India’s Digital Personal Data Protection Rules are becoming a practical concern for businesses that collect customer details online. A shop may ask for a phone number to send delivery updates; a clinic may store appointment records; a small software firm may use an email platform for newsletters. These everyday activities involve personal data. The framework asks organizations to handle that information carefully, explain why they need it and give people workable ways to exercise their rights. Here is a plain-English guide to what small businesses should understand and the steps they can begin taking.
What are India’s DPDP Rules?
The Digital Personal Data Protection Act, 2023 sets India’s broad framework for handling digital personal data. The Digital Personal Data Protection Rules, 2025 add practical details, including how notices should be written, how consent can be managed and what security and grievance processes should look like. The Ministry of Electronics and Information Technology published the Rules in the Gazette on 13 November 2025.
The Act uses “Data Fiduciary” for an organization that decides why and how personal data is processed. In everyday terms, if your business decides to collect customer names to fulfil orders or to run a mailing list, it may have responsibilities as a Data Fiduciary. A technology provider that handles information on your instructions may be a Data Processor. Outsourcing a task does not make it sensible to ignore what happens to customer information, so understand what your service providers do.
The Rules take effect in phases
Not every obligation began on the same date. Rules 1, 2 and 17 to 21 took effect when the Gazette was published. Rule 4 is due to take effect one year after publication. Rules 3, 5 to 16, 22 and 23 are due to take effect eighteen months after publication. Check the exact provision and timeline before treating a requirement as currently enforceable. The official Gazette is the best source for the wording and dates.
A phased timeline is still a reason to prepare early. Updating forms, mapping data, reviewing vendor agreements and training staff all take time. A small company that starts with a clear inventory and a few practical fixes is less likely to face a last-minute scramble than one that waits until every date is close.
Start with a simple map of personal data
List the personal data your business collects, where it comes from, why you need it, where it is stored, who can access it and when it is deleted. Include information in website forms, customer support inboxes, spreadsheets, billing tools, booking apps, marketing platforms, paper files and staff devices. You do not need an expensive system to begin. A clear spreadsheet can help a small team understand what it holds.
For each item, write down the business purpose. A delivery address may be needed to send an order. A phone number may be used for a delivery update. A marketing email list serves a different purpose from order fulfilment, so avoid treating every contact detail as permission for every future use. If a field has no clear purpose, ask whether you can stop collecting it. Less data often means less to protect and less to clean up later.
Write notices that people can understand
The Rules call for notices that can stand on their own and use clear, plain language. A privacy notice should tell people what kinds of personal data you collect and the specific purposes for using it. It should also explain how they can withdraw consent, exercise rights under the Act and make a complaint. Put the notice close to the form or action where the information is collected, so a customer can make an informed choice at the right time.
Avoid a vague sentence such as “we may use your information to improve our services.” Explain the real activity. For example, a booking site might say it uses a name and phone number to confirm an appointment and send changes. If it also sends promotional messages, describe that separately and provide an appropriate choice. Do not promise controls your business cannot actually support.
Make consent and withdrawal practical
Where your business relies on consent, keep a record of what the person agreed to and when. Save the wording shown, the date and method of consent, and any later change or withdrawal. Make it easy to find out how to withdraw consent. If joining a mailing list takes one click, leaving it should not require a long phone call and several follow-up emails.
Review old contact lists before using them for a new campaign. A list gathered for order updates may not be a suitable list for unrelated promotions. Train staff to recognize requests such as “stop sending me messages” and route them to a consistent process. A shared inbox or tracked form can prevent a request from being forgotten when the person who received it is away.Set a basic security routine
The Rules require reasonable security safeguards to protect personal data. For a small business, basic practices matter: use unique passwords, turn on multi-factor authentication where available, limit account access to people who need it, install updates, secure staff phones and laptops, and remove access when a worker leaves. Avoid sending customer lists through personal email or storing them in an unprotected shared folder.
Make a backup plan and test that you can restore important records. Protect backups too, because a copied customer file can create the same privacy problem as the original. Readers can also see our guides to cloud backup tools and passkeys for small businesses for related steps to protect files and strengthen account sign-ins.
Prepare for incidents before one happens
Write down who staff should contact if a phone containing customer records is lost, an account is taken over or a file is sent to the wrong recipient. The first steps are usually to stop further access, preserve relevant details and alert the person responsible for privacy and security. Keep a list of key vendors and support contacts where it can be reached during an incident. The Rules include requirements related to personal data breaches, so check the applicable provision and current timeline in the official text and seek qualified advice about your specific obligations.
Do not wait until an incident to decide who can reset a compromised account or notify a service provider. A short incident checklist, a named lead and a backup contact can save time. After an incident, record what happened, what data may be affected, what you did to contain it and what change could prevent a repeat. Avoid guessing about the impact before checking the facts.
Review the tools and vendors you rely on
List the services that can access customer information: website hosts, payment providers, cloud storage, bookkeeping platforms, messaging tools and marketing software. Check which staff accounts can access them, whether former workers still have access and whether you know how to export or delete data when needed. Ask vendors how they protect information, how they notify you of a breach and what happens to customer data when you stop using the service.
A contract or help page does not replace a sensible review. Confirm that each tool is still needed, turn off features that collect information you do not use, and remove old exports from laptops or shared folders. If you handle particularly sensitive records, get professional advice before choosing a service or changing how information is stored.
Give customers a clear contact route
The Rules require businesses to publish contact information for a person who can answer questions about personal data processing, where applicable. A small company can make a clear email address or support route available and assign someone to monitor it. Staff should know how to forward a privacy request instead of answering from memory or dismissing it as a general complaint.
Keep a basic record of requests, including when they arrived, who is handling them, what action was taken and when the customer received a response. Do not collect more identity documents than you need to confirm a request. A consistent process helps customers and gives the business a record of its response.
A practical first-month checklist
During the first week, list the places where customer and employee data is stored. During the second, remove unnecessary fields and close unused accounts. During the third, review your privacy notice, consent wording and contact details. During the fourth, check access controls, backups, vendor contacts and your incident plan. Assign an owner to each task and a review date. This is a starting point, not a claim that a checklist alone guarantees compliance.
Keep the plan proportionate. A local store with a booking form and a small mailing list will have a different data map from a company running a large app. The useful first step is to understand what your business actually does, then check the Act and Rules against those activities. Avoid copying a policy written for a much larger organization if it does not describe your own practices.
Conclusion
India’s DPDP framework makes responsible data handling a business task, not just a legal document to place on a website. Small businesses can begin by understanding what they collect, explaining why, reducing unnecessary access, reviewing service providers and making privacy requests easier to handle. The Rules start in phases, so verify the relevant dates and wording before making compliance claims. Use the official Gazette as your primary reference and consult a qualified professional for advice about your business. Clear processes can also build customer trust: people are more comfortable sharing information when they understand how it will be used and who to contact with questions.
Official source: Digital Personal Data Protection Rules, 2025 (Gazette of India)