DPDPA Compliance Explained: What SMEs Need To Know
DPDPA Compliance Could Soon Become A Business Requirement For Gujarat SMEs
For small and medium-sized businesses in Gujarat, data protection could soon become part of the basic requirements for working with larger companies.
The issue was discussed at a workshop organised by the Gujarat Branch of the Indo-American Chamber of Commerce (IACC) in association with ClearConsent DataSec Pvt. Ltd. The programme, titled “The DPDPA Countdown: What Every Business Must Do Before May 2027”, was held at DoubleTree by Hilton on Bopal-Ambli Road, Ahmedabad.
The discussion comes as India moves towards the next stages of implementation of the Digital Personal Data Protection Act, 2023. The Central Government notified the Digital Personal Data Protection Rules, 2025, on November 13, 2025. The government has set an 18-month phased period for several major provisions, taking the main compliance phase to May 2027.
For Gujarat SMEs, the effect of the law may be felt in business dealings before they face any direct regulatory action. Larger companies can ask their vendors to complete privacy questionnaires, sign data protection agreements or explain how personal information is collected, stored and processed.
That could make data protection a commercial requirement for businesses that supply goods or services to bigger organisations.
Jasmine Amin, Founder and CEO of ClearConsent DataSec Pvt. Ltd., said that businesses should not wait for a government notice before preparing for the new requirements.
“Most business owners are waiting for a notice from the government. That is not how this will reach them,” said Amin. “It will arrive as a data protection agreement attached to a renewal, or a privacy questionnaire before an empanelment is cleared. The consequence is not a penalty. It is a contract that does not get signed.”
Amin also explained the role of ClearConsent and announced a new service during the programme.
“The goal of Clear Consent is to help organisations. We take on all the complex work and give simple solutions to organisations. Today in the evening, we are going to launch a new service called “DPDP as a Service”. This service will guide you step-by-step and help you follow all the rules. Then you can learn and slowly start handling it on your own.
“We will give a portal to every company, called a Privacy Management Portal. You can go there to withdraw your consent or send a request to delete your data. That is one part of Clear Consent. Right? For you as a consumer, the direct place to complain is the DPB board.
“A consent manager is not going to fight for you. Their job is only to manage your permissions. If you say you have 500 permissions and do not want to manage them, you can give them over. But that will not happen because only you have to decide who you want to share your data with.”
The distinction is important because the DPDP framework gives individuals rights over their personal data, while businesses have duties when they process that information. Under the Rules, a Data Fiduciary must provide clear information about the personal data being collected, the purpose for collecting it and ways for people to withdraw consent, exercise their rights and make complaints to the Data Protection Board.
The Rules also provide for Consent Managers. These are registered entities designed to help people give, manage, review and withdraw consent. The government framework says a Consent Manager must maintain records of consent and data sharing and provide access to those records. It also sets conditions relating to security, independence and conflicts of interest.
For businesses, personal data can appear in many ordinary parts of daily operations. Customer names and telephone numbers are obvious examples. Employee records, website enquiry forms, digital transaction information and CCTV footage can also involve personal data, depending on how the information is handled.
A company therefore needs to understand what information it holds and why it holds it. It also needs to know where the information is stored, who can access it and what happens if personal data is exposed or misused.
Amit Doshi, Chairperson of the IACC Gujarat Branch, said the issue requires attention from MSMEs and SMEs as they continue to expand their business activities.
“It is very vital and critical for the industry, and for all of us, to understand the Act and its implications. As an industry and as businesses, we need to protect our businesses, comply with the requirements, sustain ourselves and continue to grow. Unless businesses understand the provisions of the Act, they may remain vulnerable to the misuse of their basic operational and business information.
“It is therefore important that we understand the Act and its provisions, take the necessary steps to prevent the misuse of our data and information, and ensure that we follow the right practices in the way we conduct our businesses. As a Chamber, it is our request and insistence to our members, especially MSMEs and SMEs that are fully engaged in business growth, to understand and learn the provisions of the Act and take the necessary steps to protect their businesses for the next level of growth.”
The government’s approach has included consultation with businesses and other groups. MeitY said it received 6,915 submissions during the consultation on the draft Rules, including responses from startups, MSMEs, industry bodies, civil society groups, government departments and citizens.
The final Rules also include requirements for security safeguards and personal data breach reporting. They set out measures such as encryption, access controls, monitoring and backups, while businesses must follow specified procedures when a breach occurs.
For an SME, preparing for this change does not begin with buying new software. The first step is understanding how personal information moves through the business. A firm taking customer enquiries through a website, maintaining employee records, using cloud software and sharing information with outside vendors may already have several points that need review.
That is why the May 2027 timeline matters to smaller companies even when they are not large data businesses. A corporate buyer may ask questions about privacy before the government does.
For many Gujarat SMEs, the immediate issue may therefore be a simple commercial one: when a major client asks how customer or employee data is handled, will the business have a clear answer?
