DPDP Act compliance for small businesses: a practical starting point

What the law actually asks

The Act governs the processing of digital personal data. In plain terms, a business must know what personal data it holds, use it only for a stated purpose, and be able to honour the rights of the people it belongs to. It is a set of duties around a single idea: data collected for one reason should not be used for another without consent.

The practical starting point: a data map

You cannot comply with what you cannot describe. The first deliverable is a data map: what personal data you collect, where it is stored, why you hold it, who can see it and how long you keep it. For most small businesses this is a spreadsheet, and building it usually reveals data that no longer serves any purpose.

• List every place personal data enters: forms, email, phone, chat, payments, spreadsheets.
• For each, note the purpose and the legal basis for holding it.
• Note where it lives and who has access.
• Set a retention period and delete what has expired.

Consent, notices and rights

Ask for consent in plain language, before you collect, and say what it is for. Then be ready to honour the core rights: to know what you hold, to correct it, and to have it erased. In practice this means a single, honest process rather than a complex system, and a named person customers can contact.

The upside nobody mentions

Done properly, compliance is just clean data handling. Less duplicate and stale data, one source of truth, clearer access control. Businesses that treat it as hygiene rather than a tax end up with better systems and a credible answer when a client or auditor asks how they handle personal data.