Does DPIIT recognition give my startup any DPDP relief at all?

Not currently. Section 17(3) allows the government to exempt notified startups from parts of the Act, but no such notification has been issued. DPIIT status changes your tax and procurement treatment. Your DPDP obligations stay where they are.

Is there a turnover or employee threshold below which DPDP doesn't apply?

No. The Act and Rules set no revenue or headcount floor. The obligations that apply to a two-person company are the same baseline obligations that apply to a large enterprise.

What is a Significant Data Fiduciary and does it help small companies?

It's the opposite of relief. Section 10 lets the government notify certain Data Fiduciaries as significant based on data volume, sensitivity, and risk, which adds duties like a Data Protection Officer and regular audits. It doesn't remove any.

If the section 17(3) exemption is ever notified, what would change?

It would exempt notified startups from section 5 (notice), section 8(3) (accuracy), section 8(7) (erasure), and sections 10 and 11. Until that notification exists, none of that relief is in effect.

Since the Board can't penalise anyone until May 2027, why build compliance infrastructure now?

Because building it takes months, and enterprise customers are already asking vendors for DPDP-aligned contracts ahead of commencement. Waiting for the deadline means starting the work too late to have it ready.

DPIIT recognition does not make DPDP lighter for your startup

4 min read

dpdpstartupsdpiitcompliance

Need help with dpdp? We can handle it for you.

A founder tells us their startup is DPIIT-recognised, so DPDP applies to them in a lighter form. It's a reasonable guess. Recognition brings tax breaks, easier public procurement, and a self-certification regime under labour and environmental law. Why would data protection be any different? Because the Digital Personal Data Protection Act doesn't work that way, and the gap between the guess and the statute is worth five minutes.

The exemption exists. It has not been switched on.

Section 17(3) of the Act gives the Central Government power to notify particular Data Fiduciaries, startups named specifically among them, as exempt from five obligations: section 5 (the notice requirement), section 8(3) (keeping personal data accurate and complete), section 8(7) (erasure once the purpose is served), section 10, and section 11. That's a real, meaningful carve-out if it's ever used. Read the sentence again, though. It describes a power the government may exercise someday. It does not describe a rule already in force. As of this writing, no notification under section 17(3) has been issued.

Legal extract

The Central Government may, subject to such conditions as may be specified by it by notification, exempt the processing of personal data by any Data Fiduciary or class of Data Fiduciaries, including a startup, from the applicability of the provisions of section 5, sub-section (3) of section 8, sub-section (7) of section 8, and sections 10 and 11, having regard to the volume and nature of personal data processed.

— Section 17(3), Digital Personal Data Protection Act, 2023

This is a power sitting in the statute, waiting to be used or not used. The correct sentence for a founder is: it could happen, watch for the notification, and don't plan around it as though it already exists.

And there's no small-company exemption either

This article is general information, not legal advice. If you need advice for your specific situation, contact BuildWright directly.

From the blog

DPDP has no materiality threshold for breach notification, and that changes what "minor incident" means DPDP's staggered commencement dates: what applies when, and why the gap still matters A Consent Manager is not something your company needs to register with

Prefer to skip the paperwork?

BuildWright can take this off your plate — done properly, the first time.

Get new templates and compliance updates by email.

Claim	What the Act actually says
"We're DPIIT-recognised, so we're exempt"	s.17(3) lets the government exempt notified startups from ss.5, 8(3), 8(7), 10 and 11. No notification has been issued.
"We're too small to matter"	No turnover or headcount threshold exists anywhere in the Act or Rules.
"There must be some size-based tiering"	The only tiering mechanism is Significant Data Fiduciary status under s.10, and it adds obligations. It removes none.

DPIIT recognition does not make DPDP lighter for your startup

The exemption exists. It has not been switched on.

And there's no small-company exemption either

What a two-person company and a bank actually share

What this means for a founder building now

Frequently asked questions