Yes, in most cases. If your business collects customer or employee personal data in digital form, you are a Data Fiduciary and the Act applies, even if you are small. You need to give a clear notice, get consent (or rely on a legitimate use), keep the data secure, delete it when no longer needed and respond to people's requests.
The government can exempt certain classes of Data Fiduciaries, including startups, from some provisions (Section 17(3)), but there is no automatic exemption based on size alone.