In your business

Start with Section 3. The Act applies to the processing of digital personal data within India where the personal data is collected in digital form, or collected on paper and digitised subsequently (Section 3(a)). It also applies to processing outside India "in connection with any activity related to offering of goods or services to Data Principals within the territory of India" (Section 3(b)). There is no turnover threshold and no headcount threshold; a two-person firm with a customer spreadsheet is in.

Section 3(c) sets out what is not covered: personal data processed by an individual for a personal or domestic purpose, and personal data made publicly available by the Data Principal herself or by someone under a legal obligation to publish it. The Act's own illustration is a person blogging her views on social media.

With that settled, make the inventory. List every place personal data sits: the CRM, the billing system, payroll, the appointment book, the shared drive, the WhatsApp groups you use with customers, the forms on your website, and the vendors that hold any of it. For each, note whose personal data it is, what fields you hold, why you collect it, where it is stored, and who can see it. Include employees; their personal data is digital personal data like anyone else's.

This map is the foundation for everything that follows. The notice in the next lesson is written from it, the consent decisions in lesson three are made purpose by purpose from it, and the retention schedule in lesson five is attached to it. Keep it as a living document rather than a one-time exercise, and give one person the job of keeping it current.

SaralPrivacy's readiness assessment opens with this inventory and scores the gaps against the Act.

Section 5(1) requires that every request for consent be accompanied or preceded by a notice telling the Data Principal three things: the personal data and the purpose for which it will be processed; how she can exercise her right to withdraw consent under Section 6(4) and her right of grievance redressal under Section 13; and how she can make a complaint to the Board. Section 5(3) requires the option to read the notice in English or in any language listed in the Eighth Schedule to the Constitution.

Rule 3 turns that into a specification. The notice must be "presented and be understandable independently of any other information" the business provides (Rule 3(a)), so a line buried in a long policy does not qualify. It must give, in clear and plain language, an itemised description of the personal data and the specified purpose or purposes, with a specific description of the goods or services being provided (Rule 3(b)). And it must give the link to the website or app, and any other means, through which the Data Principal can withdraw consent as easily as she gave it, exercise her rights, and complain to the Board (Rule 3(c)). Rule 3 applies from 13 May 2027, but there is no reason to write a notice that will need rewriting then.

Section 5(2) deals with the customers you already have. Where consent was given before the Act commenced, give the notice "as soon as it is reasonably practicable", by email, in-app notification or another effective method, and you may continue processing until the Data Principal withdraws consent.

Write one notice per purpose or per product flow rather than one document for the whole business. Use the inventory: each row that relies on consent needs a notice that names its data items and its purpose.

SaralPrivacy's privacy notice generator at https://saralprivacy.com/tools/dpdpa-privacy-notice-generator produces a notice structured to Rule 3 from your inventory.

Go back to the inventory and, for each purpose, decide which of two grounds you are relying on.

The first is consent. Section 6(1) requires it to be "free, specific, informed, unconditional and unambiguous with a clear affirmative action", and limits it to the personal data necessary for the specified purpose. Section 6(3) requires the request to be in clear and plain language, available in English or an Eighth Schedule language, and to carry the contact details of the Data Protection Officer or another person authorised to respond to the Data Principal. Section 6(4) gives her the right to withdraw at any time with ease comparable to giving it, and Section 6(6) requires you, within a reasonable time, to stop processing and to cause your Data Processors to stop, unless the law otherwise requires the processing. Section 6(10) puts the burden on you: in any proceeding you must prove that notice was given and consent obtained. So record, for each consent, when it was given, what the notice said, and how it can be withdrawn.

The second ground is a legitimate use under Section 7. The most useful for a small business is Section 7(a): personal data the Data Principal voluntarily provided for a specified purpose, where she has not indicated that she does not consent to its use. The Act's illustration is a pharmacy customer who asks for a receipt by phone message. Section 7(i) covers processing for the purposes of employment and for protecting the employer from loss or liability. Other clauses cover compliance with a court order, medical emergencies, epidemics and disasters. Legitimate use needs no consent request, but it is bounded by the purpose the Data Principal had in mind.

If you process children's personal data, Section 9(1) requires the verifiable consent of the parent or lawful guardian first, Section 9(2) forbids processing likely to cause a detrimental effect on a child's well-being, and Section 9(3) forbids tracking, behavioural monitoring and targeted advertising directed at children. Rule 10, which applies from 13 May 2027, requires due diligence that the person identifying as the parent is an identifiable adult, using identity and age details you already hold, details she provides voluntarily, or a virtual token from an authorised entity such as a Digital Locker service provider.

SaralPrivacy's assessment records the ground for each purpose and flags where a consent record is missing.

Two short obligations sit in Section 8, and both are visible to every customer.

Section 8(9) requires a Data Fiduciary to publish the business contact information of its Data Protection Officer, where one is required, or otherwise of "a person who is able to answer on behalf of the Data Fiduciary" the questions a Data Principal raises about the processing of her personal data. Rule 9 says where: prominently on the website or app, and in every response to a communication in which a Data Principal exercises her rights. Rule 9 applies from 13 May 2027. A small business does not need a Data Protection Officer unless it is notified as a Significant Data Fiduciary (module 4); it does need a named person and a working address.

Section 8(10) requires "an effective mechanism to redress the grievances of Data Principals". Section 13(1) states the same thing from the Data Principal's side as a right to readily available means of grievance redressal, and Section 13(2) requires a response within the period the Rules prescribe. Section 13(3) is the part that protects you: a Data Principal must exhaust your grievance route before approaching the Board. A route that works is your first and best line, because a matter that is resolved there never becomes a complaint.

The mechanism can be simple. A dedicated email address or form, a register that logs the date received, the request, the person handling it and the date closed, and a template reply that names the contact person as Rule 9 requires. Decide who is on duty for it and who covers when they are away. Test it by sending yourself a request and timing the response.

Put the contact and the grievance route in the notice from lesson two, since Section 5(1) requires the notice to explain how rights and grievances are exercised.

SaralPrivacy's assessment checks that the contact person and grievance route are published where Rule 9 and Section 8 require them.

Section 8(7) is the retention rule. Unless retention is necessary to comply with a law in force, a Data Fiduciary must erase personal data when the Data Principal withdraws consent, or "as soon as it is reasonable to assume that the specified purpose is no longer being served", whichever is earlier, and must cause its Data Processors to erase what it gave them. The Act's illustrations are a used-car listing that is erased once the sale concludes, and a closed bank account whose records are kept because banking law requires it.

Section 8(8) adds a deeming rule: the purpose is treated as no longer served if the Data Principal neither approaches you for the purpose nor exercises any of her rights for a prescribed period. Rule 8(1) sets those periods for the classes of Data Fiduciary listed in the Rules; if you are not in a listed class, the general test in Section 8(7) governs. Rule 8(2) requires, for those classes, at least forty-eight hours' notice to the Data Principal before erasure so she can log in or make contact and keep her account.

Rule 8(3) runs the other way and applies to every Data Fiduciary. Personal data, associated traffic data and other logs of processing must be retained for a minimum of one year from the date of processing, for the purposes the Rules specify, and erased after that unless another law requires longer. The Rule's own illustration is an e-book purchase: the order, payment and delivery records stay for a year even if the buyer deletes her account. Rule 8 applies from 13 May 2027.

Build the schedule from the inventory. For each purpose, write down the trigger for erasure (consent withdrawn, order fulfilled, employee left), the legal hold that overrides it (tax, labour, sectoral rules), and the one-year log retention under Rule 8(3). Then check that each system can actually delete, and that each vendor contract obliges the Data Processor to delete on your instruction.

SaralPrivacy's assessment produces a retention schedule against this inventory.

Section 8(5) requires a Data Fiduciary to protect personal data in its possession or under its control, including processing done on its behalf by a Data Processor, "by taking reasonable security safeguards to prevent personal data breach". Section 8(2) requires any Data Processor to be engaged under a valid contract, and Section 8(1) keeps you responsible for what that Data Processor does with your personal data.

Rule 6(1) lists the minimum safeguards: securing personal data through encryption, obfuscation, masking or virtual tokens; controlling access to the computer resources involved; keeping logs and monitoring so unauthorised access can be detected, investigated and remedied; backups or other measures so processing can continue after a loss; retaining those logs and the personal data for one year for that purpose; a provision in the Data Processor contract requiring safeguards; and technical and organisational measures to make all of it stick. Rule 6 applies from 13 May 2027. For a small business this is a checklist: strong passwords and two-factor login, role-based access, encrypted backups, audit logs turned on, and a clause in every vendor agreement.

Section 8(6) requires that, in the event of a personal data breach, you intimate both the Board and each affected Data Principal. Rule 7 gives the form and the clock. Rule 7(1): tell each affected Data Principal, without delay and in plain language, through her account or a registered mode of contact, what happened, what it likely means for her, what you are doing about it, what she can do to protect herself, and whom to contact. Rule 7(2): tell the Board without delay a description of the breach, and within seventy-two hours of becoming aware of it, or a longer period the Board allows on written request, send the detailed facts, causes, mitigation, findings on who caused it, steps to prevent recurrence, and a report of the intimations sent to Data Principals. Rule 7 applies from 13 May 2027.

Write the playbook before it is needed: who declares a breach, who drafts the two notices, where the templates live, and who speaks to the Board.

SaralPrivacy's assessment includes breach-readiness questions and template notices for Rule 7.

If you have followed the sequence, you now have an inventory that shows where the Act applies (Section 3), a notice for each consent-based purpose written to Rule 3applies from 13 May 2027 and Section 5, a recorded ground for every purpose under Section 6 or Section 7 with parental consent handled under Section 9 and Rule 10applies from 13 May 2027 where it arises, a published contact person and a grievance route that satisfy Section 8, Rule 9applies from 13 May 2027 and Section 13, a retention schedule built on Section 8(7) and Rule 8applies from 13 May 2027, and safeguards and a breach playbook that answer Section 8(5), Rule 6applies from 13 May 2027 and Rule 7applies from 13 May 2027.

What remains is to test it against the whole of the law rather than lesson by lesson, and to keep it current as the Rules come into force through 13 May 2027 and as your business changes. That is the point at which this course hands over.

SaralPrivacy's readiness assessment at https://saralprivacy.com/assessment takes the inventory you built in these ninety days, scores it against the Act and the Rules provision by provision, and returns a prioritised list of what to fix next. The privacy notice generator at https://saralprivacy.com/tools/dpdpa-privacy-notice-generator turns the inventory into notices. Both are built on the same provision text that this course cites, so a finding in the assessment links back to the section or rule that requires it.

This is the last module. If a term is unfamiliar, the glossary and the provision pages on this site carry the gazette text and the plain-language notes; if a step above is unclear, the module that teaches it is linked from each citation.