The startup exemption exists. It has not been granted to you.

There is a startup exemption in the Act, and it is more limited than the reassurance it usually provides in a founder conversation.

Sec. 17(3) empowers the Central Government to notify certain Data Fiduciaries or classes of them, startups expressly named, to whom Sec. 5, Sec. 8(3), Sec. 8(7), Sec. 10 and Sec. 11 shall not apply. The Act defines a startup by reference to recognition under the criteria the relevant department sets.

Read what that is and is not. It is real relief, covering notice and the right to access information. It is also discretionary and contingent: the government must issue a notification, and it exempts classes rather than applicants. Nothing about being small is self-executing, and nothing in Sec. 17(3) touches consent under Sec. 6, withdrawal under Sec. 6(4), security safeguards under Sec. 8(5), breach reporting under Sec. 8(6) or the rights in Sec. 12 to 14.

The order that costs least

Most of the expense in a first compliance year is not software. It is discovering what you hold. Doing the steps out of order is what makes it expensive.

Know the purposes first. Sec. 6(1) makes consent specific to a purpose, which is impossible to express before someone has written down what the purposes are. Teams that build the consent screen first end up collecting consent for categories that do not match what the business does with the data.

Then the notice. Itemised data, itemised purpose, plus how to withdraw, how to exercise rights, and how to complain to the Board. One per purpose, not a privacy policy link.

Then stop bundling. One tick covering product updates, marketing and partner sharing is one consent doing three jobs, and it makes selective withdrawal impossible later.

Then make withdrawal arrive. The control is a week. The propagation to your email platform, your ad audiences and your warehouse is the project, and it is the half that gets skipped.

Then the record. Which notice version, in which language, on what date, and when each downstream system confirmed a withdrawal.

What a small team can genuinely defer

Sec. 10's Significant Data Fiduciary duties — a Data Protection Officer in India, an independent auditor, periodic impact assessments — attach only once the Central Government notifies you as significant, judged on data volume and sensitivity and risk. A seed-stage company is not being notified.

The Third Schedule's three-year erasure rule bites at two crore registered users for e-commerce and social media, fifty lakh for online gaming. If you are nowhere near those numbers, it is not your problem this year.

The thing not to defer

Consent taken now is the consent you will be defending. Sec. 5(2) means an existing base does not go dark at commencement — you owe those people a notice as soon as is reasonably practicable and may keep processing until they withdraw — but the size of that noticing job is set by how many people you sign up between now and then, and whether the purposes were separated when you did it.

Getting the data model right at a thousand users is a schema decision. At a million it is a migration.