Data Security Checklist for Small Business in India

A data security checklist for small business owners does not need to be complicated or expensive. Most attacks on Indian MSMEs are not sophisticated hacks; they are phishing emails, reused passwords, fake bank-detail change requests, unpatched computers and ransomware that encrypts the only copy of the accounts data. A handful of disciplined habits blocks the large majority of these. This guide explains the real threats small businesses face, gives a prioritised checklist with costs, walks through a common payment fraud scenario, and sets out what to do when something goes wrong, including reporting obligations. It is general information; consult a security professional for your specific setup.

The Threats Small Businesses Actually Face

Threat	How it usually happens	Typical damage
Phishing	Fake emails or WhatsApp messages with links to steal logins	Email, bank or software accounts taken over
Payment diversion fraud	Fraudster poses as a supplier and asks you to pay into a "new" bank account	Direct financial loss, often unrecoverable
Ransomware	Malicious attachment or exposed remote desktop encrypts files	Accounts and operations halted for days
Password reuse	A password leaked from one site is tried on your email and banking	Account takeover
Lost or stolen devices	Unencrypted laptop or phone with customer and employee data	Data exposure, legal obligations
Insider misuse	Former employee retains access or copies customer lists	Lost customers, data leak
Fake payment confirmations	Customer shows an edited UPI screenshot at the counter	Goods handed over without payment

Priority 1: Accounts and Passwords

Unique password for every important account: email, banking, accounting software, GST portal, domain registrar. Reuse is the single biggest risk.
Use a password manager so staff do not write passwords on sticky notes or share them on WhatsApp.
Turn on multi-factor authentication (MFA) everywhere it is offered, starting with email and banking. An authenticator app is stronger than SMS codes.
No shared logins. Every person gets their own account in your software so actions are traceable and access can be removed individually.
Least privilege: give people only the access their role needs. A billing clerk does not need payroll data or bank details.
Offboarding on day one: when someone leaves, disable their accounts, change shared credentials they knew and collect devices the same day.

Priority 2: Backups That Actually Work

Follow the 3-2-1 rule: three copies of important data, on two different types of storage, with one copy off-site or offline.

If you use cloud software, confirm the provider's backup and restore policy, and still export key data (ledgers, customer lists, invoices) monthly.
For files on office computers, use automated cloud backup plus an external drive that is disconnected after each backup, so ransomware cannot encrypt it.
Test a restore every quarter. A backup you have never restored is a hope, not a backup.
Keep backups for long enough to recover from slow-spreading problems, such as 30 to 90 days of versions.

Priority 3: Stop Payment Fraud

Worked scenario: the changed bank account

A hypothetical Pune machine shop receives an email that looks like it is from its steel supplier, saying the supplier has changed banks and asking that the pending ₹8.5 lakh invoice be paid to a new account. The email address differs by one letter. The accountant updates the vendor's bank details and pays. Two weeks later the real supplier asks for payment. The money has moved through several accounts and is difficult to recover.

Controls that prevent it

Never change vendor bank details based on email or WhatsApp alone. Call the vendor on a number already in your records, not the one in the message.
Require two people to approve any change to vendor bank details, and log it.
Send a small test payment to new accounts and confirm receipt by phone before large transfers.
Use maker-checker on your banking portal so one person prepares payments and another approves.
Set daily transaction limits appropriate to your business.

At the retail counter

Do not accept a payment screenshot as proof. Confirm UPI receipts on your own app, soundbox or bank notification before handing over goods. Train cashiers on this specifically.

If fraud happens, act within hours: call your bank to attempt a freeze, report on the national cybercrime helpline 1930 and the cybercrime reporting portal, and preserve emails and transaction details.

Priority 4: Devices and Software

Automatic updates on for operating systems, browsers and office software. Most ransomware exploits known, already-fixed vulnerabilities.
Replace unsupported systems. Computers running operating systems that no longer receive security updates should be upgraded or isolated.
Licensed software only. Pirated software is a common malware source.
Endpoint protection on every computer, with central visibility if you have more than a few machines.
Full-disk encryption on laptops, and screen locks with PINs on phones that access business email or apps.
Do not expose remote desktop directly to the internet. Use a VPN or a secure remote access tool with MFA.

Priority 5: Network, Wi-Fi and CCTV

Change default passwords on routers, CCTV recorders and printers. Default credentials are publicly listed online.
Use a separate guest Wi-Fi for customers and visitors, isolated from billing and office systems.
Use WPA2 or WPA3 encryption with a strong Wi-Fi password, changed when staff leave.
Keep router firmware updated.
Restrict who can view CCTV remotely, and display CCTV notices as required.

Priority 6: Email and Domain Hygiene

Use a business email service with spam and phishing filtering, not personal free accounts for business.
Ask your email provider or IT person to set up SPF, DKIM and DMARC records on your domain, which make it harder for criminals to send email pretending to be you.
Protect your domain registrar account with MFA; losing it means losing your email and website.
Train staff to hover over links, check sender addresses and report suspicious messages without fear of blame.

Priority 7: Vendors and Third Parties

List every vendor with access to your systems or data: accountant, payroll provider, software vendors, IT support, marketing agencies.
Give each vendor its own login with limited access, and remove it when the work ends.
Include security, confidentiality, breach notification and data deletion clauses in contracts, which also supports obligations under the DPDP Act.
Ask software providers about encryption, backups, access controls and audit logs.

Our DPDP Act compliance checklist explains the data protection obligations these controls support.

What Basic Security Costs

Indicative annual costs for a 15-person office (actual prices vary):

Control	Indicative annual cost	Risk reduced
Password manager for 15 users	Low, often a few thousand rupees per user per year or less	Password reuse, sharing
Multi-factor authentication	Usually free with email and banking	Account takeover
Endpoint protection	Moderate per device	Malware, ransomware
Cloud backup plus external drive	Low to moderate	Data loss, ransomware
Staff awareness session twice a year	Mostly internal time	Phishing, payment fraud
Cyber insurance (optional)	Varies by cover	Financial impact of incidents

Compare these with a single ₹8.5 lakh payment fraud or a week of halted billing. Basic security is one of the best-value investments a small business can make.

Incident Response: When Something Goes Wrong

Contain: disconnect affected devices from the network; do not switch them off if you may need forensic evidence.
Secure accounts: change passwords and revoke sessions for affected email and software accounts, from a clean device.
Call your bank immediately if payments or banking credentials are involved.
Assess: what systems and data were affected, and whose personal data.
Report: to the cybercrime portal for fraud; CERT-In directions issued in 2022 require many organisations, including body corporates, to report specified cyber incidents within 6 hours of noticing them. Under the DPDP framework, personal data breaches must be reported to affected individuals and the Data Protection Board as the Rules require, once those obligations apply.
Restore from clean backups.
Learn: write down what happened and fix the root cause.

Keep a one-page incident contact sheet: your IT support, bank fraud lines, software vendors, insurer and lawyer.

Data Security Checklist for Small Business

Unique passwords and a password manager
MFA on email, banking, accounting and government portals
Individual logins with role-based access
Same-day offboarding
3-2-1 backups with quarterly restore tests
Vendor bank detail changes verified by phone with two approvals
Maker-checker on bank payments
Automatic updates and endpoint protection on all devices
Encrypted laptops and locked phones
Default passwords changed on routers and CCTV
Guest Wi-Fi separated
SPF, DKIM and DMARC on your domain
Vendor access reviewed quarterly
Incident response plan and contact sheet
Staff awareness training twice a year

Choosing Software With Good Controls

Business software that supports individual logins, role-based permissions and approval workflows makes many of these controls easier. Fininvo's ERP uses role-based access, and its banking module supports payment processing and reconciliation that helps spot unexpected transactions quickly. Moving from a single shared office PC to cloud software also changes your backup picture, as discussed in cloud vs desktop accounting software. See pricing.

Frequently Asked Questions

What is the most important security step for a small business?

Turning on multi-factor authentication for email and banking, combined with unique passwords. It blocks most account takeover attempts at almost no cost.

Do small businesses really get targeted?

Yes. Many attacks are automated and opportunistic, so small businesses with weaker controls are frequent victims, especially of phishing and payment fraud.

What should I do if I paid a fraudster?

Contact your bank immediately to request a freeze, report on the 1930 helpline and the national cybercrime portal, and preserve all evidence. Speed improves the chance of recovery.

Is cyber insurance worth it for an MSME?

It can help with costs of incident response, data recovery and some losses. Read exclusions carefully; insurers often require basic controls such as MFA and backups to be in place.

Do I need to report every incident to CERT-In?

CERT-In's 2022 directions list specific types of incidents that must be reported within 6 hours. Check the current list and take professional advice when an incident occurs.