DPDP applies to you at ten people.
Here is the short version.

The Act has no revenue floor and no employee threshold. It starts at your first Indian user. The good news is that the obligations that matter to a ten-person company are a short list, and most of them are engineering work rather than legal work.

There is no small-business carve-out. The Act reaches the processing of digital personal data collected within India, and it reaches processing outside India where that processing relates to offering goods or services to people in India. A four-person SaaS company in Bengaluru with one paying customer is a Data Fiduciary. So is a Delaware company with a Mumbai sign-up form.

What varies by size is not whether the obligations apply but which ones bite. The duties reserved for Significant Data Fiduciaries — a Data Protection Officer based in India, independent audits, impact assessments — depend on being notified as one, and the factors behind that notification are volume and sensitivity of data, risk to principals and effects on the security of the State. Early-stage companies are rarely in that set. The duties every Data Fiduciary carries regardless — notice, valid consent, honouring rights, publishing a grievance route, reporting a breach — apply from day one.

The penalties are set against the obligation, not the balance sheet. Failure to take reasonable security safeguards sits in the largest band; failures around principal rights and grievances sit lower but are still measured in crores. A startup is not fined proportionally to its size, which is the argument for doing the cheap parts early. The scoping question has its own answer here.

Compliance advice aimed at banks gets copied down to startups and produces a programme nobody has the staff to run. Some of it genuinely waits.

• A formal Data Protection Impact Assessment. Tied to Significant Data Fiduciary status. Until then, write down the risky processing and why you accepted it.
• An independent data auditor. Same trigger, same answer.
• A full third-party risk programme. Keep a list of sub-processors and where they store data; the questionnaires and scoring can come when you have more than a dozen.
• A thirty-document policy set. Six documents cover a startup: privacy notice, cookie policy, retention schedule, breach response plan, data principal request procedure and a sub-processor list.
• Automated discovery across every system. Useful at fifty systems, theatre at five.

What does not wait is anything that has to be true at the moment data is collected. Consent cannot be reconstructed retrospectively, and neither can proof that a tracker was blocked before someone clicked accept. Everything in that category is cheaper to do on day one than to remediate in year two.

In a startup the privacy owner is usually the founder who least wants the job, or whoever last touched the cookie banner. That works if the role is defined as a small set of recurring decisions rather than a standing function. The decisions are: which purposes we collect consent for, who answers a rights request, who decides whether an incident is reportable, and who signs a policy change.

Everything around those four is mechanical and can be automated — routing, clocks, reminders, the evidence trail, the export. What cannot be automated is the judgement call, and no platform should claim otherwise. Name the person who makes each call, put their name in the notice where the Act requires a contact, and give them a queue rather than an inbox.

Compare that with the job as a full-time DPO runs it, or with what an enterprise procurement team will eventually ask you to evidence.

The other three persona pages on this site do not answer this, so here it is plainly. ProtectComply publishes one self-serve price. The Startup plan is ₹4,999 a month, or ₹49,990 a year billed annually, and it covers the cookie consent banner with unlimited banner views plus the DPDP quick start. Managed consent beyond the banner is metered at ₹2 per user. The governance tiers — Protect Pro, Protect Max and Enterprise — are scoped per organisation rather than listed, because what they cost depends on how many data principals and systems you are covering.

Set against that, the costs founders routinely underestimate are the non-software ones: legal review of the notice, someone's time answering the first few rights requests by hand, and the engineering week that goes into moving tag loading behind a consent gate if the site was built without one. Budget the engineering week. It is the item that slips.

Current pricing is here and is the figure to trust if this page ever drifts.

Three signals, in the order they usually arrive. The first is a rights request you cannot answer from one system, because customer data now lives in the product database, the CRM and the support tool. The second is a security questionnaire that asks for an audit trail rather than a policy document. The third is a regulator-shaped question from a customer's legal team — typically about cross-border transfer or retention — that you cannot answer without a record of processing.

None of the three is about headcount. Each is about the number of places your data lives. When you hit the second one, the readiness assessment is the cheapest way to find out what you would fail, and the website scan tells you what a buyer can already see from outside.

At what headcount does a startup need to take DPDP seriously?

Headcount is not the test. The Act applies to the processing of digital personal data of people in India, so a two-person company with one Indian signup is inside scope and a two-hundred-person company selling only to US enterprises may not be. What changes with headcount is who has time to run the obligations, which is why the practical trigger is usually the first enterprise customer who sends a security questionnaire.

Do we need to appoint a Data Protection Officer before we raise a Series A?

A DPO is an obligation of Significant Data Fiduciaries, a classification the Central Government notifies. Most early-stage startups are not notified and therefore do not need a DPO. Every Data Fiduciary still has to publish a contact who can answer questions about its processing and run a grievance mechanism under section 8(9) and 8(10), so name a real person who reads the inbox and record why you concluded the Significant Data Fiduciary duties do not apply to you.

Can a startup run DPDP compliance without buying software?

Up to a point. A notice, a grievance address and a spreadsheet of systems can be written by hand. What cannot be done by hand is proving, months later, that a specific person consented to a specific purpose at a specific time and that the withdrawal you received was honoured downstream. That evidence has to be generated as a by-product of the flow, which is where tooling starts paying for itself.

What do investors and enterprise buyers actually ask for?

In practice, four artefacts: a published privacy notice with an Indian contact on it, evidence that trackers are gated behind consent, a documented process for data principal requests with a response time, and a list of sub-processors with where they store data. None of them requires a compliance team. All of them take longer than expected if you start on the day the questionnaire arrives.