The 30-minute DPDP guide for small business owners
You run a shop, a clinic, a salon, a sweet shop with a website. No legal team, no time. Here is what the DPDP Act actually asks of you, in half an hour.
- Who this is for
- Owners without a legal team
- What you leave with
- The whole law, mapped to 30 minutes of your time
If your business has a website with a contact form, takes orders on it, or runs a loyalty list, the DPDP Act applies to you. There is no small-business exemption by size or turnover. The good news: for most small businesses the obligations are finite, practical, and mostly about honesty. Here is the whole picture in one sitting.
Minute 0 to 5: know what you collect
Walk through your own website like a customer. Every field that asks for a name, phone, email, or address is personal data collection. Write the list down - it becomes your notice, your retention plan, and your consent map.
Minute 5 to 15: write the notice in your own words
The law does not ask for legalese. It asks you to tell people what you collect, why, how they can withdraw, and how they can complain (Section 5, Rule 3). Four short paragraphs in plain language beat ten pages of boilerplate - and the notice must also be available in English or any Eighth Schedule language your customers need.
Minute 15 to 20: make consent honest
One rule of thumb covers most of Section 6: nothing optional should be pre-ticked, and saying no to marketing must not block the purchase. If you remember only one sentence, remember that withdrawing consent must be as easy as giving it.
Minute 20 to 25: basic safety
HTTPS on every page, passwords stored properly by whoever built your site, and no customer list living in an open spreadsheet link. Reasonable security safeguards (Section 8(5)) scale with your size - but they never round down to zero, and the penalty cap for ignoring them is the Act's largest.
Minute 25 to 30: name a person
Pick who answers if a customer asks about their data, put that contact on the website, and decide today what you would do if data leaked - who you would tell and how. Doing this before an incident is the whole trick.
When you have the half hour, check your website free - it turns this guide into a list specific to your site, scored, with the exact fixes. The deadlines and penalties are collected on our DPDP answers page.
See where your website stands
Free readiness check in about a minute. No card, no signup, no code to install.