Do solo professionals and small businesses count as Data Fiduciaries?

At a glance

Yes. India’s DPDP Act has no size cut-off — a solo consultant, a two-person shop, or a freelancer who collects clients’ personal data is a Data Fiduciary, with the core duties. There’s no blanket “small business” exemption. What does exist is narrower: the government can notify certain classes, including recognised startups, for lighter versions of some obligations — but that’s proportional relief on specific duties, not a free pass out of the law.

Educational resource only. This explains how the DPDP Act applies to small businesses and solo professionals under India’s Digital Personal Data Protection Act, 2023 (DPDP Act); it is not formal legal advice.

The worry

Small-business owners and solo professionals often assume DPDP is a big-company problem — something for the Big Tech firms and banks, not a freelance designer or a neighbourhood clinic. It’s an understandable read, and it’s wrong in a way worth fixing early, because the duties apply to you too — just in proportion to what you actually do.

Does being small get you out of it?

No — the Data Fiduciary role turns on what you do with personal data, not how big you are. The Act defines a Fiduciary by control over the purpose and means of processing, with no minimum size, turnover, or headcount attached. So a one-person consultancy that keeps client contact details, a coaching tutor holding student records, or a boutique storing customer numbers is a Data Fiduciary in exactly the way a large company is. There’s no threshold you stay under to avoid the label.

Why even a one-person business is a Fiduciary

If you decide why you collect personal data and how you use it, the role is yours — the law cares about the decision, not the scale. A freelancer choosing to collect a client’s phone number to send invoices has decided a purpose and a means; that’s the whole test. The obligations that follow — notice, consent, security, deletion, a way to reach you — apply, sized to your operation. A solo business handling a little data does less than a large one handling a lot, but it isn’t exempt; it’s a small Fiduciary.

Is there any startup or small-business exemption?

There’s no automatic small-business carve-out — but a targeted, notified relief exists for certain classes, including recognised startups. The Act lets the central government notify specific Data Fiduciaries or classes (Section 17), including startups, for whom some provisions — such as the standalone notice requirement and certain data-accuracy and retention-timing duties — don’t apply or apply in a lighter form.

Two things to be clear-eyed about:

• It’s not self-serve. The relief applies only to classes the government actually notifies, and “startup” means an entity recognised as such under the government’s startup criteria — not just any small firm calling itself one.
• It’s partial. Even where it applies, it lightens specific obligations; it doesn’t switch off consent, security, or your accountability. The baseline duties still stand.

So “we’re a startup” or “we’re tiny” isn’t, by itself, an exemption — it may qualify you for proportional relief on some duties if your class is notified, and nothing more.

What a small Fiduciary actually needs to do

Compliance scales down with you — the point is to do the basics well, not to build a big-company programme. For most small operations, that means:

• Collect only what you need, for a clear purpose, and tell people what and why.
• Take consent you can show later — a simple record of who agreed to what.
• Keep it reasonably secure — access controls and sensible storage, proportionate to the data.
• Delete what you no longer need rather than keeping it “just in case.”
• Give people a way to reach you to ask questions, raise a grievance, or exercise a right.

Done at a small scale, this is a light routine — not a legal department. The goal is to be able to show you handle personal data responsibly, in proportion to how much you hold.

FAQ