The DPDP Act for small businesses: what to do with the customer data you collect
Every enquiry, booking and visiting card swapped at a stall leaves you holding someone's name and number. India's data protection law now says what you owe them. Here is when it applies, from when, and a notice you can use.
India's Digital Personal Data Protection Act, 2023 covers any business that keeps people's personal data digitally, including names and numbers from enquiries and bookings. Most of its duties - the consent notice, security, breach reporting - apply from May 2027, eighteen months after the DPDP Rules were published on 13 November 2025. Collect only what you need, say why, let people withdraw, keep it safe.
Sources: Ministry of Electronics and Information Technology, Ministry of Electronics and Information Technology
Profile from ₹199/year · works with no card · add the NFC card for ₹1,699 whenever you want one
Does the DPDP Act apply to a small business?
Yes, if the business keeps people's personal data in digital form - a phone's contact list, WhatsApp chats, a spreadsheet, a booking app - or types up data collected on paper. There is no size threshold. The Act leaves out data used for personal or domestic purposes, and data the person made public themselves.
From section 3 of the Digital Personal Data Protection Act, 2023, read on MeitY's site on 24 October 2026. This is our reading of the law, written for small businesses; it is not legal advice. Part of our guides to leads and bookings.
Covered
- Enquiries from your website or profile
- Booking names and numbers
- Contacts collected at an event or stall
- Customer lists in a spreadsheet or app
Not covered
- Your family's numbers, kept for yourself
- What someone posted publicly about themselves
- Data about a business, not a person
What that makes you
A data fiduciary: PIB's definition is "an entity that decides why and how personal data is processed". The person whose data it is, is the data principal.
When does the DPDP Act start? The dates in the Rules
The DPDP Rules were published on 13 November 2025. The rules setting up the Data Protection Board took effect that day. The rule on consent managers follows one year later. The rules a small business will feel - notices, security, breach reporting, retention, contact details - come into force eighteen months after publication, in May 2027.
Commencement is set out in Rule 1 of the DPDP Rules, 2025, published as G.S.R. 846(E) dated 13 November 2025. PIB's release of 14 November describes it as an "18-month phased compliance timeline".
Consent, or "legitimate use": when you need to ask
The Act lets you use personal data on two grounds: the person's consent, or a "legitimate use" it lists. The one that matters most to a small business is section 7(a): data someone gave you voluntarily, used for the purpose they gave it, until they say no. Anything beyond that purpose needs consent.
The pharmacy receipt
A customer buys from a pharmacy and asks for the payment receipt by SMS, giving her number. The pharmacy may use the number to send the receipt without separate consent: she gave it for that.
The estate agent
Someone messages an estate agent for help finding a flat and shares her details. The agent may use them to send her rentals. When she says she no longer needs help, the agent must stop.
What it means for your enquiries. A person who sends an enquiry for a quote can be sent the quote, and followed up about it. Adding them to festival offers or a broadcast list is a different purpose; for that, ask, with a notice, and keep a record. Section 6(10) puts the burden of proving notice and consent on you.
What valid consent looks like. Section 6(1): "free, specific, informed, unconditional and unambiguous with a clear affirmative action", and limited to the data needed for the purpose. A pre-ticked box is not a clear affirmative action.
Write your consent notice: a builder that follows Rule 3
Rule 3 says a notice must stand on its own, in clear and plain language, list the personal data item by item, state the purpose, and say how to withdraw consent, exercise rights and complain to the Data Protection Board. Fill in the fields and copy the result. It runs in your browser and sends nothing anywhere.
Jay Associates will use the details you give here - your name, mobile number, email address and your message and any files you send - only to reply to your enquiry and send you a quote. You can withdraw your consent at any time, as easily as you gave it, through WhatsApp +91 90000 00000 or jay@mail.com. The same contact lets you ask to see, correct, update or erase your details, or name someone to do so for you. If you are not satisfied with our response, you can complain to the Data Protection Board of India.
Show it next to the form, before the submit button, with a checkbox the person ticks themselves. Section 5(3) says people must be able to read it in English or any language in the Eighth Schedule of the Constitution. A starting point, not legal advice: have it checked if you handle health, financial or children's data.
A DPDP compliance checklist for a small business
Eight things, each from the Act or the Rules: collect only what the purpose needs, give a notice, make withdrawal easy, keep the data secure, report breaches, delete what you no longer need, publish a contact, and answer requests within 90 days. None of it needs software; most of it needs a habit.
Collect only what the purpose needs
Consent is limited to the data necessary for the specified purpose (section 6(1)). A quote needs a name and a number, not a date of birth.
Give a notice before you ask
Itemised data, purpose, and how to withdraw, use rights and complain (section 5, Rule 3). The builder above writes one.
Make withdrawing as easy as agreeing
Section 6(4). If people agree with a tap, they must be able to withdraw with a message.
Keep it secure
Rule 6 lists the minimum: encryption or masking, control over who can access it, logs to spot misuse, and backups. On a phone or a dashboard: a lock, two-factor login, and fewer people with access.
Report a breach
Rule 7: tell each affected person without delay, and the Data Protection Board, with a detailed report within 72 hours.
Erase what you no longer need
Section 8(7): once consent is withdrawn or the purpose is served, unless another law needs you to keep it. Rule 8(3) asks for the data and logs of processing to be kept for at least a year first.
Publish a contact
Section 8(9) and Rule 9: the business contact details of a person who can answer questions about how you use personal data, on your website or app.
Answer requests within 90 days
Access, correction, updating and erasure: PIB says requests must be answered within a maximum of 90 days.
The penalties, for scale. PIB's backgrounder lists penalties of up to ₹250 crore for failing to keep reasonable security safeguards, up to ₹200 crore each for not reporting a breach or for breaking the duties around children's data, and up to ₹50 crore for anything else. The Data Protection Board decides them case by case.
Collecting leads on a profile: what reaches you, and what to do with it
On a Beeps profile, people choose what to share. Enquiries visitors send are relayed to you, and everyone who saves your contact is listed in your dashboard with the name, email and phone they gave. That list exports to PDF or Excel, so the checklist above applies to it the moment you download it.
- Turn on two-factor login. Beeps accounts support an authenticator app; it is the cheapest security safeguard you will ever add.
- Treat exports as data you hold. A spreadsheet of contacts on a shared laptop is the commonest leak there is. Keep it where only you can open it, and delete old copies.
- Use each contact for what it came for. A booking is for the booking; a broadcast list needs consent.
Beeps does not sell anyone's personal information, and every page and API call is served over HTTPS; the details are in our privacy policy. What a profile can and cannot tell you about the people who open it is in can a card tell you who opened it?
DPDP for small businesses: questions
Does the DPDP Act apply to small businesses?
Yes. It applies to digital personal data processed in India, and to data collected on paper and typed in later, whatever the size of the business. It does not apply to data a person processes for personal or domestic purposes, or to data the person made public themselves. A shop that keeps customers' numbers for its business is covered.
When does the DPDP Act come into force for businesses?
The DPDP Rules were published on 13 November 2025. Rule 1 brings the rules on notices, security safeguards, breach reporting, retention and contact details into force eighteen months later, in May 2027. The rules setting up the Data Protection Board applied at once, and the rule on consent managers one year after publication.
Sources: Ministry of Electronics and Information Technology, Press Information Bureau, Ministry of Electronics and IT
Do I need consent to save a customer's phone number?
Not always. Section 7(a) of the Act lets a business use data a person gave it voluntarily, for the purpose they gave it, unless they say no. The Act's own example is a pharmacy sending an SMS receipt to the number a customer gave for it. Using the same number for something else, such as offers, needs consent with a notice.
What are the penalties under the DPDP Act?
Up to ₹250 crore for failing to keep reasonable security safeguards, up to ₹200 crore each for not reporting a breach or breaking the duties for children's data, and up to ₹50 crore for any other breach of the Act or Rules, according to PIB. The Data Protection Board decides penalties case by case.
Sources: Press Information Bureau
Does a small business need a Data Protection Officer?
Only a Significant Data Fiduciary, a business the government notifies as one, must appoint a Data Protection Officer. Every other business must publish the business contact details of a person who can answer questions about its use of personal data, and have a way to handle complaints.
Sources: Ministry of Electronics and Information Technology, Ministry of Electronics and Information Technology
Sources
Facts about other companies and the wider market come from the pages below, as published by them. Each was read on the date shown. Beeps Card prices come from our own pricing page.
- Ministry of Electronics and Information Technology, The Digital Personal Data Protection Act, 2023 (No. 22 of 2023). Checked .
- Ministry of Electronics and Information Technology, Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E), 13 November 2025). Checked .
- Press Information Bureau, Ministry of Electronics and IT, Press release: Government notifies DPDP Rules (14 November 2025). Checked .
- Press Information Bureau, DPDP Rules, 2025 Notified - backgrounder (17 November 2025). Checked .