DPDP Act for Small Businesses: 10 Practical Steps
The DPDP Act covers large companies and small ones alike. Any business that holds personal data in digital form has to think about it, and that includes consultants, advocates, insurance and loan agents, HR teams and small shops that take identity documents.
Most of the duties begin on 13 May 2027. The steps below are practical, and most can be done in a few weeks.
1. Find out what personal data you hold
List every place personal data sits. That includes customer documents, staff records, KYC files, email attachments and the phones your team uses. You cannot protect data you have not found.
2. Stop using personal phones and email for ID documents
Personal devices and accounts are the most common source of trouble. When an employee leaves, their phone and inbox leave with them. Move identity documents to a business-controlled location.
3. Collect only what the service needs
If you do not need a document to deliver the work, do not ask for it. Smaller requests create less data to protect, and clients respond faster when the list is short.
4. Tell people what you collect and why
Write a short notice. Say what you collect, why you need it, how long you keep it and who to contact with questions. Ask people to acknowledge it, and keep the record.
5. Limit access by role
Give each person access to the data their job requires, and no more. A receptionist who collects a form does not need access to the full file.
6. Keep a record of who opened sensitive files
A simple access record helps you answer questions later. Who opened the file, and when? Without that record, you are guessing.
7. Set retention rules for each type of document
Decide how long you keep each type of document, and check that period against the laws that require you to keep it. Delete the rest on a set schedule.
8. Use approved tools for documents
Avoid free online tools that compress, convert or scan identity documents. They may upload files to servers you do not control. Write a one-line rule for your team and make sure everyone knows it.
9. Prepare a breach response
Write a one-page plan. It should name who acts, how you check what happened, how you contain it, and when you tell the people affected. Practise it once, even as a short conversation.
10. Name someone to handle questions and complaints
People will ask what you hold about them and may complain. Name one person responsible for those requests, and tell customers and staff how to reach them.
Review the basics every quarter
Every three months, check three things. Are the people with access still the right people? Are any identity documents sitting on personal devices? Are old files past their retention date? A short review of this kind catches drift before it becomes a problem.
Questions people ask
Does this apply to a small shop that keeps ID copies?
Yes, if those copies are held in digital form. Keep them only as long as you need them, restrict who can see them, and remove them when they are no longer needed.
Do I need a consent form?
The Act relies on notice and consent in many situations. Write a short notice and ask customers to acknowledge it. Ask your lawyer which wording fits your business.
Where should I begin this month?
Start with steps 1 and 2. Find where personal data sits, and move identity documents off personal devices. Those two steps remove most of the immediate risk.
The DPDP checklist walks through these steps in order.
