary designations and transfer restrictions are set by government notification and can change.

Limitations

This paper interprets the Act and Rules as notified and is not legal advice. Sector rules, such as those from RBI, SEBI or IRDAI, and contractual obligations to foreign clients under other laws, may add requirements we do not cover. The phase dates assume a start in October 2026 and a business of modest complexity. A business with many systems, large volumes of sensitive data or exposure to children's data should start earlier and expect more work. We have not tested the plan across a sample of MSMEs, and the effort each phase takes will vary considerably.

Sources

• Digital Personal Data Protection Act, 2023 (India)
• Digital Personal Data Protection Rules, 2025
• Information Technology Act, 2000 (India)
• CERT-In Directions of 28 April 2022 under section 70B(6) of the Information Technology Act, 2000