Artificial Intelligence
DPDP for Small Indian Businesses Using AI Tools, Ahead of May 2027
There is no small-business exemption. A two-person firm that pastes a customer's details into a chat tool is processing personal data under the Act, the AI vendor is its processor, and from 13 May 2027 the obligations are enforceable. Seven things to have in place, none of them expensive.
By Maya Iyer · Updated · 10 min read
Short answer
Does the DPDP Act apply to a small business?
Under the Digital Personal Data Protection Act, 2023, any business that decides how personal data is processed is a Data Fiduciary, whatever its size, and the Rules notified on 13 November 2025 make the substantive obligations enforceable from 13 May 2027, with consent-manager provisions arriving on 13 November 2026. There is no exemption for small businesses; the Act lets the government exempt notified classes from some provisions, but none exists that a typical firm can rely on. An AI vendor that processes your customers' data on your instruction is a Data Processor and needs a contract; a consumer AI tier that may train on inputs is processing beyond your stated purpose. The core duties are a plain notice and a lawful basis - consent or a listed legitimate use - for each purpose, using data only for that purpose, keeping it accurate, erasing it when the purpose is served, reasonable security safeguards, a grievance contact, handling access, correction and erasure requests, verifiable parental consent for children's data, and breach notification to the Data Protection Board without delay with a detailed report within 72 hours, plus notice to affected individuals. Penalties run to Rs 250 crore for failed safeguards and Rs 200 crore for failing to notify a breach. For a small business using AI, the practical list is: know what staff paste, move it to business or API tiers with no-train terms and a processor agreement, set retention, publish a notice, name a contact, write a breach playbook with the 72-hour clock, and keep a processor list.
Our practical verdict
The privacy guide on this site told individuals that the DPDP Act gives them no enforceable remedy against an AI vendor until May 2027. This page is the other half of that fact. From the same date, a business that processes personal data - and a firm whose staff paste a customer's name, number or order into a chat tool is doing exactly that - becomes answerable for it, and there is no exemption for being small.
The structure is simple once the two roles are clear. The business that decides why and how personal data is used is the Data Fiduciary. Anyone processing it on the business's behalf, an AI vendor included, is a Data Processor, and the fiduciary answers for what the processor does. A business or API tier with no-training terms and a data processing agreement is a processor arrangement you can defend. A consumer tier that may use inputs to improve models is processing your customers' data for the vendor's own ends, which is not a purpose you told the customer about, and it is the configuration most small firms are on today.
The duties themselves are a short list. A plain notice saying what is collected and why. A lawful basis for each purpose - consent, or one of the Act's listed legitimate uses. Use limited to that purpose, accuracy where it affects a decision, and erasure when the purpose is served. Reasonable security. A published grievance contact. A way to act on requests for access, correction and erasure. Verifiable parental consent for a child's data. None of these requires a lawyer to draft, and all of them are easier before May 2027 than in the week after.
Shortlist
Recommended options to compare
Use this as a starting list, then compare live India prices and warranty before buying.
Pick 1
You are a Data Fiduciary, whatever your size
The Act applies to anyone who determines the purpose and means of processing digital personal data - a customer's name, phone number, address, order history, a candidate's CV. There is no turnover or headcount threshold. The Act does let the government exempt notified classes of fiduciary, including startups, from some provisions, but no such notification exists that a typical small business can rely on, so plan as if the full set applies. The heavier Significant Data Fiduciary duties - impact assessments, audits - do not apply to most small firms.
Pick 2
The AI vendor is your processor, and the tier decides the terms
A vendor that processes personal data on your behalf is a Data Processor, and the Act makes you responsible for what it does with the data. A business or API tier with no-training terms and a data processing agreement is a processor arrangement you can defend. A consumer tier that may use inputs to improve models is processing your customers' data for the vendor's own purposes, which is beyond the purpose you told the customer about. The privacy guide explains the tier distinction; this is the legal reason it matters.
Pick 3
The core duties, in one list
A plain-language notice saying what data is collected and why. A lawful basis for each purpose - consent, or one of the Act's legitimate uses such as employment or a purpose the person volunteered the data for. Use limited to that purpose. Accuracy where the data affects a decision about the person. Erasure once the purpose is served or consent is withdrawn. Reasonable security safeguards. A published grievance contact. A way to handle requests for access, correction, erasure and nomination. Verifiable parental consent before processing a child's data.
Pick 4
The breach clock
Under the 2025 Rules, on becoming aware of a personal data breach you must inform the Data Protection Board without delay with the nature, extent, timing and likely impact, and file a detailed report within 72 hours, or longer only if the Board allows, covering the facts, the mitigation and any findings on who was responsible. Affected individuals must be told too. A breach at your AI vendor that exposes your customers' data is your breach to report, which is why the processor contract should oblige the vendor to tell you fast.
Pick 5
The penalty schedule
Up to Rs 250 crore for failing to maintain reasonable security safeguards, up to Rs 200 crore for failing to notify a breach, up to Rs 150 crore for a Significant Data Fiduciary missing its extra duties, and lower ceilings for other breaches. The Board sets the actual amount with regard to the nature and gravity of the breach and the business's circumstances; the ceilings are not tariffs. They are also not scaled to size in the Act, which is the point of putting the list here.
Pick 6
The dates
Rules notified 13 November 2025, with the Board's constitution effective then. Consent-manager provisions from 13 November 2026. The substantive obligations - notice, consent, security, breach reporting, rights handling - enforceable from 13 May 2027, with no grace period after that date. The window between now and then is preparation time, and the seven items below fit inside it comfortably.
Pick 7
Seven things to have in place
One: an inventory of what staff paste into AI tools, which the AI at work guide explains the company can see on its own seats. Two: those workflows moved to business or API tiers with no-train terms and a processor agreement, the case the small team subscriptions guide makes on cost grounds alone. Three: a retention rule for prompts, outputs and logs, which the model deprecation guide wants for other reasons. Four: a one-page notice on the website naming purposes and the AI processing. Five: a named grievance contact. Six: a breach playbook with the 72-hour clock and the vendor's notification duty written in. Seven: a list of every processor, AI vendors included, with the country they process in, since cross-border transfer is permitted except to countries the government restricts and the list should be checked when it changes.
Which option should you choose?
You are a Data Fiduciary, whatever your size
The Act applies to anyone who determines the purpose and means of processing digital personal data - a customer's name, phone number, address, order history, a candidate's CV. There is no turnover or headcount threshold. The Act does let the government exempt notified classes of fiduciary, including startups, from some provisions, but no such notification exists that a typical small business can rely on, so plan as if the full set applies. The heavier Significant Data Fiduciary duties - impact assessments, audits - do not apply to most small firms.
The AI vendor is your processor, and the tier decides the terms
A vendor that processes personal data on your behalf is a Data Processor, and the Act makes you responsible for what it does with the data. A business or API tier with no-training terms and a data processing agreement is a processor arrangement you can defend. A consumer tier that may use inputs to improve models is processing your customers' data for the vendor's own purposes, which is beyond the purpose you told the customer about. The privacy guide explains the tier distinction; this is the legal reason it matters.
The core duties, in one list
A plain-language notice saying what data is collected and why. A lawful basis for each purpose - consent, or one of the Act's legitimate uses such as employment or a purpose the person volunteered the data for. Use limited to that purpose. Accuracy where the data affects a decision about the person. Erasure once the purpose is served or consent is withdrawn. Reasonable security safeguards. A published grievance contact. A way to handle requests for access, correction, erasure and nomination. Verifiable parental consent before processing a child's data.
The breach clock
Under the 2025 Rules, on becoming aware of a personal data breach you must inform the Data Protection Board without delay with the nature, extent, timing and likely impact, and file a detailed report within 72 hours, or longer only if the Board allows, covering the facts, the mitigation and any findings on who was responsible. Affected individuals must be told too. A breach at your AI vendor that exposes your customers' data is your breach to report, which is why the processor contract should oblige the vendor to tell you fast.
The penalty schedule
Up to Rs 250 crore for failing to maintain reasonable security safeguards, up to Rs 200 crore for failing to notify a breach, up to Rs 150 crore for a Significant Data Fiduciary missing its extra duties, and lower ceilings for other breaches. The Board sets the actual amount with regard to the nature and gravity of the breach and the business's circumstances; the ceilings are not tariffs. They are also not scaled to size in the Act, which is the point of putting the list here.
The dates
Rules notified 13 November 2025, with the Board's constitution effective then. Consent-manager provisions from 13 November 2026. The substantive obligations - notice, consent, security, breach reporting, rights handling - enforceable from 13 May 2027, with no grace period after that date. The window between now and then is preparation time, and the seven items below fit inside it comfortably.
Seven things to have in place
One: an inventory of what staff paste into AI tools, which the AI at work guide explains the company can see on its own seats. Two: those workflows moved to business or API tiers with no-train terms and a processor agreement, the case the small team subscriptions guide makes on cost grounds alone. Three: a retention rule for prompts, outputs and logs, which the model deprecation guide wants for other reasons. Four: a one-page notice on the website naming purposes and the AI processing. Five: a named grievance contact. Six: a breach playbook with the 72-hour clock and the vendor's notification duty written in. Seven: a list of every processor, AI vendors included, with the country they process in, since cross-border transfer is permitted except to countries the government restricts and the list should be checked when it changes.
Choice IQ pick
Need the faster shortlist?
Start with our recommended options, then compare the tradeoffs that matter for your budget and workflow.
See top picksHow to decide
Pick the option around the job you need done. This is the fastest way to avoid paying for something that looks impressive but does not change your real workflow.
| Situation | Best starting point | Final check |
|---|---|---|
| You are a Data Fiduciary, whatever your size | The Act applies to anyone who determines the purpose and means of processing digital personal data - a customer's name, phone number, address, order history, a candidate's CV. There is no turnover or headcount threshold. The Act does let the government exempt notified classes of fiduciary, including startups, from some provisions, but no such notification exists that a typical small business can rely on, so plan as if the full set applies. The heavier Significant Data Fiduciary duties - impact assessments, audits - do not apply to most small firms. | Use this as a shortlist, then verify the final details before committing. |
| The AI vendor is your processor, and the tier decides the terms | A vendor that processes personal data on your behalf is a Data Processor, and the Act makes you responsible for what it does with the data. A business or API tier with no-training terms and a data processing agreement is a processor arrangement you can defend. A consumer tier that may use inputs to improve models is processing your customers' data for the vendor's own purposes, which is beyond the purpose you told the customer about. The privacy guide explains the tier distinction; this is the legal reason it matters. | Use this as a shortlist, then verify the final details before committing. |
| The core duties, in one list | A plain-language notice saying what data is collected and why. A lawful basis for each purpose - consent, or one of the Act's legitimate uses such as employment or a purpose the person volunteered the data for. Use limited to that purpose. Accuracy where the data affects a decision about the person. Erasure once the purpose is served or consent is withdrawn. Reasonable security safeguards. A published grievance contact. A way to handle requests for access, correction, erasure and nomination. Verifiable parental consent before processing a child's data. | Use this as a shortlist, then verify the final details before committing. |
| The breach clock | Under the 2025 Rules, on becoming aware of a personal data breach you must inform the Data Protection Board without delay with the nature, extent, timing and likely impact, and file a detailed report within 72 hours, or longer only if the Board allows, covering the facts, the mitigation and any findings on who was responsible. Affected individuals must be told too. A breach at your AI vendor that exposes your customers' data is your breach to report, which is why the processor contract should oblige the vendor to tell you fast. | Use this as a shortlist, then verify the final details before committing. |
Read the editorial notes
The breach rule is the one with a clock. On becoming aware of a breach, the Data Protection Board must be told without delay, and a detailed report filed within 72 hours unless the Board allows longer, alongside notice to the people affected. A breach at your AI vendor that exposes your customers' data is your breach to report, which is the practical reason the processor contract should make the vendor tell you quickly. The penalty schedule behind all this runs to Rs 250 crore for failed safeguards and Rs 200 crore for failing to notify, set by the Board according to gravity and circumstance and not scaled to the size of the firm.
The dates are fixed. The Rules were notified on 13 November 2025, consent-manager provisions apply from 13 November 2026, and the substantive obligations are enforceable from 13 May 2027 with no grace period after. That leaves a window, and seven things fit inside it. Find out what staff actually paste into AI tools, which the AI at work guide notes the company can already see on its own seats. Move those workflows onto business or API tiers with no-train terms and a processor agreement, which the small team subscriptions guide argues for on cost alone. Set a retention rule for prompts, outputs and logs, which the model deprecation guide wants anyway. Put a one-page notice on the website that names the purposes and the AI processing. Name a grievance contact. Write a breach playbook with the 72-hour clock and the vendor's duty to notify in it. And keep a list of every processor, with the country each processes in, because cross-border transfer is allowed except to countries the government restricts, and that list can change.
None of this is expensive. All of it is cheaper than the first request from the Board.
Decision shortcut
Still comparing options?
Use the table above to shortlist your best fit, then check related picks, tools, and buying guides before you make the final call.
FAQ
Does the DPDP Act apply to a small business?
Yes. Any business that determines how personal data is processed is a Data Fiduciary regardless of size. The Act allows the government to exempt notified classes from some provisions, but no such exemption exists that a typical small business can rely on.
Is pasting customer data into ChatGPT or Claude a DPDP issue?
Yes. It is processing personal data, the vendor is your processor, and a consumer tier that may train on inputs uses the data for a purpose the customer was not told about. Business or API tiers with no-train terms and a processor agreement are the defensible arrangement.
When do DPDP obligations become enforceable?
The substantive obligations are enforceable from 13 May 2027, under the Rules notified on 13 November 2025. Consent-manager provisions apply from 13 November 2026. There is no grace period after May 2027.
How quickly must a data breach be reported under DPDP?
To the Data Protection Board without delay on becoming aware, with a detailed report within 72 hours unless the Board allows longer, and to affected individuals. A breach at your AI vendor involving your customers' data is yours to report.
What are the penalties under the DPDP Act?
Up to Rs 250 crore for failing security safeguards, Rs 200 crore for failing to notify a breach, and Rs 150 crore for Significant Data Fiduciary failures, with the Board setting the actual amount by gravity and circumstances. The ceilings are not scaled to business size.
Features, model access, limits, privacy controls, and India billing can change. Choice IQ evaluates practical workflow fit and recommends checking the provider's current official terms before paying.
AI Tools Editor
Maya reviews AI products, productivity systems, and automation workflows with a focus on practical adoption.
Keep reading
Related artificial intelligence picks
Artificial Intelligence
AI Agents for Indian Businesses: What Ships and What Stalls
An agent is software that takes actions, not just software that answers. That difference is where almost every pilot fails, and it fails on scoping rather than on the model.
Artificial Intelligence
Best AI Tools for Customer Support in India
A practical guide to support AI that improves response speed without trapping customers in unhelpful automation.
Artificial Intelligence
EU AI Act for Indian Businesses: What Landed in August 2026
A lot of compliance marketing has the August 2026 deadline wrong. The transparency rules landed on schedule; most high-risk obligations were pushed to 2027 and 2028.
Comparison
Claude Opus 5 vs GPT-5.6: Which Flagship Should You Pay For?
The two flagship models compared on what they cost, what they are measurably better at, and why most people should buy neither.
Tool
AI Use Case Finder
Identify a sensible first AI workflow based on your role, repeated task, and risk level.
The best choice is rarely the product with the longest feature list. It is the one you will still trust and use six months from now.
How Choice IQ evaluated this guide
Choice IQ evaluates DPDP obligations for small Indian businesses using AI by the Data Fiduciary and Data Processor roles, the absence of a size exemption, the core duties in the Act, the 2025 Rules' breach-notification clock and penalty schedule, the phased enforcement dates through 13 May 2027, and a seven-item preparation list tied to AI-tool practice.
Weekly intelligence
Get smarter AI tool picks weekly.
One useful email with practical comparisons, refresh alerts, and decision frameworks for people who do not want another noisy newsletter.