Every business collects personal data. A customer's name and phone number on a bill. A staff member's Aadhaar and bank details. A visiting card photographed at a trade fair. Addresses for delivery. Under the Digital Personal Data Protection Act, 2023, all of this is personal data, and a business that decides why and how it is used has duties under the law.
The Act was passed in August 2023. The government notified the DPDP Rules, 2025 on 14 November 2025, with an 18 month period for phased compliance. The position below is as of October 2026. It is general information and not legal advice.
01Key terms
- Personal data
- any data about an individual who can be identified by or in relation to it. Names, phone numbers, addresses, Aadhaar and PAN numbers, photos, salary details.
- Data principal
- the individual the data is about, such as your customer or employee.
- Data fiduciary
- the business that decides why and how personal data is processed. That is you.
- Data processor
- someone who processes data on your behalf, such as a software provider, a courier or a payroll agency.
- Data Protection Board of India
- the body that oversees compliance and inquires into breaches.
The Act covers digital personal data, and data collected on paper that is later digitised.
02The timeline
The Rules came into effect in phases from 14 November 2025:
- From notification
- the Data Protection Board and the Board's procedures.
- One year from notification
- provisions on consent managers.
- Eighteen months from notification,
- in May 2027: the main duties of data fiduciaries, such as notice, consent, security safeguards, breach reporting and handling the rights of data principals.
The Ministry consulted industry in early 2026 on shortening this timeline. Check the current position on the MeitY website before planning around May 2027.
03The core duties
The Act rests on principles that the Ministry describes as consent and transparency, purpose limitation, data minimisation, accuracy, storage limitation, security safeguards and accountability. For a small business, they mean:
Tell people what you collect and why
When you ask for personal data on the basis of consent, give a clear notice: what data, for what purpose, and how the person can withdraw consent or complain. The Rules require the notice to be separate, clear and easy to understand.
Use data only for that purpose
A phone number collected to send an invoice is not automatically available for marketing. The Act also allows certain legitimate uses without separate consent, such as where a person gives data voluntarily for a specific purpose, or where the law requires it, as with GST and labour records. Ask your adviser which apply to you.
Collect only what you need
A shop does not need a walk-in customer's date of birth. A delivery business needs the address, but not the customer's Aadhaar.
Keep it accurate and secure
Take reasonable security safeguards: own logins for each person, limited access, passwords that are not shared, devices locked, backups. See roles and access.
Delete it when it is no longer needed
Once the purpose is served and no law requires you to keep the data, delete it. Tax and labour laws require you to keep some records for years. Keep those, and delete the rest.
04Rights of the people whose data you hold
Data principals can ask to access their data, correct or update it, and have it erased in certain cases. They can nominate someone to act for them. Under the Rules, data fiduciaries must respond to such requests within 90 days. You must also show a contact for questions about personal data: a designated person, or a Data Protection Officer for larger fiduciaries.
05If there is a breach
If personal data is lost, leaked or accessed without authority, the Rules require you to inform each affected person without delay, in plain language: what happened, the likely impact, what you have done and whom to contact. The Board must also be informed. Penalties under the Act are significant: up to ₹250 crore for failing to take reasonable security safeguards, and up to ₹200 crore for failing to notify a breach.
06Children's data
Processing a child's personal data needs verifiable consent from a parent or guardian, with limited exceptions such as healthcare and education. Schools, coaching centres, toy shops and children's clothing stores should take note.
07What to do now
- List the personal data you hold: customers, staff, suppliers' contact persons, website visitors. Where is it, who can see it, why do you have it?
- Remove what you do not need, such as photocopies of customer IDs kept for no reason.
- Limit access: each person sees only what their job needs.
- Write a short privacy notice for customers and one for staff.
- Name a person who handles questions and requests about personal data.
- Check your processors: your software provider, courier, payroll agency. Where is the data stored, and how is it protected?
- Write down what you will do in a breach: who decides, whom you tell, how fast.
- Train staff on the basics: no customer lists on personal phones, no sharing passwords, no forwarding customer data to anyone outside the business.
08Examples
A Pune clinic with two doctors holds patient names, phone numbers and treatment notes. It limits who can open records, keeps a privacy notice at the front desk and names the practice manager as the contact.
A Jaipur online saree store collects addresses and phone numbers for delivery. It shows a privacy policy at checkout, asks separately before adding customers to offer messages, and deletes old delivery addresses after a set period where no law requires them.
A Rajkot manufacturer with 150 staff holds Aadhaar, bank and family details for PF and ESI. It keeps them in one system with access for HR and accounts only, and removes copies from emails and shared drives.
09Words to use carefully
The Act and the Rules do not set up a compliance certificate for ordinary businesses. Be wary of anyone who offers one. The right description is that a business or a product is DPDP-ready: it has the practices in place that the Act and Rules require.
MatruOS gives each person their own login, invited by email or link; see security for how data is protected.