DPDP Act 2023 for Small Businesses — Customer Data, Consent, Privacy Policy and WhatsApp Marketing in India

Quick answer: India's Digital Personal Data Protection (DPDP) Act, 2023 applies to businesses that collect personal data digitally — including customer phone numbers in billing software, WhatsApp, Google Forms and websites. In practice for a small business: collect only what you need, tell customers clearly why you're collecting it, get consent for marketing messages, keep data secure, let people withdraw consent or ask for deletion, delete data you no longer need, and publish a simple privacy policy. The DPDP Rules were notified in 2025 with obligations phased in, so prepare now. This is general information, not legal advice.

Every time you save a customer's name and number in your billing app, collect a form on your website or add someone to a WhatsApp broadcast, you're handling personal data. India's data protection law makes that a responsibility — and good data habits also build customer trust.

Laws and rules evolve. Check the official text on MeitY's website and consult a legal professional for your specific situation.

Key terms in simple words

Term	Meaning	Example
Personal data	Information about an identifiable person	Name, phone, address, email, photo, health details
Data principal	The person the data is about	Your customer
Data fiduciary	The business deciding why and how data is used	You
Data processor	Someone processing data for you	Billing software, email tool, WhatsApp API provider
Consent	A clear, informed yes for a specific purpose	Ticking "Send me offers on WhatsApp"

Where small businesses collect personal data

• Billing software (name, phone, purchase history) (billing software).
• WhatsApp Business chats and broadcast lists (WhatsApp for business).
• Website contact and booking forms (Google Forms).
• Appointment registers and patient files (clinics — health data is especially sensitive).
• Loyalty programs and referral cards (loyalty programs).
• CCTV footage.
• Employee records.

Core obligations, practically

1. Give notice

Tell people what data you collect, why, and how to contact you. A short line on forms and a privacy policy page usually do this:

"We use your phone number to confirm your booking and, if you agree, to send occasional offers. See our privacy policy."

2. Get valid consent where needed

• Consent should be free, specific, informed, unconditional and clear — an unticked checkbox the customer ticks, or a clear "Yes" message.
• Separate consent for marketing from the core service. Don't force marketing consent to get a bill or appointment.
• The law also recognises certain "legitimate uses" without separate consent in specific situations — e.g., when someone voluntarily gives data for a specific purpose. Marketing generally needs clear consent.

3. Use data only for the stated purpose

Phone numbers collected for delivery shouldn't be sold or used for unrelated promotions without consent.

4. Keep data accurate and secure

• Strong passwords and two-factor authentication on billing, email and Google accounts.
• Limit staff access.
• Lock phones used for WhatsApp Business.
• Choose reputable software providers.

5. Respect people's rights

Customers can ask what data you hold, ask for correction, ask for deletion, and withdraw consent. Have a simple process — a WhatsApp number or email — and respond promptly.

6. Delete data you no longer need

Don't keep data forever "just in case". Set a retention period (e.g., delete inactive marketing contacts after a set time), keeping records you're legally required to keep (like tax invoices).

7. Report breaches

If personal data is leaked or stolen (hacked account, lost device with data), the Act requires notifying the Data Protection Board and affected people as per the rules. Plan who does what.

Children's data

Coaching centres, schools, play schools and kids' activity businesses should be especially careful: processing children's data generally needs verifiable parental consent, and tracking or targeted advertising directed at children is restricted.

WhatsApp, SMS and email marketing

• Send marketing only to people who agreed (SMS and DLT rules).
• Include an easy opt-out ("Reply STOP").
• Honour opt-outs immediately.
• Don't add customers to groups without permission (society marketing etiquette).
• Don't buy contact lists.

Privacy policy essentials

Your website (and booking forms) should link to a privacy policy covering:

1. Who you are and how to contact you.
2. What personal data you collect.
3. Why you collect it (purposes).
4. Legal basis — consent or other permitted uses.
5. Who you share it with (payment providers, delivery partners, software tools).
6. How long you keep it.
7. How you protect it.
8. How people can access, correct, delete or withdraw consent.
9. Cookies and analytics (GA4).
10. Grievance contact and how to escalate.

Keep it in plain language, and in the local language too if most customers use it.

Reviews, photos and Google

• Don't post customer photos, phone numbers or private details publicly without permission.
• Never reveal customer details in review replies — especially for clinics (doctor reply templates).
• Get written consent for testimonials and before/after photos (video testimonials).

A small-business compliance checklist

• List where you store customer data (apps, sheets, phones, paper).
• Remove data you don't need.
• Add a notice line to forms and bills.
• Add marketing consent checkbox / opt-in message.
• Publish a privacy policy on your website.
• Turn on 2FA on all business accounts.
• Limit staff access.
• Create a process for data requests.
• Set retention and deletion rules.
• Prepare a breach response plan.
• Check contracts with software vendors handling data.

Penalties

The Act provides for significant financial penalties for failures such as inadequate security safeguards and breach notification failures. Small businesses are unlikely to be the first target, but a single leak can damage customer trust far more than any fine.

Example: a coaching institute in Kota

A coaching institute kept student and parent numbers in several staff phones and shared them in large WhatsApp groups. It moved records to one protected sheet, added a consent form at admission with a separate checkbox for promotional messages, replaced groups with a WhatsApp Channel for announcements (followers' numbers are hidden), and published a simple privacy policy. Parents appreciated the change, and staff departures no longer meant losing or leaking contact data.

Sources and further reading

• Digital Personal Data Protection Act, 2023 and DPDP Rules — Ministry of Electronics and IT: meity.gov.in
• WhatsApp Channels for business

Frequently asked questions

Does the DPDP Act apply to small shops?

It applies to digital personal data processing generally, including small businesses. Some obligations scale with size, and certain exemptions may apply; check the rules.

Is a phone number personal data?

Yes, a phone number linked to a person is personal data.

Can I send WhatsApp offers to all my billing customers?

Only to those who've agreed to receive them. Get clear opt-in.

Do I need a privacy policy if I don't have a website?

It's good practice to have one available (e.g., a link or printed notice), especially if you collect data through forms or apps.

What about paper registers?

The Act focuses on digital personal data, including data collected offline and later digitised. Good practice is to protect all customer data.