India's Digital Personal Data Protection Act now has operative rules and a real deadline. There is no small-business exemption, and the obligations do not transfer to your software vendor. This guide covers what the DPDP Rules 2025 actually require from the billing, CRM, HR and customer-facing software you already run — the compliance dates, the six software-level obligations, the 72-hour breach reporting rule, the one-year log retention requirement, and where the standard SME software stack falls short.
Varisya deploys self-hosted software on infrastructure you own and provides the ongoing engineering to implement access control, encryption, audit logging and erasure workflows — from ₹39,000/year.
In one paragraph
India's Digital Personal Data Protection Act applies to your business software from 14 May 2027, with no exemption for small companies. If your billing, CRM or HR system stores customer names, phone numbers or KYC documents, you are the Data Fiduciary and owe consent notices, erasure on request, breach reporting within 72 hours, and one year of retained access logs.
Two things surprise most Indian business owners when they first read this. The first is that there is no revenue or headcount threshold — a 12-person distributor running TallyPrime and a WhatsApp-based customer list is covered on exactly the same terms as a large enterprise. The second is that the obligation cannot be outsourced. Your software vendor may be a Data Processor, but your business remains the Data Fiduciary, and the accountability stays with you.
The practical consequence is that DPDP readiness is mostly an engineering project, not a documentation project. Writing a privacy notice takes an afternoon. Making your billing system able to erase a customer's personal details without destroying the GST invoice history attached to them takes considerably longer — and that is the kind of work that decides whether you are actually ready.
The Digital Personal Data Protection Act was passed in 2023, but it had no operative rules until the Ministry of Electronics and Information Technology notified the Digital Personal Data Protection Rules, 2025 in the Gazette on 14 November 2025. The Rules phase in obligations rather than switching everything on at once.
14 Nov 2025
DPDP Rules 2025 notified in the Gazette. Provisions establishing the Data Protection Board of India take effect immediately.
14 Nov 2026
Consent manager registration obligations apply. Relevant mainly to organisations operating consent management platforms.
14 May 2027
Substantive obligations apply — Rules 3 and 5 to 16, 22 and 23. Notice and consent, security safeguards, breach notification, retention limits and Data Principal rights. This is the date to plan against.
As of today that leaves under nine months. That sounds comfortable until you look at what has to change. Most growing Indian businesses are running some combination of accounting software, a spreadsheet-based customer list, a WhatsApp group where staff share customer details, and one or two SaaS tools nobody has audited. Consolidating that into systems where you can state with confidence what personal data exists, who can see it, and how it gets deleted is a multi-month programme of work — and it competes with everything else the business needs its software to do.
Worth knowing
The compliance date is not the deadline for starting. It is the date on which a regulator can hold you to a standard you must already be meeting. Businesses that begin the technical work in the last quarter before a compliance deadline typically discover that their existing software cannot do what is required at all — and replacing or re-architecting software takes longer than the time remaining.
Legal summaries of the DPDP Act tend to stay at the level of principles. Here is the same thing translated into capabilities your systems either have or do not have. Each of these is a yes-or-no question you can put to your current software today.
You cannot protect, retain or erase what you cannot locate. The first task is a complete inventory of every system holding personal data about an identifiable individual — billing software with customer names and phone numbers, CRM records, HR files containing Aadhaar or PAN copies, vendor onboarding forms with KYC documents, appointment booking records, marketing lists, WhatsApp exports, and the spreadsheets individual staff keep on their own laptops.
What we consistently see: businesses find two or three systems they had forgotten about, and the forgotten ones are almost always the least protected — an old shared drive, a departed employee's exported customer list, a form-submission inbox nobody has cleared in three years.
If your business decides why and how personal data is processed, you are the Data Fiduciary. A vendor processing data on your instructions is a Data Processor. You should have a written contract binding each processor to appropriate security obligations — but understand what that contract does and does not achieve. It gives you recourse against the vendor. It does not move your statutory accountability onto them.
A practical test: ask each SaaS vendor in writing whether they can delete an individual's personal data on request, whether they can tell you which sub-processors hold copies, and where the data physically resides. The quality of the answers is a reasonable proxy for how much control you actually have.
Every point where you collect personal data — a customer signup, a vendor onboarding portal, an appointment booking page, a feedback form — needs a clear notice stating what is being collected, the specific purpose it will be used for, and how the individual can withdraw consent or complain to the Data Protection Board of India. Consent has to be free, specific, informed, unconditional and unambiguous.
Where this typically fails: consent bundled into terms and conditions, a single checkbox covering unrelated purposes, or purposes described so broadly ("to improve our services") that they are not specific at all. If you later want to use billing data for marketing, that is a different purpose and needs its own consent.
Rule 6 of the DPDP Rules 2025 requires reasonable security safeguards, including measures such as encryption, masking or obfuscation of personal data, and controlled access. It also requires that system logs and associated traffic data be retained for at least one year to support detection, investigation and remediation of a breach.
Translated into an SME reality: one shared admin login used by six people is not controlled access. Unencrypted backups on a pen drive are not a safeguard. And if logging was never switched on, you have no way to demonstrate that a breach did not happen — which, in practice, is the position most businesses would find themselves in today.
A Data Principal — the individual whose data you hold — can ask what you have about them, ask you to correct it, and ask you to erase it. Your systems need a workable process for all three. If honouring an erasure request means a developer running a manual database query, or if deleting a customer breaks their historical invoices, you do not have a process that survives contact with real volume.
This is where the design work concentrates. Erasure has to be selective: remove the personal data you no longer have a legal basis to keep, while preserving the transaction records that GST and company law require you to retain. Most off-the-shelf software treats deletion as all-or-nothing, which makes it unusable for this purpose.
Under Rule 7, when you become aware of a personal data breach you must inform affected individuals without delay, and submit a detailed report to the Data Protection Board of India within 72 hours. The Schedule to the Act sets maximum penalties of up to ₹250 crore for failing to take reasonable security safeguards and up to ₹200 crore for failing to notify.
The hard part is not the report — it is detection. Without monitoring and alerting, most breaches are discovered weeks or months later, by which point the 72-hour clock has long expired. Decide in advance who detects, who is authorised to declare a breach, and who files. A live incident is the wrong moment to design the process.
These are the gaps that come up repeatedly when we audit the systems a growing Indian business is actually running. None of them are unusual, and none of them are anyone's fault — they are the natural result of software that was chosen to solve an operational problem years before data protection law was a consideration.
Deployment model does not determine compliance. It determines how much of the compliance work is within your control versus dependent on a vendor's roadmap. That distinction becomes material when an obligation has a deadline attached to it.
| DPDP requirement | Multi-tenant SaaS | Self-hosted (Varisya model) |
|---|---|---|
| Knowing where personal data resides | Depends on vendor disclosure; may involve sub-processors and regions you do not control | Data sits on infrastructure your business owns — you can state the location definitively |
| Selective erasure that preserves GST records | Available only if the vendor built it; feature requests join a global roadmap | Built to your specific retention rules as an engineering change |
| Audit logging with one-year retention (Rule 6) | Log access and retention window are set by the vendor's plan tier | You set the retention period and hold the logs yourself |
| Role-based access control | Usually available, though granularity varies and often sits behind a higher tier | Configured to your actual roles, not to generic templates |
| Breach detection and 72-hour reporting | You are dependent on the vendor detecting and telling you in time | Monitoring runs on your infrastructure; your engineer is the first to know |
| Producing evidence for the Data Protection Board | Requires vendor cooperation, on the vendor's timeline | You hold the systems, the logs and the configuration history |
| Exiting the vendor without losing data | Export formats and completeness are at the vendor's discretion | The data is already yours and already on your infrastructure |
To be clear about what this table is not saying: self-hosting is not a compliance shortcut, and reputable SaaS vendors serving Indian customers are building these capabilities. The honest summary is that self-hosting converts a set of vendor dependencies into a set of engineering tasks. That is an improvement only if you have someone to do the engineering — which is exactly why this tends to arrive as a support and retainer question rather than a software-purchasing question.
DPDP readiness spans legal, operational and engineering work. Varisya covers one part of that well and does not cover the rest. Here is the honest split.
Varisya fits if…
Talk to someone else if…
Varisya customises a suite of proven products — Books, Inventory, Billing, Storefront, Ecommerce, POS, Forms, Signage, Vendor Management, Invoice Designer and Sign — and deploys them self-hosted on infrastructure the client owns, white-labelled under the client's brand. Because the same annual retainer that covers implementation also covers ongoing engineering, data-protection work does not arrive as a separate quoted project.
In a typical engagement the technical work sequences roughly like this: a systems audit that produces the data inventory in step one; replacing shared logins with role-based accounts; moving personal data intake out of WhatsApp and spreadsheets into structured forms with proper consent capture, using the Forms module; configuring encrypted backups and audit logging with retention that meets the one-year expectation; then building selective erasure and data-export workflows that respect the transaction records GST and company law require you to keep. Each of those is a normal piece of retainer work rather than a change request with its own commercial negotiation.
The reason this matters commercially is straightforward. Under a project-based model, every clarification the Data Protection Board issues between now and May 2027 becomes a new scope conversation and a new quote. Under a retainer, it is Tuesday's work. Varisya's plans run from ₹39,000/year to ₹1,49,000/year, with users always unlimited rather than priced per seat — which matters here, because per-user pricing quietly discourages exactly the thing DPDP requires: giving every staff member their own account instead of sharing one login.
If you want the broader picture on how ongoing engineering support is structured, see dedicated software support and software implementation partner. If personal data is currently arriving through WhatsApp and paper forms, document workflow automation covers the structured intake side. If your existing software was built by a vendor who has since gone quiet, legacy software support is the relevant starting point — you cannot secure a system nobody currently owns.
Does the DPDP Act apply to a small business in India, or only to large companies?
It applies to small businesses too. The Digital Personal Data Protection Act 2023 and the DPDP Rules 2025 contain no revenue threshold or employee-count exemption for the core obligations — any organisation that processes the digital personal data of individuals in India is covered, whether it has five employees or five thousand. What does scale with size is the additional set of obligations placed on a Significant Data Fiduciary, a category the government notifies based on volume and sensitivity of data, which brings extra duties such as appointing a Data Protection Officer, annual data protection impact assessments, and independent audits. A typical 30-person distributor or manufacturer will not be a Significant Data Fiduciary, but it is still a Data Fiduciary and still owes notice, consent, security safeguards, breach reporting, and erasure on request.
When do we actually have to be compliant — what is the DPDP deadline?
The DPDP Rules 2025 were notified in the Gazette on 14 November 2025 and take effect in phases. The provisions establishing the Data Protection Board of India applied immediately from that date. Consent manager registration requirements apply from 14 November 2026. The substantive day-to-day obligations — notice and consent, security safeguards, breach notification, retention limits, and Data Principal rights, covered by Rules 3, 5 to 16, 22 and 23 — apply from 14 May 2027. That is the date most Indian businesses are working towards. It sounds distant, but the work that takes longest is not writing a privacy notice; it is changing software that was never designed to delete a customer record cleanly, and getting logging and access control in place across systems that currently share one admin password.
We use Tally and a few SaaS tools — is our vendor responsible for DPDP compliance, or are we?
You are. If your business decides why and how personal data is processed, you are the Data Fiduciary, and the accountability sits with you. A software vendor that handles data on your instructions is a Data Processor, and while you should have a written contract binding that processor to appropriate security obligations, the Act does not let you transfer your own liability to them. This matters practically: a SaaS vendor being ISO-certified does not make you compliant, and it does not answer questions like whether you can produce a list of every place a specific customer's phone number is stored, or whether you can erase it on request across billing, CRM and marketing lists. Those are your obligations, and they depend on how your systems are configured, not on your vendor's certifications.
What are the penalties if we get a data breach wrong under the DPDP Act?
The Schedule to the Digital Personal Data Protection Act 2023 sets maximum penalties of up to ₹250 crore for failing to take reasonable security safeguards to prevent a personal data breach, and up to ₹200 crore for failing to notify the Data Protection Board of India or affected individuals about a breach. These are statutory ceilings, not standard fines — the Board determines the actual amount considering the nature, gravity and duration of the breach, the type of data involved, whether the breach was repetitive, and what the organisation did to mitigate it. For a growing business the realistic risk is not a headline ₹250 crore penalty; it is being unable to demonstrate that any safeguards existed at all, because there were no access logs, no encryption, and no record of who could see what.
Does self-hosting our software on our own server make us DPDP compliant?
No — self-hosting does not by itself make you compliant, and anyone claiming otherwise is overselling. Compliance is a combination of policy, process and technical controls: consent notices, purpose limitation, retention rules, erasure workflows, security safeguards and breach response. Self-hosting changes one important variable, which is control. When the database sits on infrastructure your business owns, you can answer with certainty where personal data physically resides, you can enforce your own retention and deletion rules rather than waiting for a vendor's roadmap, you can switch on the logging that Rule 6 expects, and you are not dependent on a vendor's cooperation to complete a Data Principal's erasure request. With multi-tenant SaaS you often have the opposite position: the controls exist only if the vendor built them. Self-hosting makes compliance achievable; it does not deliver it.
A customer asks us to delete their data, but GST rules say we must keep invoices — which one wins?
This is the most common practical conflict, and the answer is that a legal retention obligation is a legitimate reason to retain the specific records that law requires. Indian GST law requires books and records to be retained for a defined period, and company law imposes its own retention duties. Those obligations do not disappear because a Data Principal requests erasure. What you cannot do is treat one statutory retention requirement as a blanket licence to keep everything forever. The workable approach is granular: keep the transaction records the law requires you to keep, and erase what falls outside that — marketing consent, contact records held purely for outreach, uploaded KYC documents that are no longer needed, behavioural or preference data. Most off-the-shelf systems cannot do this, because deletion is all-or-nothing and removing a customer breaks their invoice history. Making erasure selective rather than destructive is a software change, and it is one of the main reasons DPDP readiness turns into an engineering project rather than a policy document.
We do not have an in-house tech team — how do we actually implement all this?
Split the work into the part a lawyer or consultant does and the part that needs engineering. A privacy consultant or law firm should determine your role, draft your notices and consent language, and assess whether you are likely to be classified as a Significant Data Fiduciary. But the majority of the effort is engineering work inside your systems: adding consent capture to the forms you actually use, replacing shared logins with per-user accounts and role-based access, encrypting backups, switching on and retaining audit logs for at least a year, building selective erasure and data-export workflows, and setting up alerting so a breach is detected rather than discovered months later. This is ongoing work that arrives in pieces over many months, which is why it fits a dedicated engineering retainer better than a fixed-scope project — the requirements clarify as the Board issues guidance, and the software has to keep changing with them. Varisya's retainer starts at ₹39,000/year and includes the engineering capacity to do this work as part of ongoing support rather than as separately quoted change requests.
Can Varisya guarantee our business will be DPDP compliant?
No, and treat any software vendor that guarantees compliance with caution. Compliance is an organisational outcome that depends on your policies, your staff behaviour, your contracts and your legal position — not solely on software. What Varisya can do is the technical half: deploy your software self-hosted on infrastructure you own so you control where personal data lives, implement role-based access control and encryption, configure audit logging with at least one year of retention, build selective erasure and data-export capability that respects your GST and company-law retention duties, and provide the named engineer who implements changes as guidance evolves. We work alongside your legal or compliance advisor rather than replacing them. If you need a formal compliance certification or a legal opinion, you need a specialist firm, and we will tell you that rather than pretending our scope covers it.
A 30-minute scoping call. We map where personal data actually lives across your systems, which of the six software obligations your current stack can already meet, and what the technical work would involve. If your main gap is legal rather than technical, we will say so and point you to the right kind of advisor.
No checkout, no per-seat pricing. Every plan routes through a consultation.