Exemptions for Startups under the DPDP Act: studying regulatory sandbox environments, streamlined reporting, and phased compliance timelines

By Aditya Sharma

Abstract

The Digital Personal Data Protection Act, 2023 (“DPDP Act”) contains an express statutory hook, found in Section 17(3) read with Section 17(5), that permits the Central Government to grant startups relaxed or deferred compliance obligations. Yet more than two years after the Act received Presidential assent, and even after the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”) were notified on 13 November 2025, no dedicated startup exemption notification has been issued. This creates a compliance paradox: founders are told, correctly, that a startup carve-out exists in the statute, while simultaneously being warned, equally correctly, that no such carve-out currently operates in practice. This article maps the statutory architecture of Section 17, distinguishes it from the general applicability exclusions in Section 3, examines the phased implementation timeline under the DPDP Rules, and sets out a compliance roadmap that founders can follow without relying on an exemption that has not yet materialised.

I. Legal Framework: Where the “Startup Exemption” Actually Lives

Public discourse around a supposed “DPDP startup exemption” tends to conflate two structurally different provisions, and the distinction matters for compliance planning.

A. Section 3: Applicability, Not Exemption

Section 3 of the DPDP Act defines the outer boundary of the statute’s applicability. It excludes personal data processed for purely personal or domestic purposes and data that has been made publicly available by the data principal or under a legal obligation. This is not a startup-specific concession; it is a threshold question of whether the Act applies at all, and it applies identically to a two-person incorporated entity and a listed conglomerate.

B. Section 17(3): The Startup-Specific Hook

The operative provision is Section 17(3), which empowers the Central Government to exempt a Data Fiduciary, or a class of Data Fiduciaries, including startups, from specified obligations under the Act, having regard to the volume and nature of personal data processed. The provision carries its own statutory definition of “startup”: a private limited company, partnership firm, or limited liability partnership incorporated in India that is recognised as a startup under the criteria notified by the department administering startup recognition, in practice the Department for Promotion of Industry and Internal Trade (DPIIT).

Two features of this drafting are significant for advisory work. First, the exemption is discretionary and conditional on a future notification; the statute does not self-execute a carve-out merely because an entity holds DPIIT recognition. Second, the exemption is scoped to “volume and nature” of processing, which signals that even a future notification is unlikely to be a blanket exemption and will more plausibly track thresholds of data scale, sensitivity, or user count.

C. Section 17(5): The Sunset-Bound General Power

A separate and broader power under Section 17(5) allows the Central Government, within five years of the Act’s commencement, to notify that any provision shall not apply to a Data Fiduciary or class of Data Fiduciaries for a specified period. Advisory commentary has noted that industry bodies, including payment platforms and voice-technology companies, have invoked this provision to seek relief for specific processing activities such as AI model training, illustrating that Section 17(5) is being used as a general innovation-relief valve rather than a startup-only mechanism.

It is this discretionary, class-based framing that distinguishes a genuine startup exemption from the enforcement discretion the Data Protection Board already exercises. The Act’s Schedule sets graded penalty ceilings, running as high as two hundred fifty crore rupees for failures of reasonable security safeguards and two hundred crore rupees for breach-notification or children’s-data failures, with a general ceiling of fifty crore rupees for other contraventions. Nothing in this penalty structure is currently modified for startups; the ceilings apply identically regardless of the Data Fiduciary’s size, and any reduction for a resource-constrained entity would have to come either from a Section 17(3) notification or from the Board’s discretionary assessment of proportionate penalties, not from the Schedule itself.

D. Constitutional Foundations: Puttaswamy and the Proportionality Standard

The entire DPDP framework, including the discretion the executive holds under Section 17, operates within a constitutional ceiling set by the Supreme Court in K.S. Puttaswamy v. Union of India, (2017) 10 SCC 1, which recognised privacy as a fundamental right under Article 21 and required any state intrusion into that right to satisfy a four-fold proportionality test: legality, legitimate aim, necessity, and procedural safeguards. A subsequent nine-judge and later five-judge continuation of that litigation, commonly cited as the Aadhaar judgment, Justice K.S. Puttaswamy (Retd.) v. Union of India, (2019) 1 SCC 1, applied this standard to a large-scale data-processing programme and remains the leading authority on balancing state and commercial data use against individual privacy.

This matters directly for the Section 17(3) exemption analysis. Any future notification exempting startups from specific obligations, most plausibly notice, consent friction, or breach-reporting formalities, will itself need to satisfy the Puttaswamy proportionality standard if challenged, since a broad or poorly reasoned exemption could be characterised as diluting statutory safeguards without a legitimate, necessity-tested justification. Drafting counsel advising the Government or industry bodies on the scope of a startup notification should therefore frame submissions in proportionality terms: a narrowly tailored exemption tied to demonstrable data volume or risk thresholds is far more defensible than a size-based blanket carve-out.

II. The Compliance Timeline: What Is Actually in Force

Advisory work in this space cannot rest on the text of the Act alone; the DPDP Rules, 2025 govern when and how each obligation bites, and the schedule is central to any startup-exemption analysis.

The Rules were notified on 13 November 2025 vide G.S.R. 846(E), under Section 40 of the Act, alongside a separate commencement notification, G.S.R. 843(E), issued the same day under Section 1(2) of the Act, and a further notification establishing the Data Protection Board of India. Rules 1, 2, and 17 to 21, covering preliminary matters and the constitution of the Data Protection Board, came into force immediately on notification. Registration requirements for Consent Managers under Rule 4 become operative twelve months later, around 13 November 2026. The remaining substantive obligations, including notice and consent mechanics, breach reporting, data principal rights fulfilment, and children’s-data safeguards, come into force eighteen months from notification, giving businesses a compliance deadline of on or around 13 May 2027.

This phased schedule is, in practical effect, the closest thing every Data Fiduciary, startups included, currently has to compliance breathing room. It is a general grace period built into the Rules, not a startup-specific exemption under Section 17(3). Advisers should be precise with founders on this point: the runway to mid-2027 is available to every regulated entity, not a special benefit reserved for startups.

III. Main Analysis: The Three Pillars Startups Are Told to Expect

A. Regulatory Sandbox Environments

A recurring expectation in industry commentary is that the Central Government will establish a regulatory sandbox for startups, permitting controlled, time-bound testing of data-processing models, particularly for AI-adjacent products, before full compliance obligations attach. The statutory basis for such a sandbox would most plausibly be a Section 17(5) notification, given that provision’s framing around class-based, time-bound relief. As of the most recent regulatory commentary, no such sandbox has been formally constituted, though industry associations have submitted representations requesting one, particularly around the use of publicly available personal data for training language and speech models.

Advisers should therefore treat the sandbox as a proposed, not existing, mechanism. Any drafting or advisory brief that assumes an operative sandbox without pointing to the specific notification date and gazette reference risks overstating the client’s compliance position.

B. Streamlined Reporting Obligations

A second expectation is that a future startup notification will simplify breach-reporting and record-keeping duties, particularly the two-stage breach notification structure under Rule 7 of the DPDP Rules, which requires an initial notification to the Data Protection Board without delay upon becoming aware of a breach, followed by a more detailed report within a prescribed window. For a small engineering team without a dedicated security function, this obligation is disproportionately burdensome relative to a large Significant Data Fiduciary with an established incident-response desk.

Until a Section 17(3) notification specifically addresses breach-reporting thresholds for startups, the safer compliance posture is to build a lightweight but complete incident-response playbook now: a designated point of contact, a template notification, and a documented escalation path. This is materially cheaper to build proactively than to reconstruct under regulatory pressure during an actual breach investigation.

C. Phased Compliance Timelines

The third and most reliable form of relief for startups is not a bespoke exemption but the general eighteen-month phased implementation already discussed in Part II. Founders frequently conflate this general phase-in with a startup-specific benefit. The distinction is not academic: a startup that assumes it has a longer runway than a large enterprise, believing its status confers extra time, will be mistaken. The mid-2027 deadline applies uniformly.

Where startups may realistically gain a practical, if informal, advantage is in enforcement posture rather than statutory obligation. The Data Protection Board’s power to consider a Data Fiduciary’s compliance history, the scale of harm, and remediation efforts when calibrating penalties under the Act’s Schedule suggests that a good-faith, resource-constrained startup that has documented reasonable efforts is likely to be treated differently at the penalty stage than a large platform with the same violation. This is a matter of enforcement discretion, not a codified exemption, and should be advised as such.

D. The Significant Data Fiduciary Trap

A structural risk that receives insufficient attention in startup-facing commentary is the Significant Data Fiduciary (SDF) classification. The Central Government retains a separate power to notify any Data Fiduciary, including a startup, as an SDF based on factors such as the volume and sensitivity of personal data processed, risk to data principal rights, and potential impact on India’s sovereignty and electoral democracy. SDF status attracts materially heavier obligations, including the appointment of a Data Protection Officer based in India, an independent data auditor, and periodic Data Protection Impact Assessments. A fast-growing startup, particularly one in fintech, health-tech, or edtech that accumulates a large or sensitive user base, can cross into SDF territory well before it would ever qualify for Section 17(3) relief. Advisers should therefore model both trajectories simultaneously: the downside risk of SDF designation as the business scales, alongside the upside possibility of a future startup exemption. Treating only the exemption as relevant, while ignoring the SDF exposure that often grows in parallel, produces an incomplete compliance picture.

E. The Investor Due Diligence Dimension

Beyond direct regulatory exposure, DPDP compliance has become a functional precondition for fundraising. Institutional investors, particularly foreign venture capital funds conducting cross-border diligence, increasingly request evidence of a documented privacy programme, a data processing inventory, and vendor-level Data Processing Agreements before closing a round. This commercial pressure operates independently of whether a Section 17(3) notification is ever issued. A startup that defers compliance in anticipation of a future exemption risks not only regulatory exposure but also friction at the term-sheet stage, when a diligence questionnaire surfaces the absence of a privacy policy or a documented consent architecture. Counsel advising startups on fundraising rounds should treat DPDP readiness as a diligence workstream in its own right, distinct from, and often more time-sensitive than, the underlying regulatory deadline.

IV. Critical Analysis and Evaluation

A. The Gap Between Statutory Promise and Regulatory Delivery

The core doctrinal problem is that Section 17(3) creates an expectation of differentiated treatment that the executive has not yet operationalised. This is not unusual in Indian delegated legislation, but it leaves practitioners and founders in an uncomfortable advisory position: citing a provision that exists in the Bare Act while being unable to point to a single notification giving it content. Until DPIIT and MeitY jointly issue criteria, the safest professional position is to advise full compliance and treat any future startup notification as an upside, not a planning assumption.

B. Comparative Perspective

Two operating sandbox models offer the most instructive precedent for how a future Indian scheme under Section 17(5) might be designed. The UK Information Commissioner’s Office launched its Regulatory Sandbox in 2019 as a free, opt-in service in which selected organisations work directly with dedicated ICO staff over a fixed engagement period to test data-driven products, with the ICO providing advisory input on compliance rather than issuing a blanket dispensation from UK GDPR obligations. Singapore has run a parallel model through its Personal Data Protection Commission and, more recently, the Infocomm Media Development Authority, which established a dedicated sandbox for privacy-enhancing technologies to allow supervised trials of techniques such as federated learning and synthetic data generation. In both models the participating organisation remains fully bound by the underlying statute; what changes is the intensity of regulator engagement and the predictability of enforcement outcomes during the trial, not the substantive law itself.

If India adopts a comparable model under Section 17(5), the likely design will trade reduced principal-facing friction for increased regulator-facing oversight, rather than a genuine reduction in overall compliance burden. Advisers should calibrate client expectations accordingly: a sandbox, on the UK and Singapore models, is a supervised trial conducted in close coordination with the regulator, not a period of deregulation.

The Organisation for Economic Co-operation and Development’s Privacy Guidelines, most recently revised in 2013, supply a further comparative anchor, particularly the principles of collection limitation, purpose specification, and accountability, all of which are already embedded in the DPDP Act’s own data-fiduciary obligations. The OECD framework does not itself carve out small or early-stage entities, reinforcing the broader comparative pattern that size-based relief for startups is the exception internationally rather than the norm, and that India’s Section 17(3) approach, while presently unexercised, would be comparatively unusual in scope if and when it is finally operationalised.

A further comparative lesson lies in how mature regimes calibrate proportionality without a dedicated startup carve-out at all. The European Union’s General Data Protection Regulation, for instance, does not exempt small entities from its substantive obligations but does relax specific record-keeping duties for organisations employing fewer than two hundred fifty persons, unless their processing is regular, high-risk, or involves special categories of data. India’s Section 17(3) is structurally more generous in concept, since it contemplates exemption from substantive obligations rather than mere record-keeping relief, but that generosity remains theoretical until exercised. Practitioners advising founders with pan-European operations should be careful not to assume that a lighter-touch approach in one jurisdiction translates into an equivalent concession under Indian law.

C. Practical Recommendations

Pending a formal notification, startups and their counsel should adopt three practical measures. First, maintain DPIIT recognition documentation in a form that can be readily submitted if and when an eligibility-based notification is issued, since recognition status will almost certainly be a threshold condition. Second, build compliance systems, consent capture, a privacy notice, a breach playbook, and a record of processing activities, calibrated to the mid-2027 deadline rather than to a hoped-for exemption, since building compliant systems now avoids a costlier retrofit later. Third, monitor the Gazette of India and the Ministry of Electronics and Information Technology’s official notifications page directly, since secondary commentary on a startup exemption has at times moved faster than the underlying regulatory text.

V. Conclusion

Section 17(3) of the DPDP Act gives India’s startup ecosystem a genuine, if conditional, statutory promise of differentiated treatment. That promise, however, remains unfulfilled in regulatory practice. The DPDP Rules, 2025 supply every Data Fiduciary, not startups alone, with a phased runway to mid-2027, and it is this general timeline, rather than any bespoke sandbox or reporting relief, that currently governs startup compliance planning. Sound advisory practice requires distinguishing clearly between the exemption that the statute permits, the relief that the Rules actually deliver, and the notification that the executive has yet to issue. Until that notification arrives, the most defensible position for any startup is to build toward full compliance while remaining alert to the gazette for the day Section 17(3) is finally given operative content.

Frequently Asked Questions

1. Is there currently a blanket exemption for startups under the DPDP Act?

No. Section 17(3) permits the Central Government to notify such an exemption, but as of the most recent regulatory updates, no dedicated startup notification has been issued. Every startup that processes digital personal data of individuals in India is fully subject to the Act.

2. Does DPIIT startup recognition automatically reduce DPDP compliance obligations?

Not automatically. DPIIT recognition is likely to be a precondition for any future Section 17(3) notification, but recognition alone does not currently trigger any relaxation of obligations under the Act or the Rules.

3. What is the actual compliance deadline startups should plan around?

The DPDP Rules, 2025 set a phased implementation schedule, with most operational obligations, including consent, notice, and breach-reporting duties, becoming fully enforceable around 13 May 2027, eighteen months after the Rules were notified on 13 November 2025. This deadline applies to all Data Fiduciaries, not only startups.

4. Is the regulatory sandbox for startups operational?

No formal sandbox has been constituted to date. Industry bodies have requested one, particularly for AI-related data processing, but any such mechanism would require a separate notification, most likely under Section 17(5), and should not be assumed in current compliance planning.

 

5. Can a startup rely on Section 17(5) instead of Section 17(3)?

Section 17(5) is a broader, time-bound relief mechanism available to any class of Data Fiduciary, not a startup-exclusive provision. Startups may benefit from a Section 17(5) notification if one is issued for a relevant processing activity, but they cannot invoke it unilaterally without a Government notification in place.

6. What should a startup do while waiting for a startup-specific notification?

Build core compliance infrastructure now, a compliant privacy notice, a consent mechanism, a breach-response playbook, and a record of processing activities, calibrated to the mid-2027 statutory deadline, and maintain DPIIT documentation so the startup is positioned to benefit immediately if and when a Section 17(3) notification is issued.

References

Primary Sources

Digital Personal Data Protection Act 2023, ss 3, 17, Schedule.

Digital Personal Data Protection Rules 2025, GSR 846(E), Gazette of India, Extraordinary, Part II, Section 3(i), 13 November 2025.

Ministry of Electronics and Information Technology, Notification on Commencement of the Digital Personal Data Protection Act 2023, GSR 843(E), Gazette of India, 13 November 2025.

Press Information Bureau, Government of India, ‘Digital Personal Data Protection Rules 2025 Notified’ (Ministry of Electronics and Information Technology, 17 November 2025).

K.S. Puttaswamy v Union of India (2017) 10 SCC 1 (Supreme Court of India, nine-judge bench).

Justice K.S. Puttaswamy (Retd.) v Union of India (2019) 1 SCC 1 (Supreme Court of India, five-judge bench, Aadhaar).

Organisation for Economic Co-operation and Development, Guidelines Governing the Protection of Privacy and Transborder Flows of Personal Data (as revised, 2013).

Information Commissioner’s Office (UK), Guide to the Regulatory Sandbox (ICO, 2019).

Personal Data Protection Commission Singapore and Infocomm Media Development Authority, Privacy Enhancing Technologies Sandbox (Launch Announcement, 2022).

Secondary Sources

Ikigai Law, ‘A Closer Look at the DPDP Rules 2025’ (Ikigai Law, 2025).

Neeti Niyaman, ‘Digital Personal Data Protection (DPDP) Rules 2025’ (Neeti Niyaman, 2025).

S.S. Rana & Co, ‘MeitY Notifies Final Digital Personal Data Protection Rules 2025’ (S.S. Rana & Co, 2025).

Shardul Amarchand Mangaldas & Co, ‘Enforcement of the DPDP Act and Notification of the DPDP Rules’ (SAM, 27 November 2025).

ComplyZero, ‘DPDP Act Exemptions: When the Law Does Not Apply’ (ComplyZero, 2026).

GoTrust, ‘Exemptions and Accountability in India’s Data Protection Framew

ork’ (GoTrust, 2026).