DPDP Compliance for Startups in India. Under ₹20k/mo. Founder-led in one week.

Yes. The DPDP Act 2023 has no minimum revenue or employee threshold. If your app, website or SaaS product collects a single Aadhaar, phone number, email or payment card from an Indian user, you are a Data Fiduciary. Enforcement is soft in 2026 but hard from May 2027. Fixing it pre-Series A is 10x cheaper than fixing it during due diligence.

Under ₹20,000/month total. Combine dcomply Starter (₹9,999/month for platform: consent, DSR, breach, DPIA, gap assessment, retention, cross-border) with vDPO AI Tier (₹2,499/month for named-DPO output on record). Total ~₹12,500. For pre-Series A this covers all DPDP obligations except SDF designation (which most non-SDFs never trigger).

Yes, increasingly. Since DPDP Rules 2025 notification (Nov 2025), Indian VCs and foreign investors ask about: (a) named DPO or equivalent, (b) DPDP-compliant privacy notice, (c) DSR process, (d) breach response plan, (e) vendor DPA chain. dcomply produces the full due-diligence bundle in one PDF export.

DPIIT recognition itself does not exempt you from DPDP. But DPIIT startups often get preferred pricing from compliance platforms. dcomply offers 30% off Starter tier for DPIIT-recognised startups in Year 1. Ask sales.

Yes for non-SDF companies. Section 10 only mandates a named DPO for Significant Data Fiduciaries. For everyone else, the founder can wear the DPO hat — but you still need a published contact and a real process. dcomply's vDPO AI Tier gives the founder a named-DPO backstop for ₹2,499/mo without hiring anyone.

Every one of them is a Data Processor under Section 8(2). You need: signed DPA (they all publish one), listed in your processing register, breach flow-through in the contract. dcomply's Vendor Register ships with pre-signed DPAs for 50+ common SaaS vendors ready to import.

You need both. GDPR covers EU data principals; DPDP covers Indian ones. Overlap is ~70% on controls but they differ on: (a) legal basis (GDPR has 6, DPDP has consent + 4 legitimate uses), (b) DPO threshold (GDPR broader, DPDP only SDFs), (c) cross-border (GDPR adequacy vs DPDP whitelist), (d) fines (4% turnover vs fixed caps). dcomply runs both in one workspace.

Yes. Every India-focused portfolio call in Q2 2026 has asked about DPDP posture. The specific question: "Can you produce a DPDP compliance snapshot in one click?" dcomply's Board Report module produces this exact artefact.

Penalties are capped, not automatic. Schedule 1 sets maximums; the DPB adjudicates severity, intent, harm and mitigation. Startups with a demonstrated compliance programme (even a lean one) get materially lower penalties. dcomply's EvidenceChain is the artefact that shows the DPB you had reasonable safeguards under Section 8(5).

Yes. dcomply has a free tier that covers consent capture, privacy notice generator, DSR intake and gap assessment. Upgrade to Starter (₹9,999/mo) when you need audit trail, DPIA, breach workflow and vendor register — usually at seed round.

One founder-led week: Day 1 gap assessment (2 hours), Day 2 privacy notice + consent artefacts (2 hours), Day 3 DSR portal published (30 min), Day 4 vendor DPAs imported (2 hours), Day 5 board pack generated (30 min). Total under 10 hours of founder time.

Yes, per Section 3(b) extraterritorial application. If you offer goods or services to individuals in India, DPDP applies regardless of where you are incorporated. dcomply is a legal India-based Data Fiduciary partner for foreign SaaS entering India.