You're a Data Fiduciary. Here's your compliance stack.
If your startup decides what personal data to collect and why, the DPDP Act treats you as a Data Fiduciary — even before you have paying users. Appointing a Data Protection Officer is a duty only for Significant Data Fiduciaries (Section 10(2)(a)), and the criteria for that status are still pending. If under-18s could sign up, the children's-data rules add verifiable parental consent on top of your normal consent flow. You almost certainly won't register as a Consent Manager — but your consent systems should be built to work with one.
Not sure if DPDP applies to you? Take the 2-minute self-check →
Do these first. 1. Law, from 13 May 2027: when you ask people for consent, give them a notice with or before the request (Section 5(1), Rule 3). Good practice: tell people what you collect even where consent is not needed. 2. Law, from 13 May 2027: set up a way to handle complaints (Section 8(10)). 3. Good practice: map your data, how long you keep it, and where it goes. 4. Law, from 13 May 2027: tell the Board and affected users about a breach (Section 8(6), Rule 7). Good practice: write the plan now. 5. Law, only if notified as a Significant Data Fiduciary: yearly DPIA and audit (Rule 13).
Start here
DPDP Applicability & Action Check
Answer eight short questions and get a starting checklist scoped to your product and user base.
OpenDeep dives
Am I a Data Fiduciary?
You're the one deciding how user data gets processed — that's usually the trigger. Run the 2-minute self-check to see what applies to your startup.
Run it nowWritten by Sandesh Kokate, reviewed against primary sources.Connect on LinkedIn →