DPDP Rules 2025: what small businesses must do

The DPDP Rules 2025 come fully into force on 13 May 2027, and they apply to any small business that keeps customers' personal data in digital form, however small. In practice that means a plain consent notice, collecting only what you need, keeping it safe, answering requests on time and reporting leaks quickly.

Picture a dental clinic in Salt Lake (an example, not a real client). It has a booking form on its website, patient phone numbers in a billing app and years of WhatsApp chats on the receptionist's phone. All of that is digital personal data under the new rules.

This is a plain summary, not legal advice. Read the official notice, and check anything you're unsure about with a lawyer.

When the DPDP Rules 2025 apply

The Digital Personal Data Protection Act was passed in August 2023. Its Rules were notified in November 2025 with an 18-month phased timeline (PIB, as of November 2026).

Dates from AZB & Partners, as of November 2026. The last row is the one that matters for most shops, clinics and coaching centres.

The law calls a business that decides why and how data is used a "Data Fiduciary". A one-person salon taking bookings online is one.

What you must do

Here is the short list. Each point has its own section below.

1. Tell people what you collect and why, in a standalone notice, before you collect it.
2. Get clear consent, and make withdrawing it as easy as giving it.
3. Collect only what the purpose needs, and delete it when you're done.
4. Keep it safe, with access controls, backups and logs.
5. Show a contact for privacy questions, and answer requests within 90 days.
6. Report a leak to the people affected and to the Data Protection Board.
7. Take extra care with children's data, which needs verifiable consent from a parent.

A consent notice in plain words

The Rules require a standalone, clear and simple notice that explains the specific purpose for collecting the data (PIB). Put it right next to the form or button, not only in a privacy policy nobody opens.

A booking form notice can be this short:

Then check each place you collect data: website forms, the register at the counter if it's typed into a computer, WhatsApp, Google Forms and your billing app. Each one needs a notice and a reason. Our guide on what a clinic website needs shows a booking form built this way.

Coaching centres need special care. Data about anyone under 18 needs verifiable consent from a parent or guardian, with limited exceptions for things like education and safety.

Keep less, keep it safe

The easiest data to protect is data you never collected. Remove fields you don't use, and stop asking for things "just in case".

• Booking forms: name, phone, service and time. Not date of birth, address or medical history.
• WhatsApp: don't ask for reports or ID photos in chat. Ask people to bring them.
• Old data: set a rule, say one year after the last visit, and delete or anonymise older records.

The Rules set minimum safeguards, including encryption or masking, access controls, logs that watch for unauthorised access, backups, and keeping logs for one year (AZB & Partners). For a small business that means each staff member gets their own login, ex-staff lose access on their last day, and backups are tested.

People also get rights to access, correct and erase their data. You must answer such requests within 90 days at most. Put a named contact on your website so they know where to ask.

Check the people who handle data for you

Your billing app, booking software, web host and WhatsApp provider all handle your customers' data on your behalf. The Rules say your security safeguards must also cover data processed through them, and that contracts with them should include security obligations.

Ask each of them three questions: where is the data stored, who can see it, and how do I get a full export or have it deleted? Keep their answers on file.

If something leaks

A leak can be a stolen phone, a hacked website or a spreadsheet sent to the wrong group. The Rules say you must tell everyone affected without delay, in plain language: what happened, the likely impact, what you've done and who to contact (PIB backgrounder).

You must also inform the Data Protection Board, with a fuller report within 72 hours. Write a one-page plan now: who decides, who messages customers, and which lawyer you call.

What the penalties are

The penalties are large. These are the maximums, as of November 2026:

• Up to ₹250 crore for failing to keep reasonable security safeguards.
• Up to ₹200 crore for not reporting a breach, or for breaking the rules on children's data.
• Up to ₹50 crore for other breaches of the Act or Rules.

Source: the PIB backgrounder. The point isn't fear. Six months is enough time to fix forms, logins and backups calmly.

If you'd like help

Our client sites come with a consent notice by every form, no tracking cookies and a data export the owner controls. Ask for a free audit of your forms and data, or WhatsApp us on +91 62918 31815.