Article · 10 min read

As DPDPA Kicks In, Are Startups Ready For Privacy Compliance Burden?

Shraddha Goled · Inc42 Free Intermediate India

An Inc42 feature from April 2026 on what the DPDP rollout asks of startups and small companies, with the phased dates and where practitioners say a small team should start.

  • The DPDP Rules 2025 run on an eighteen-month rollout, with consent manager obligations from November 2026 and core operational requirements from 13 May 2027.
  • The law applies uniformly, so small companies carry a heavier relative burden than large ones.
  • Suggested starting point for a small company: find and classify the personal data you hold, handle access and deletion requests, and set purpose and retention rules.
Open on inc42.com ↗

The question it answers

  1. We buy contact lists and run outbound in India. What do the DPDP rules and TRAI's spam rules change for us?

Read with it

  1. If you sell into Indian enterprises, DPDP is now part of the security review alongside SOC 2. This lays out the obligations... Wattlecorp Cybersecurity Labs Article · 16 min read What SaaS Providers Need to Know About India's Digital Personal Data Protection Act 2023 Irshad Rafeekhudheen PK
  2. The government's own plain-language backgrounder on the DPDP Act and the Rules notified in November 2025: what a data fiduciary... Press Information Bureau, Government of India Report · 7 pages DPDP Rules, 2025 Notified: A Citizen-Centric Framework for Privacy Protection and Responsible Data Use Press Information Bureau, Government of India
  3. A short news report of TRAI's February 2025 amendment to the telecom commercial communication rules, which govern every... Storyboard18 Article · 4 min read TRAI tightens rules against spam, introduces provision of stricter penalties Storyboard18
eChai Partner Brands The partnership →