DPDP and small businesses: the myth that it only applies to big companies

Many shop owners, freelancers, accountants and clinic operators think the new privacy law is meant for large technology companies. It is not. The main duties of the DPDP Act start on 13 May 2027, and they cover small businesses too.

Why it applies to you

If you decide why and how personal data is used, you are a Data Fiduciary, whatever your size. Collecting names, phone numbers, addresses or payment details on a computer or phone counts. The Government can exempt certain classes of businesses from some duties, but only by notification, so do not assume you are exempt.

Three everyday slips

• Insisting on a phone number at checkout. You may collect only the data you need for the purpose. Refusing to bill someone because they will not give a mobile number for your marketing list is hard to defend.
• Forwarding customer lists on chat groups. Sending spreadsheets of phone numbers and addresses to open groups is a security risk, and the Act expects reasonable safeguards.
• Keeping old lists forever. When the purpose is served, the data should go, and customers need a way to ask you to delete it.

A fix that does not need a big budget

1. Collect only what you need to complete the sale.
2. Password-protect customer lists, and share them only with people who need them.
3. Give people one email address or phone number for requests to see, correct or delete their data, and answer promptly.
4. Delete lists you no longer use.

The penalties in the Act are ceilings, up to ₹250 crore for failing to protect data. The Board looks at the nature and seriousness of each case, but there is no reason to take the risk with data you do not need.

Simple rule: even a solo freelancer or local shop must protect customers' phone numbers and stop collecting data it does not need.

Check your readiness for free in a few minutes.

General information, not legal advice. Check the Act and Rules before relying on it.