DPDP Act: A Simple Guide for Small Business Owners
If your business keeps customer names, phone numbers or emails, India's data protection law applies to you, and the main duties become enforceable on 13 May 2027.
The Digital Personal Data Protection Act was passed in 2023. The government notified the rules that put it into practice in November 2025, with an 18-month runway to get ready. Many small business owners assume this law is meant for big tech companies. It is not. A clinic, a coaching center, a boutique with a billing app or a D2C brand on Instagram all handle personal data every day.
The good news: for most small businesses, getting compliant is a few weeks of sensible housekeeping, not a big project. This guide explains what the law asks of you in plain words and gives you a checklist to start with.
Does it apply to you?
It applies if you collect or use personal data of people in India in digital form. That includes paper records you later type or scan into a computer. Personal data is anything that identifies a person, such as a name, phone number, email, address, photo or payment details.
If any of these sound like you, the law applies:
You save customer numbers in a billing app or on WhatsApp.
You collect enquiries through a website form.
You keep patient, student or member records on a computer.
You run an online store or take bookings online.
You keep employee details in a spreadsheet or payroll tool.
There is no general exemption based on how small your business is. The law does allow the government to exempt certain startups from some duties, but only through a specific notification. Unless you are covered by one, plan to comply.
What the Law asks of you?
Give a short, clear notice that lists what data you collect and why. It must also explain how people can withdraw consent and how they can complain. English or any of India's scheduled languages is fine.
A pre-ticked box or a line hidden in long terms does not count. People must actively agree, and withdrawing must be as easy as agreeing.
If you collected a number to send a bill, do not add it to a marketing list without asking.
Use reasonable safeguards such as passwords, access control, backups and encryption where you can. Keep security logs for at least one year.
If data leaks or is stolen, tell the affected people without delay. Tell the Data Protection Board too, with a detailed report within 72 hours of finding out.
Once the purpose is over, or someone withdraws consent, erase their data unless another law requires you to keep it.
People can ask to see, correct or erase their data. Publish how long you take to respond, which can be no more than 90 days.
For anyone under 18, you need verifiable consent from a parent. You cannot track children or target ads at them.
Display who people can reach with privacy questions, with an email or phone number.
If a software provider or agency handles data for you, you remain responsible. Choose vendors who protect data and put it in your contract.
What Happens if you Ignore it?
Penalties go up to ₹250 crore per violation. The Data Protection Board decides the amount case by case.
Violation | Maximum penalty |
Failing to keep reasonable security safeguards | ₹250 crore |
Failing to report a breach to the Board or to affected people | ₹200 crore |
Breaking the rules on children's data | ₹200 crore |
Any other breach of the Act or Rules | ₹50 crore |
These are maximums, not fixed fines. The Board looks at how serious the violation was, how long it lasted and what you did to fix it. A small business that took reasonable steps is in a very different position from one that did nothing. The bigger risk for most small businesses is losing customer trust after a leak.
A Simple Checklist to Start this Month
List every place you keep personal data: phones, WhatsApp, billing app, spreadsheets, email, website forms.
Delete data you no longer need, such as old enquiries and past customers with no ongoing relationship.
Write a short privacy notice and add it to your website, forms and billing counter.
Replace pre-ticked boxes with a clear "I agree" step, and add an easy way to withdraw consent.
Turn on strong passwords and two-step login for every app that holds customer data.
Limit who in your team can see customer data.
Ask your software vendors how they protect your data, and get it in writing.
Name one person to handle privacy questions, and publish their contact details.
Write a one-page plan for what to do if data leaks, including who reports to the Board within 72 hours.
Check whether you collect data about anyone under 18, and if so, plan for parental consent.
Start Now, Not in May 2027
Good privacy practice is good business. Customers trust businesses that respect their data, and every item on the checklist above also protects you from fraud and data loss. Starting early gives you time to fix things calmly instead of rushing near the deadline.
Need help with your DPDP readiness? Ambar Defence works with businesses of every size, from a quick gap assessment to a full compliance plan. Write to team@ambardefence.com and we will reply within one business day.
This article is general information, not legal advice. Check with a qualified professional for your specific situation.
Comments