Start by listing the personal data you hold, why you collect it, who can access it and which vendors receive it. Then check your notices, retention and how you would handle a request or incident. These seven steps take a small team a few weeks and need no special software.
- Start with a simple data list, not a policy.
- Most risk sits in everyday tools: spreadsheets, WhatsApp, shared logins.
- Confirm legal questions with a qualified professional.
Why start now
Most business duties under the DPDP Act are scheduled from 13 May 2027. That sounds far away, but mapping data, changing habits and updating forms takes time. Starting early lets you make small, steady changes instead of a rushed fix. See the timeline for dates to verify.
Step 1: List the personal data you hold
Write down every place personal data enters your business. A simple table is enough.
| Where it comes from | What you collect | Where it is stored |
|---|---|---|
| Website or enquiry form | Name, phone, email | Email inbox, CRM, spreadsheet |
| Walk-ins and calls | Name, phone, needs | Notebook, WhatsApp |
| Orders or enrolments | Address, ID, payment details | Billing software |
| Staff | Contact, bank details, attendance | HR sheet, payroll tool |
Step 2: Note why you collect each item
For every row, write one clear purpose. If you cannot explain why you collect something, you may not need it. Collecting less is the simplest way to reduce risk.
Step 3: Check what you tell people
Review your forms and website. Do they explain what you collect, why, and how to withdraw consent or complain? Our consent and notice guide outlines what to include.
Step 4: Review who can access the data
List who can open each system. Remove accounts for people who have left, stop sharing one login and limit who can export or download data.
Step 5: List your vendors and tools
Include accounting software, CRM, ad platforms, courier partners, hosting and messaging providers. For each, note what personal data it receives and who manages the relationship.
Step 6: Decide how long you keep things
Pick a retention rule for each data type, for example “enquiries not converted are deleted after 12 months”, unless a law requires you to keep records. Write the rule down and follow it.
Step 7: Prepare to respond
Name a person who handles requests and a person who handles incidents. Prepare a short incident plan and a simple process for the requests individuals may make.
Frequently asked questions
How long does this take?
For a small team, the first pass often takes a few weeks of part-time effort, mostly spent gathering information and agreeing habits. It depends on how many tools and locations hold data.
Do I need software?
Not to begin. A shared document or spreadsheet is enough to list data, vendors and decisions.
Sources
- MeitY: Digital Personal Data Protection Act, 2023
- MeitY: DPDP Rules, 2025 publication page
- Gazette: G.S.R. 846(E), DPDP Rules, 13 November 2025
- Gazette: G.S.R. 843(E), Act commencement notification, 13 November 2025
Reviewed 3 November 2026. This is general information, not legal advice. Dates and details can change, so check the official sources.