Q3 - Do small businesses and start-ups also need to comply, or only big companies?

Answer

Yes, all organizations that process personal data must comply — whether they are large corporations or small start-ups. However, compliance is proportionate to the scale and risk:

• Small retailers collecting only customer names and phone numbers will have simpler compliance requirements.
• A large fintech company handling Aadhaar, PAN, and financial transactions will face stricter obligations, and may even be classified as a Significant Data Fiduciary (SDF).

Example

• A local bakery using a phone number list for delivery updates must provide customers a way to opt out.
• A crypto exchange handling millions in transactions must implement advanced safeguards, audits, and breach reporting systems.