Does the DPDP Act Apply to Your Shop or Office? The 10-Point Check Every Small Business Should Do Before 13 November

Probably yes. The DPDP Act covers any business that handles digital personal data of people in India, whatever its size, and that includes customer phone numbers, WhatsApp leads, employee files and CCTV. The main duties begin on 13 May 2027, so the next six
months are the time to prepare.

If you run a shop, clinic, office or small factory, that may sound odd. But if you keep a customer register, bill at a counter, send offers on WhatsApp or pay staff every month, you already handle personal data. The law calls you a data fiduciary. The people whose data you hold are data principals.

This guide explains the DPDP Act for small business owners in plain words. It shows which dates matter, including 13 November 2026, and it ends with a 10-point readiness check you can finish in an afternoon. We build business software at Tazk, so we see how customer and staff data moves through a business. We are not your lawyer, so show your finished checklist to a CA or advocate.

Does the DPDP Act apply to a small business?

Yes, in almost every case. The Digital Personal Data Protection Act, 2023 does not ask how big your business is. It asks one question: do you handle digital personal data?

Yes, in almost every case. The Digital Personal Data Protection Act, 2023 does not ask how big your business is. It asks one question: do you handle digital personal data?

“Personal data” means any detail that can point to a real person. “Digital” means it sits on a computer or phone, or it was on paper and you typed it in later. The Act covers this data when you handle it in India. It also covers a business outside India that sells to people in India (see the Act on India Code).

Three roles are worth knowing:

• Data principal: the person the data is about, such as your customer or your employee.
• Data fiduciary: the one who decides why and how the data is used. That is usually you.
• Data processor: a company that handles data for you, such as your billing, payroll or CRM vendor.

What about MSMEs and startups? Section 17 lets the government excuse some data fiduciaries, including startups, from some duties. But a note from the law firm King Stubb & Kasiva, updated on 30 September 2026, says this is a power, not a ready-made exemption. MSME status alone does not take you out of the Act. We found no notice that frees small businesses as a group. So the DPDP Act applicability question for MSMEs has a simple answer today. Plan as if the Act covers you, and change that only if the government publishes relief for your kind of business.

What counts as personal data in a shop, an office or a payrollfile?

Any detail that points to a real person counts. A name is personal data. So are a phone number, a photo, a bank account number and a face on CCTV video.

Most owners hold more than they think. Here is where it usually hides:

Your point of sale software holds customer details and purchase history. Your lead management software holds enquiries and chats. Paper that stays on paper is outside the Act. Paper that you type or photograph is not.

When do the DPDP dates start, and what changes on 13 November 2026?

Three dates matter. The government published the DPDP Rules on 13 November 2025. A small part starts on 13 November 2026. The main duties start on 13 May 2027.

So why do we say “before 13 November”? Rule 4 commencement is the next date on the calendar, only ten days after we published this guide. It is a handy deadline to finish your first check, not a legal one. A Consent Manager is a registered company that helps people give, view and withdraw consent from one place. Most small businesses will never register as one.

These dates come from Rule 1(2) of the DPDP Rules, 2025 . A 2026 milestones note from King Stubb & Kasiva lists the same phases. The Data Protection Board of India will hear complaints and decide penalties. That note, from August 2026, said the Board’s Chairperson and members were still being chosen, so watch for news.

Do I need consentto store customer phone numbers and billing history?

Sometimes yes and sometimes no. It depends on why you keep the data.

For the job the customer asked for, you usually do not need separate consent. Say a customer gives you a phone number so you can send the bill or call about a delivery. Section 7 of the Act calls this a “legitimate use”. Use it only for that job.

For anything else, you need a clear yes. Sending offers on WhatsApp, adding people to a festival message list or sharing numbers with a partner is a new purpose. The Act says consent must be free, specific, informed and clear. The person must do something to say yes, such as tick a box or reply “YES”. A pre-ticked box does not count. People must also be able to take their consent back as easily as they gave it.

Before you ask, show a short consent notice. Rule 3 lists what the notice must say. It should tell people what data you collect and why. It should also tell them how to withdraw consent, how to use their rights and how to complain to the Data Protection Board of India. A short printed notice at the counter or on the bill, with a link or QR code to the full text, is a good way to start.

Billing history needs a different answer. The Act says to erase personal data once the reason for keeping it is over, unless a law says you must keep it. Tax and accounting laws do ask you to keep invoices for a set period. Ask your CA how long, and write the period down. When it ends, delete the data or remove the names.

How does the Acttreat employee data such as attendance, biometrics and payslips?

Employers get more room here. Section 7 lists several legitimate uses, and employment is one of them. So you can use staff details for hiring, attendance and salary without asking for fresh consent each time. The DPDP Rules 2025 add safeguards for employee data too.

Still, “legitimate use” is not a free pass. Three limits apply.

• Use the data for work only. Attendance times are for pay and shifts. Do not put staff photos or phone numbers in your ads or marketing lists without a clear yes.
• Guard it well. A payslip shows a name, bank account, PAN and salary. Keep access to the people who need it, and keep a record of who opened what
• Take extra care with biometrics. The Act has no separate “sensitive data” class, but a leaked fingerprint cannot be changed like a password. Collect it only if a simpler method will not work, and keep it encrypted.

Former staff count too. When someone leaves, keep the records the law asks for, such as PF, ESI and TDS papers, for the required period. Then delete the rest.

If you run payroll in software, check how the tool handles all this. Tazk’s payroll and HRMS software, for example, offers GPS, selfie, biometric, face and QR attendance, payslips on WhatsApp or email, and an audit trail of changes. Features like these help control who sees staff data. They do not make you compliant on their own.

Who is responsible when a software vendor holds our data?

You are. The Act says the data fiduciary stays responsible for the personal data it controls, even when another company handles that data for it. Section 8 also says you can hire such a data processor only under a valid contract.

Think of a courier. If a parcel goes missing, your customer still comes to you, not the courier. Your billing, payroll and CRM vendors work the same way.

Before you sign or renew with any vendor, ask five questions:

• Where is our data stored? The Act lets the government restrict data transfers to some countries, so you should know. India-hosted servers keep the answer simple.
• Who can see it? Look for role-based access, so a cashier cannot open the salary file.
• How is it protected? Ask about encryption, backups and activity logs. Rule 6 expects safeguards like these.
• What happens after a breach? The contract should say how fast the vendor must tell you, so you can meet your own duty to tell the Board.
• What happens when we leave? Ask how and when they delete your data, backups included.

Get the answers in writing. For example, Tazk’s privacy policy says Tazk acts as a processor for the data a business enters. It also says Tazk stores the data in the AWS India region and removes deleted records from the live system at once and from backups within 30 days. Tazk’s data deletion page explains how an account is closed. Use the same five questions on any vendor, ours included.

What are the penalties, and what should we do first?

The Data Protection Board of India can fine a business, but only after it holds an inquiry and finds a serious breach. The Schedule to the Act sets the highest amounts:

These amounts are ceilings, not fixed fines. Section 33 asks the Board to weigh how serious the breach was, how long it lasted, what kind of data was involved and what the business did to fix it. That is why the DPDP penalty of up to ₹250 crore for weak security matters even to a small firm: safeguards and records are what the law checks first.

Here is a simple DPDP compliance checklist for small business owners. Do points 1 and 2 this week, points 3 to 6 this month, and points 7 to 10 before 13 May 2027.

The 10-point DPDP readiness check

1. . List your data. Write down every place you keep customer, staff and visitor details: the billing system, phones, WhatsApp, Excel sheets, registers and CCTV
2. Name the reason. Write one line on why you keep each item. If you cannot name a reason, stop collecting it.
3. Fix your consent. Offers, festival messages and photo sharing need a clear yes. No pre-ticked boxes. Keep a record of each yes.
4. Write a short notice. Say what you collect, why, how to withdraw consent and how to complain. Put it on your bill, form, website or counter board.
5. Lock the doors. Give each person only the access they need. Use strong passwords,encryption and backups, and keep a log of who opened what.
6. Sign a processor contract. For every software or service company that holds your data, ask for a written contract that covers security and breach alerts.
7. Plan for breach notification. Decide who you call, who tells the customers and who informs the Board. The Board needs a detailed report within 72 hours.
8. Plan data retention and erasure. Keep invoices and payroll records as long as the law asks. Delete the rest when the job is done. Your CA can give you the periods.
9. Name a contact. Publish a phone number or email where people can ask what you hold, fix it, ask you to delete it or complain. Reply quickly.
10. Train and record. Tell your team what they may and may not do with customer data. Keep a one-page record of what you did and when.

When all ten are done, show the list to your CA or a lawyer. They can tell you what else applies to your trade.

Want to see how a business tool handles access and hosting? See role-based access and India-hosted data in a 20-minute Tazk demo.

Want the checklist on your phone? Ask for our DPDP readiness checklist for small businesses, a one-page PDF. We send it on WhatsApp: Get the checklist on WhatsApp.

This guide is general information, not legal advice. Laws and dates can change, so check them with a CA or advocate before you act.