DPDP Act Checklist for MSMEs: 12 Steps Before 13 May 2027

Why order matters

Most DPDP work for a small business is not legal drafting; it is finding out where personal data sits and who can see it. Notices written before that is known tend to be wrong, and vendor reviews started without a vendor list never finish.

The checklist therefore runs in four blocks: know your data (steps 1 to 3), what people see (steps 4 to 6), protect it (steps 7 to 9), and contracts and processes (steps 10 to 12). Each block produces evidence you can show a customer, an auditor or the Data Protection Board.

Keep everything in one compliance folder with dates. Under section 33(2) the Board considers what a business did to mitigate a breach, and a dated folder is the simplest way to show reasonable steps.

What does each block involve?

Knowing your data means listing each data set (customers, leads, employees, CCTV, suppliers), the purpose, where it is stored, who has access and which outside vendors touch it. A spreadsheet is enough.

What people see covers the privacy notice required by section 5 and Rule 3, the wording on forms and onboarding, and separate consent for marketing under section 6. Old WhatsApp and email lists built from billing numbers usually need re-consent.

Protecting data covers individual logins, role-based access, encryption of laptops and backups, tested restores and logs kept for at least a year under Rule 6, plus a one-page breach plan that meets Rule 7’s 72-hour report to the Board.

Contracts and processes cover processor terms with vendors under section 8(2), a retention schedule that respects GST, income-tax and company-law record periods, and a published contact and process for access, correction and erasure requests.

Where do small businesses usually get stuck?

Vendor terms are the most common gap. Many small businesses use ten or more apps that hold personal data and have never checked whether a data processing agreement exists. Most large providers publish one you can accept online; smaller vendors may need a short addendum.

Retention is the second. Deleting data too early can breach tax or labour law, while keeping it indefinitely breaches section 8(7). A CA-built retention schedule resolves the conflict by tying each data set to its statutory period.

Marketing consent is the third. A number collected for an invoice or delivery can be used for that purpose, but promotional messages need specific consent. Re-consenting a list feels risky, yet it is the only clean way to keep using it.

How long does it take?

For a micro business with one website, an accounting package and a payroll app, the twelve steps typically take four to six weeks of elapsed time, mostly waiting on information. A business with branches, several systems or a large marketing database will take longer.

Run the work alongside your existing compliance calendar so the same person owns DPDP, GST, TDS and ROC deadlines. After go-live, a quarterly review of new vendors, rights requests and changes in law keeps the file current.

The 12-step DPDP checklist for MSMEs

1. Map your personal data

   List each data set, its purpose, where it is stored, who can access it and which vendors handle it.

2. Drop what you do not need

   Stop collecting fields that serve no clear purpose and delete stale copies and exports.

3. List every vendor that touches personal data

   Accounting, payroll, CRM, WhatsApp API, email marketing, cloud storage, website developer and IT support.

4. Publish a plain-language privacy notice

   Cover what you collect, why, how to withdraw consent, how to exercise rights and how to complain to the Board (s.5; Rule 3).

5. Fix form and onboarding wording

   Link the notice wherever data is collected: website forms, app sign-up, store billing and employee onboarding.

6. Separate and record marketing consent

   Take specific consent for promotions, keep a consent log, honour opt-outs and re-consent older lists (s.6).

7. Lock down access

   Use individual logins, remove shared passwords and limit access to people who need it (s.8(5); Rule 6).

8. Protect devices, backups and logs

   Encrypt laptops and backups, test restores, patch software and keep access logs for at least a year (Rule 6).

9. Write a one-page breach plan

   Name who decides, who informs affected people without delay and who sends the detailed report to the Board within 72 hours (s.8(6); Rule 7).

10. Put processor terms in vendor contracts

    Accept each provider’s data processing agreement or add a short addendum covering security, breaches and deletion (s.8(2)).

11. Set a retention schedule

    Tie each data set to its statutory record period under GST, income-tax, labour or company law, then erase (s.8(7)).

12. Publish a contact and handle rights requests

    Name a person for data questions and set a simple process for access, correction and erasure requests (ss.8(9), 11–13).