Common DPDP myths for small businesses, cleared up

At a glance

The most common DPDP myths — “it’s only for big tech,” “we’re too small to count,” “our privacy policy makes us compliant,” “only Aadhaar-type data matters” — are all false. The DPDP Act applies to almost any business that handles digital personal data, there is no size-based exemption in force, and a privacy policy is not the same as meeting the Act. Here’s what’s actually true.

Educational resource only. This clears up common misconceptions about India’s Digital Personal Data Protection Act, 2023 (DPDP Act); it is not formal legal advice.

Myths about who the Act applies to

If your business collects customer or client information digitally, the Act almost certainly applies to you — size and sector don’t buy you out.

Myth: “DPDP is only for big tech and IT companies.” Reality: it applies to any organisation that decides why and how personal data is processed — a clinic, a coaching class, a real-estate agent, a boutique, a solo consultant. The label for that role is Data Fiduciary, and it has nothing to do with being a tech company.

Myth: “We’re too small to be covered.” Reality: there is no size threshold. The Act does let the government exempt certain classes — including recognised startups — from some obligations (Section 17), but no such exemption has been notified, so no business is exempt on grounds of size today. The startup relief exists on paper only.

Myth: “We only keep paper records, so we’re outside DPDP.” Reality: the Act covers digital personal data, including anything digitised from paper. The moment a form is scanned, photographed, or typed into a spreadsheet, CRM or WhatsApp, it’s in scope. Purely-paper-and-never-digitised is the rare exception, not the norm.

Myths about consent and data

Most consent and data myths come from assuming the old, looser habits still hold — they don’t.

Myth: “Only sensitive data like Aadhaar or bank details is covered.” Reality: the DPDP Act protects all personal data — names, phone numbers, email addresses, photographs — not just financial or identity documents. The old “sensitive data only” idea belonged to the previous regime; the Act replaced it with one baseline for all personal data.

Myth: “Our privacy policy makes us compliant.” Reality: a privacy policy is not a DPDP notice, and neither one, on its own, makes you compliant. The Act requires a clear, itemised notice at the point of collection, plus valid consent, security, retention limits, and the ability to honour people’s rights. A policy sitting on your website doesn’t discharge those.

Myth: “Once a customer consents, we’re covered forever.” Reality: consent is per purpose, and it can be withdrawn as easily as it was given. Use the data for a new purpose and you need fresh consent; and you must be able to prove the consent you relied on. Consent is a live obligation, not a one-time signature.

Myth: “We use Google Forms or WhatsApp, so consent is handled.” Reality: those tools collect data, but they don’t provide a compliant notice, capture purpose-bound consent, or give you a demonstrable record that consent was taken. Using them doesn’t meet the obligation by itself — the responsibility stays with you as the Data Fiduciary.

Myths about enforcement and penalties

“Nothing’s happening yet” is the most expensive myth of all — the obligations have a date, and the penalties are real.

Myth: “It’s not enforced yet, so we can ignore it.” Reality: the substantive obligations become binding on 13 May 2027, and the Data Protection Board and penalty framework are already in place. Most of these duties — compliant intake, breach response, being able to answer a rights request — take months to build, so the runway is for getting ready, not for waiting.

Myth: “Penalties only apply if we suffer a data breach.” Reality: a breach is one trigger, but failing to keep data secure is penalised on its own (up to ₹250 crore), and so are other failures — no valid consent, no notice, ignoring rights requests. You don’t need to be breached to be in breach of the Act.

Myth: “DPDP is basically GDPR — our GDPR policy covers us.” Reality: the DPDP Act shares ideas with the EU’s General Data Protection Regulation (GDPR), but it isn’t a copy. The notice rules, the treatment of data categories, children’s-data handling, and India-specific expectations differ enough that a lifted-and-shifted GDPR pack won’t cleanly meet the Act. Use it as a starting point, not a substitute.

FAQ