For MSMEs
DPDP for MSMEs
A manufacturer, distributor, clinic or retailer keeps customer and staff records in billing software, spreadsheets, email and phones. DPDP applies to that data too.
Short answer
DPDP applies to digital personal data, including data collected on paper and later digitised (s.3), so an MSME that keeps customer or staff records in software is a Data Fiduciary. Core obligations begin on 13 May 2027: notice and consent (Rule 3, s.6), contracts with software vendors that process data for you (s.8(2)), security safeguards (Rule 6), breach intimation (Rule 7) and a published grievance period of no more than 90 days (Rule 14(3)).
What DPDP means for a small business
If you hold a customer's name and phone number in billing software, that is personal data. So are your staff records, your CCTV footage and the contact list in your CRM.
For staff, you can process data for employment purposes without consent, as a legitimate use under s.7(i). For customers, you need consent or another s.7 ground for each purpose.
A checklist in plain words
- Write down where customer and staff data is kept: software, spreadsheets, email, phones and paper files you scan.
- Collect only what you need for each purpose.
- Give customers a short notice saying what you collect, why, and how to withdraw consent or complain.
- Ask separately before sending marketing messages, and stop when someone says no.
- Limit who can open customer and staff files, and use strong passwords with two-step login.
- Name one person to answer questions about personal data and publish their contact (Rule 9).
- Delete data you no longer need for its purpose, unless a law says to keep it (s.8(7)).
- Tell customers how to ask for their data, correct it or have it erased, and answer within your published period.
- Know what you will do in the first hours of a breach.
Questions to ask your software vendors
- Where is our customers' data stored, and who on your side can see it?
- Will you tell us without delay if there is a breach?
- How do we delete one customer's data when asked?
- Which other companies process our data for you?
- Where are your security and data processing terms?
Contracts with the software you use
Accounting, billing, CRM, email and cloud storage tools process your customers' data for you. Under s.8(2) you need a valid contract with each, which for most SaaS tools means their data processing terms. Read them for security, breach reporting and deletion, using our processor contracts guide.
If something goes wrong
A breach can be as small as an email sent to the wrong list or a lost phone with customer files on it. Under Rule 7, tell each affected person and the Data Protection Board without delay, then give the Board a detailed report within 72 hours. Write down who will do this before you need it.
No Board members have been appointed yet, but that does not move the 13 May 2027 date. Plan as though the duties apply from that day.
How TruePrivacy helps
- Data discovery connects to databases, Google Drive and other sources to find personal data you forgot you had.
- Consent management and the privacy center give customers a place to manage choices and make requests.
- Vendors and processors keeps your software contracts in one list.
- Pricing: Priced on scope, never per seat. Unlimited users. Quotes in INR, GST extra.
Does DPDP apply to paper records?
DPDP applies to digital personal data, including data collected on paper and later digitised (s.3). Paper records that are never digitised fall outside it.
Do we need consent from our employees?
Not for employment purposes or for safeguarding the business from loss or liability, which s.7(i) makes a legitimate use. Other uses need another ground, usually consent.
Do I need a lawyer?
For notices and contracts, a review by counsel is worth it. Much of the operational work, such as mapping data and setting retention, you can do yourself.
What does TruePrivacy cost?
Priced on scope, never per seat. Unlimited users. Quotes in INR, GST extra.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin