The everyday tools that hold personal data
Small businesses seldom have one system of record. Customer details sit in invoices, chat apps, spreadsheets, accounting software, delivery partners and ad platforms.
Leads and enquiries
Website forms, calls, WhatsApp, social media messages and marketplace leads.
Orders and billing
Invoices, delivery addresses, GST records and customer accounts.
Payments
Payment gateways, UPI records and refunds. Avoid keeping payment details you do not need.
Staff and contractors
Hiring documents, attendance, payroll and access to company accounts.
Marketing tools
Mailing lists, broadcast messages, CRM, ads and retargeting audiences.
Website and apps
Analytics, cookies, chat widgets, hosting and any app that collects user details.
Use business-level descriptions, not customer or employee records, in readiness conversations.
Questions worth asking your team
- Which tools hold customer and employee details, and who owns each one?
- Which details do we collect but never actually use?
- Who outside the team receives them: accountants, couriers, agencies or software vendors?
- How can a customer ask us to stop messaging them or correct their details?
- How long do we keep old leads, orders and ex-employee files?
- Who would respond to a complaint or a suspected incident?
Check before you assume either way
Duties and exemptions depend on your facts and the official text, so avoid assuming that being small means you are exempt, or that every duty applies. Check the official materials or take advice.
Common places to look first:
- Customer lists shared with agencies or freelancers
- Shared logins to billing or CRM tools
- Marketing messages sent to numbers collected only for orders
A first review in four steps
List your tools
Include accounting software, chat apps, spreadsheets, CRM, ad accounts and delivery partners.
Trace a customer’s journey
Follow a customer from first enquiry to invoice, delivery and follow-up messages.
Check access and vendors
Review shared logins, freelancers, agencies and anyone outside the team with data.
Pick the first fixes
Choose a few practical changes and confirm legal points with a qualified professional.
Check the official sources
The applicable law and any exemptions depend on the facts. Do not assume that all organisations have identical duties, or that a checklist alone proves compliance. Check the current official Act, Rules and commencement notifications, and obtain legal advice for segment-specific conclusions.
Official MeitY DPDP Act materials · the DPDP Act guide explains the framework and its commencement schedule.