Most conversations about data protection in India assume a tech company with millions of users. But the Digital Personal Data Protection Act applies just as much to a dental clinic with 3,000 patient records, a salon with a WhatsApp broadcast list, or a coaching centre holding students' and parents' phone numbers.
This is a plain-language overview, not legal advice. For your specific situation, speak to a lawyer or a CA who works on DPDP compliance.
Where things stand
The Digital Personal Data Protection Act, 2023 is law, and its Rules were notified in November 2025. Most duties for businesses (notice, consent, security, breach reporting) apply from May 2027. That gives small businesses a window to get ready without panic, and it's enough time if you start with the basics now.
Does it apply to my business?
If you collect personal data in digital form, or collect it on paper and then digitise it, the Act applies. Personal data means anything that identifies a person: name, phone number, email, address, date of birth, photos, health or financial details.
In practice that includes:
- a customer or patient list in Excel, Google Sheets or billing software
- WhatsApp chats and broadcast lists
- website enquiry forms
- appointment and booking systems
- CCTV footage in many cases
- staff records
Under the Act, your business is the data fiduciary, the one who decides why and how the data is used. Software you use to process it, such as a CRM or a booking app, is a data processor. You remain responsible for what your processors do with it.
What the Act asks of you, in plain terms
1. Tell people what you're collecting and why. Before or when you collect personal data, give a clear notice: what you collect, what it's for, and how someone can withdraw consent or complain. It must be in plain language, and people can ask for it in English or any of the 22 languages in the Eighth Schedule of the Constitution.
2. Get proper consent, for a specific purpose. Consent must be free, specific, informed and clear, given by an action like ticking a box, not assumed. Collecting a phone number for appointment reminders doesn't automatically let you send promotional offers to it.
3. Make withdrawal easy. Withdrawing consent should be as easy as giving it. A simple "reply STOP" or a link is the kind of thing that meets the spirit of this.
4. Use it only for what you said. Data collected for one purpose shouldn't drift into others.
5. Protect it. You need reasonable security safeguards. For a small business that means basics done consistently: separate logins, strong passwords, two-factor authentication, limited access, backups, and not leaving customer lists on shared or personal devices.
6. Delete it when you're done. When the purpose is over and you no longer need to keep the data, for legal reasons such as tax records for instance, it should be erased.
7. Report breaches. If personal data is leaked or accessed without permission, you must inform the Data Protection Board and the affected people.
8. Take extra care with children's data. Processing data of anyone under 18 generally requires verifiable consent from a parent. That matters for schools, coaching centres, paediatric clinics and kids' activity businesses.
9. Give people a way to reach you. People can ask what data you hold about them, ask for corrections or erasure, and complain. Name a person and a contact (a phone number or email) who handles these.
Penalties under the Act are large, up to ₹250 crore for the most serious failures such as not having reasonable security safeguards. When setting a penalty, the Board weighs factors such as how serious the breach was, how long it lasted, what was done to limit it, and the likely impact of the penalty on the business. The realistic risk for most small businesses is a complaint from an unhappy customer, and that is enough reason to be ready.
Where AI comes into it
AI tools often handle personal data: a WhatsApp chatbot reading customer messages, an assistant summarising patient feedback, staff pasting a customer list into ChatGPT. Everything above applies. In short:
- Don't paste identifiable customer data into general AI tools. See is ChatGPT safe for business data?
- If a vendor's AI system processes your customers' data, have a written agreement covering security, where the data is stored, and deletion when the contract ends.
- Tell customers when they're talking to an automated assistant, and give them an easy way to reach a person.
Checklist: getting ready for DPDP
- List every place customer, patient, student or staff data is stored: registers, sheets, phones, software, WhatsApp
- Note why you collect each piece of data, and stop collecting what you don't use
- Add a short, plain-language notice and consent line to forms, booking pages and WhatsApp opt-ins
- Separate consent for reminders from consent for promotions
- Give each staff member their own login; turn on two-factor authentication
- Decide how long you keep each type of data, and delete old records you no longer need
- Name one person who handles data requests and complaints
- Get written data-protection terms from software vendors and agencies that handle your customer data
- Write down what you'd do in the first 24 hours if a customer list leaked
If you're putting AI into customer conversations and want it set up within these rules, our AI consulting covers data flows as part of the plan. For the wider legal picture, read is there an AI law in India?.
