Are you covered? The ten-minute version
No size threshold, your role, the dates and the penalties
Read this chapter
The same material as the video, step by step. Each diagram animates as you reach it.
Who is covered
If your business handles personal data in digital form, the Act applies to you. It does not ask how many staff you have or how much you earn.
Section 3 sets the scope by the kind of data and where it is processed, not by the size of the organisation. Paper records are covered once you digitise them (s.3(a)(ii)). Size matters only for the extra duties of a notified Significant Data Fiduciary (s.10) and the fixed erasure periods for very large platforms in the Third Schedule to the Rules. A possible exemption for startups under s.17(3) is covered later in this chapter.
What counts as personal data
Personal data is any data about a person who can be identified by it or in relation to it. A phone number in a spreadsheet counts, and so does a scanned admission form.
The definition is in s.2(t). The Act applies to personal data collected in digital form, or collected on paper and digitised later (s.3(a)). The exclusions are in s.3(c): personal or domestic use by an individual, and data made public by the person or under a legal obligation. The Act has no separate 'sensitive data' category, but the type and nature of the data affected is one of the factors the Board weighs when setting a penalty (s.33(2)(b)).
Fiduciary or processor: which are you?
Most businesses are Data Fiduciaries for their own customers and staff. If you only process data for a client, you are a processor for that data, and your client carries the legal duties.
A Data Fiduciary 'determines the purpose and means of processing' (s.2(i)); a Data Processor processes 'on behalf of a Data Fiduciary' (s.2(k)). A SaaS startup is usually both: a processor for the records its clients upload, and a fiduciary for its own sign-ups, leads and employees. The obligations in Chapter II of the Act are addressed to Data Fiduciaries, and s.8(1) keeps the fiduciary responsible for processing done on its behalf. As a processor, expect clients to require a valid contract (s.8(2)) with security terms (Rule 6(1)(f)), and to ask for fast breach alerts and deletion on instruction.
The dates that matter
For a small business the date to plan for is May 2027. That is when the rules on notice, security, breach reporting and people's rights begin to apply.
Rule 1 brings Rules 1, 2 and 17 to 21 into force on publication, Rule 4 one year later, and Rules 3, 5 to 16, 22 and 23 eighteen months later. Sources differ on whether the count runs from 13 or 14 November 2025, so this guide gives only the month. The sections of the Act itself are brought into force by separate Government notifications under s.1(2). In January 2026 MeitY proposed shortening the timeline to 12 months; as of November 2026 no amendment has been notified, so check for updates.
What a startup exemption could lift
The Government may exempt notified Data Fiduciaries, including startups, from five provisions. It must have regard to the volume and nature of the personal data they process.
Section 17(3) lists exactly these provisions: s.5, s.8(3), s.8(7), s.10 and s.11. For this purpose a 'startup' is a private limited company, partnership firm or limited liability partnership incorporated in India that is recognised under the criteria notified by the Government department responsible for startups. Separately, s.17(5) lets the Government, within five years of commencement, declare that any provision will not apply to certain Data Fiduciaries for a specified period.
Nothing is automatic
Startup recognition alone changes nothing under this Act. Until a notification covers your class of business, plan to meet every duty.
The Act and Rules used for this guide do not themselves exempt anyone under s.17(3); an exemption needs a separate notification. Check the Official Gazette and MeitY's website before relying on one. Even a notified business would still have to meet s.6 on consent, s.8(5) on security, s.8(6) on breach intimation, s.9 on children, s.12 on correction and erasure and s.13 on grievances, because s.17(3) does not mention them.
The top penalties
These are maximums, not fixed fines. The Board looks at how serious the breach was, what you did to limit the harm, and whether the amount is proportionate.
The amounts come from the Schedule to the Act: up to ₹250 crore for failing to take reasonable security safeguards (s.8(5)), up to ₹200 crore for not intimating a breach (s.8(6)), up to ₹200 crore for the children's data duties (s.9), and up to ₹50 crore for any other breach. The Schedule has no lower scale for small businesses. A penalty needs an inquiry, a hearing and a finding that the breach is significant (s.33(1)), and the Board must weigh the factors in s.33(2), including the likely impact of the penalty on the person. Chapter 4 returns to this.
In one line
That is the ten-minute version. Next, how to collect less data and ask for it clearly.