Security
DPDP Act 2023: A Practical Data Protection Checklist for Small Businesses
· 5 min read · Autobiography Techventures
India's Digital Personal Data Protection Act, 2023 applies to almost every organisation that collects personal data — customer phone numbers, student records, patient details or employee files. Here's a practical starting point. This is general guidance, not legal advice.
Who it applies to
If you collect or process the personal data of people in India in digital form — through a website, app, CRM, billing software or even spreadsheets — the Act is relevant to you.
A practical checklist
- Map what personal data you collect, where it's stored and who can access it
- Collect only what you need, for a clear purpose
- Take clear consent, and make withdrawing it easy
- Publish a simple privacy notice in plain language
- Restrict access by role and remove ex-employees promptly
- Encrypt data, use strong passwords and turn on two-factor authentication
- Keep backups and a plan for responding to a data breach
- Delete data you no longer need
- Make sure vendors handling your data protect it too
Start with a security check
Many data leaks come from basic gaps — outdated websites, shared passwords, open cloud storage. A vulnerability assessment shows you where you stand and what to fix first.
Want help with this?
Get a security & DPDP review