Small Company 90 Day DPDP Playbook

You do not need a big consultant. A small company can reach a sound DPDP position in about 90 days by working through three phases. Tick each box as you finish it; the bar shows your progress. This DPDPA 2023 course page explains small company 90 day dpdp playbook in plain language.

Before you start: 5-minute triage (small company 90 day dpdp playbook)

Question	If yes
Do you collect personal data online (forms, app, store, email)?	You are a Data Fiduciary. All guides apply.
Do you serve anyone under 18?	Read the children guide first.
Do you send data to vendors or servers abroad?	Read the vendor and transfer guide.
More than 2 crore users (e-commerce or social) or 50 lakh (gaming)?	Third Schedule erasure applies. See the retention guide.
Has the Government notified you as a Significant Data Fiduciary?	Read the DPIA guide.

See the plan (tap a phase)

Phase 1: Foundation (days 1 to 30) (small company 90 day dpdp playbook)

0 of 8 done

Choose a privacy owner and a backup (can be the founder or operations head)
Write down every system holding personal data: website, CRM, payroll, accounts, email tool, support desk, analytics, cloud storage
Fill the data inventory for each system
List all vendors that touch personal data and what they do
Check whether you handle data of children
Check whether data leaves India (servers, support teams, SaaS tools)
Check size thresholds and whether you could be a Significant Data Fiduciary
Create a shared folder called DPDP Evidence

Phase 2: Build (days 31 to 60)

0 of 8 done

Publish a new privacy notice that meets Rule 3
Change forms so consent is separate for each purpose and recorded
Add an easy withdrawal route (preference link or email)
Turn on the Rule 6 controls: encryption, access control, logging, backups
Create the request workflow and publish how to use it
Write the breach runbook with the two templates
Add data-protection clauses to vendor contracts
Publish your privacy contact (Rule 9)

Phase 3: Prove (days 61 to 90) (small company 90 day dpdp playbook)

0 of 6 done

Run a one-hour breach drill and note what failed
Set a retention schedule and delete what is not needed
Train every employee for 30 minutes (what is personal data, how to report a breach, how to handle a request)
Review the evidence folder: notice versions, consent logs, vendor contracts, test results
Do a self-check with the readiness questionnaire
Put quarterly reviews in the calendar

What this costs

The evidence folder (small company 90 day dpdp playbook)

Folder	What goes in it
1 Inventory	Data inventory, vendor list, data-flow notes
2 Notices and consent	Each notice version with date, consent log samples, screenshots of forms
3 Security	Settings screenshots, access reviews, backup test results, log retention proof
4 Requests	Request log and replies
5 Incidents	Breach register, drill report, notices sent
6 People	Training records, role descriptions
7 Vendors	Contracts and checks

Related guides

Educational material, not legal advice. Based on the DPDP Act, 2023 and the DPDP Rules, 2025 (Gazette notification of 13 November 2025). Always check the official text on the MeitY website.

Official sources for small company 90 day dpdp playbook: Digital Personal Data Protection Rules, 2025 (MeitY, PDF) and DPDP Rules 2025, English text (PDF). Always check the latest official notifications.

Small Company 90-Day DPDP Playbook

Before you start: 5-minute triage (small company 90 day dpdp playbook)

See the plan (tap a phase)

Phase 1: Foundation (days 1 to 30) (small company 90 day dpdp playbook)

Phase 2: Build (days 31 to 60)

Phase 3: Prove (days 61 to 90) (small company 90 day dpdp playbook)

What this costs

The evidence folder (small company 90 day dpdp playbook)

Related guides