Fluxx Tech
Businesses collect personal data every day: customer names and phone numbers on forms, patient details, employee records, WhatsApp chats, delivery addresses and payment information. India’s Digital Personal Data Protection Act, 2023 (DPDP Act) sets rules for how this digital personal data must be handled.
Note: This is a general overview, not legal advice. Rules under the Act have phased timelines for different obligations. Check the current status and consult a legal professional for your business.
Key ideas in the Act
Concept | What it means |
Data principal | The person whose data it is, such as a customer or employee |
Data fiduciary | The business that decides why and how data is processed |
Data processor | A vendor that processes data on the business’s behalf, such as a CRM or hosting provider |
Consent | Clear, specific agreement to use personal data for a stated purpose |
Notice | Telling people what data you collect, why and how they can exercise their rights |
What businesses should generally do
• Collect only what you need for a clear purpose
• Give clear notice explaining what you collect and why
• Get valid consent where required, and make withdrawing consent easy
• Protect data with reasonable security safeguards
• Respond to rights requests, such as access, correction and erasure, and offer grievance handling
• Delete data when it’s no longer needed for the purpose
• Handle breaches by following notification requirements
• Take extra care with children’s data, including parental consent requirements
Practical first steps
1. Map your data: forms, CRM, spreadsheets, WhatsApp, HR files, apps
2. Review website forms: remove unnecessary fields and add clear notices
3. Update your privacy policy in plain language
4. Check vendors: hosting, CRM, payment and marketing tools
5. Limit access to personal data by role
6. Secure systems: strong passwords, two-factor login, encryption, backups
7. Set a retention policy and delete old data you don’t need
8. Train staff on handling customer and employee data
9. Create a simple process for privacy requests and complaints
Marketing and consent
• Message only people who agreed to hear from you
• Make opting out easy on WhatsApp, SMS and email
• Don’t use purchased contact lists
Frequently asked questions
Does the DPDP Act apply to small businesses? It generally applies to businesses processing digital personal data, though obligations and timelines can vary. Check how it applies to you.
Do I need a new privacy policy? Most businesses should review and update their privacy notice and consent flows.
Does it cover employee data? Employee personal data is personal data too; check how the rules apply to employment use.
