DPDP Act Compliance for Small Business: A Practical Checklist

DPDP Act compliance for small business owners is no longer a distant concern. The Digital Personal Data Protection Act, 2023 sets India's rules for how organisations collect, use, store and share personal data, and the Digital Personal Data Protection Rules were notified in November 2025 with a phased timeline. Almost every MSME handles personal data: customer phone numbers for billing, employee Aadhaar and bank details, vendor contacts, CCTV footage, website enquiries. This guide explains the Act's core concepts in plain language, the phased timeline, what a small business practically needs to do, a data mapping example, a breach response plan and a step-by-step checklist. It is general information, not legal advice.

Key Concepts in the DPDP Act

• Personal data: any data about an individual who is identifiable by or in relation to that data, in digital form, or collected offline and later digitised.
• Data principal: the individual the data is about, such as your customer, employee or vendor contact. For children, it includes parents or lawful guardians.
• Data fiduciary: the organisation that decides the purpose and means of processing. Your business is a data fiduciary for its customers and employees.
• Data processor: an entity that processes data on your behalf, such as a payroll provider, cloud software vendor or marketing agency.
• Significant data fiduciary: a fiduciary notified by the government based on factors like volume and sensitivity of data, with extra obligations. Most small businesses are unlikely to be notified, but check.
• Data Protection Board of India: the body that inquires into breaches and imposes penalties.

Phased Timeline Under the 2025 Rules

The Rules notified in November 2025 brought provisions into force in phases. Broadly:

Phase	What came or comes into force	Approximate timing
Immediate	Provisions establishing the Data Protection Board and related administrative rules	November 2025
After about 12 months	Provisions relating to registration and obligations of consent managers	Around November 2026
After about 18 months	Most substantive obligations: notice, consent, security safeguards, breach intimation, data principal rights, retention and erasure, children's data	Around May 2027

Exact dates and any later changes should be verified against the official notification. Eighteen months sounds generous, but mapping data, fixing vendor contracts and changing forms and software takes time, so starting now is sensible.

Core Obligations for a Small Business

1. Lawful basis: consent or legitimate use

Personal data can be processed with the data principal's consent, or for certain "legitimate uses" specified in the Act, such as where the individual voluntarily provides data for a specified purpose and has not objected, for employment purposes, for compliance with law, or in medical emergencies. Consent must be free, specific, informed, unconditional and unambiguous, given by clear affirmative action, and limited to the data necessary for the purpose.

2. Notice

When seeking consent, you must give a notice that is clear and standalone, in plain language, describing the personal data collected, the purpose, how the person can withdraw consent and exercise rights, and how to complain to the Board. Notices should be available in English or any language in the Eighth Schedule of the Constitution on request.

3. Withdrawal of consent

Withdrawing consent must be as easy as giving it. After withdrawal, you must stop processing (and have processors stop) within a reasonable time, unless another legal basis applies.

4. Security safeguards

Take reasonable security safeguards to prevent personal data breaches, including measures such as encryption or masking, access controls, logging and monitoring, backups, and contractual obligations on processors. The Rules expect logs to be retained for a minimum period (one year is specified for certain logs); verify specifics.

5. Breach intimation

On becoming aware of a personal data breach, you must inform affected data principals without delay and inform the Board, with a detailed report within 72 hours of becoming aware (or a longer period if the Board allows).

6. Retention and erasure

Erase personal data when the purpose is served and retention is no longer required by law, and have processors erase it too. Keep data needed for statutory purposes, such as GST records and payroll records, for the legally required period.

7. Data principal rights

Individuals can request a summary of their data and processing, correction, completion, updating and erasure, grievance redressal, and nomination of another person to exercise rights after death or incapacity. You need a way to receive and respond to these requests within the timelines in the Rules.

8. Children's data

Processing data of children (under 18) generally requires verifiable consent of a parent or guardian, and tracking, behavioural monitoring or targeted advertising directed at children is prohibited, with limited exemptions. Schools, coaching centres, toy shops and kids' activity businesses should pay special attention.

Penalties

The Schedule to the Act sets maximum penalties per instance, including up to ₹250 crore for failing to take reasonable security safeguards, up to ₹200 crore for failing to notify a breach or for violating children's data obligations, and up to ₹50 crore for other breaches of the Act. The Board considers factors such as the nature, gravity and duration of the breach and mitigation steps when deciding amounts. The numbers are designed for large firms, but they signal that the law is serious.

Step 1: Map Your Personal Data

You cannot comply with what you cannot see. A data map lists each category of personal data, why you hold it, where it lives, who can access it and how long you keep it. Here is an example for a hypothetical 40-employee retail and wholesale business in Jaipur:

Data category	Examples	Purpose and basis	Where stored	Retention
Customer billing	Name, phone, GSTIN, address	Invoicing, legal compliance	Billing and accounting software	As required for tax records
Marketing contacts	Phone, email, WhatsApp opt-in	Offers and newsletters, consent	CRM, WhatsApp business tool	Until consent withdrawn
Employee records	Aadhaar, PAN, bank, salary, attendance	Employment, statutory compliance	HRMS, payroll, paper files	As required by labour and tax laws
Job applicants	CVs, contact details	Recruitment, consent	Email, shared drive	Defined period, then delete
CCTV	Video of customers and staff	Security	DVR on premises	30 days rolling (example)
Vendor contacts	Names, phones, bank details	Purchasing and payments	Accounting software	As required for tax records

Step 2: Fix Notices, Consent and Forms

• Update website enquiry forms with a short notice and a separate, unticked consent checkbox for marketing
• Separate transactional messages (invoices, delivery updates) from marketing messages
• Add a consent step for loyalty programmes and WhatsApp marketing lists
• Prepare an employee privacy notice for HR data
• Display a CCTV notice at entrances
• Publish a privacy policy and a contact for data requests

Step 3: Tighten Security and Vendors

• Unique logins and role-based access in every system; no shared passwords
• Two-factor authentication on email, banking and core software
• Encrypted laptops and phones that hold customer or employee data
• Remove access the day an employee leaves
• Written contracts with processors (payroll, cloud software, agencies) covering security, breach notice, use limitations and deletion
• Delete old spreadsheets with customer data from shared drives and personal email

Our data security checklist for small business covers technical controls in more depth.

Step 4: Prepare a Breach Response Plan

1. Name a responsible person and a backup
2. Define what counts as a breach (lost laptop, hacked email, data sent to the wrong customer, ransomware)
3. Contain: disconnect affected systems, change passwords, preserve evidence
4. Assess what data and whose data was affected
5. Notify affected individuals and the Board within required timelines
6. Fix root causes and document lessons

DPDP Act Compliance Checklist for Small Business

• Data map completed and reviewed
• Lawful basis identified for each processing purpose
• Notices and consent forms updated
• Easy consent withdrawal mechanism
• Privacy policy and grievance contact published
• Access controls, two-factor authentication and encryption in place
• Processor contracts updated
• Retention schedule defined, old data deleted
• Breach response plan tested
• Process for data principal requests
• Children's data handling reviewed if relevant
• Staff trained on basics

Choosing Software With Data Protection in Mind

Your business software holds most of your personal data, so its access controls matter. When evaluating any system, check for role-based permissions, audit logs, data export and deletion capability. Fininvo's ERP, HRMS and Payroll products use role-based access; review the details with your own requirements. See pricing. This article is general information, not legal advice; consult a qualified lawyer on your obligations.

Frequently Asked Questions

Does the DPDP Act apply to small businesses?

Yes. The Act applies to any organisation processing digital personal data in India, regardless of size. The government has powers to exempt certain classes of data fiduciaries, including startups, from some provisions, so check current notifications.

When do DPDP obligations start for my business?

Under the phased Rules, most substantive obligations for data fiduciaries are expected to apply about 18 months after November 2025. Verify the exact date in the official notification.

Do I need consent to send invoices to customers?

Processing data to complete a transaction the customer requested, and to comply with tax law, can generally rely on legitimate uses. Marketing messages need consent. Take advice for your specific case.

Does employee data need consent under the DPDP Act?

The Act includes legitimate uses for employment purposes, but you still need security safeguards, appropriate notices and retention limits. Sensitive uses beyond employment may need consent.

Is paper data covered?

The Act covers digital personal data, and personal data collected offline that is later digitised. Purely paper records that are never digitised are generally outside its scope, though other laws may apply.