The Digital Personal Data Protection Act, 2023 does not apply only to large technology companies. It applies to anyone who processes digital personal data in the course of business — which includes a clinic keeping patient contact details, a coaching centre with student records, and a shop maintaining a customer database.
Know what you hold
Begin with an inventory: what personal data you collect, where it is stored, who has access, how long it is kept and whom it is shared with. Most small businesses discover in this exercise that they retain considerably more than they need.
Consent must be specific
Consent has to be free, specific, informed and unconditional, and it must be preceded by a notice describing the purpose. Bundled consent buried in terms and conditions does not meet the standard. Consent must also be as easy to withdraw as to give.
Collect only what you need
Purpose limitation is the core of the Act. Data collected for one purpose cannot be used for another without fresh consent, and data must be erased once the purpose is served.
Have a grievance route
You are required to publish contact details for grievances and to respond within a reasonable time. For most small businesses this is a named person and a working email address.
Be ready to report a breach
A personal data breach must be notified to the Board and to affected individuals. Preparing a short internal procedure now is considerably easier than improvising during an incident.
This note is general information and not legal advice. Please take advice on your own facts before acting on it.