Protect the Customer List: A Minimum Data Routine for a Small Business

The DPDP Act and Small Business Readiness

The EY-FTCCI report discussed in PR3 included a survey of about 150 professionals on readiness for India's Digital Personal Data Protection Act and Rules. It found about 30% reported moderate or lower awareness, with manufacturing, infrastructure and shipping the least familiar. About 48% had started a gap assessment, but roughly 80% had not begun updating policies, about 81% had not set up a privacy governance structure and over 83% had not started implementation across processes and systems. The respondents were professionals, mostly from larger organisations, so the figures are not a measure of small-firm readiness, but they indicate how far preparation lags.

The timeline as reported

The report said the DPDP Rules were notified on 13 November 2025, with an 18-month window for data fiduciary obligations. Under the rules as described, breaches must be notified to affected parties and the Data Protection Board without undue delay, with a detailed report within 72 hours. Grievances must be addressed within 90 days, and logs retained for at least one year. We have not verified the rules against the official notification, and some provisions may differ in detail or apply differently by category of entity. Take legal advice on what applies to you. The Vi Business study discussed in PR2 found that about 46% of surveyed MSMEs had adopted cyber-defence solutions, which implies that a majority had not, at least on that platform. The Nasscom-Meta report found 56.4% concerned about data privacy and security and 52% wanting guidance on compliance.

“You cannot report a breach in 72 hours if you do not know where your data lives.”

Why a small firm should care: our analysis

Even a shop with a few hundred customers holds personal data, and a breach could mean financial loss, harm to customers and loss of trust. For firms selling to larger buyers, customers increasingly ask about data handling in contracts. Compliance may also become a condition of doing business with larger partners.

A minimum routine: our suggestions

1. Know what you hold. List where customer and employee data sit: phones, spreadsheets, billing software, cloud drives, paper files. List who has access. 2. Collect only what you need. If you do not need a customer's date of birth, do not ask for it. Less data means less risk. 3. Tell people what you do with it. A short notice at the point of collection, in a language they understand, saying why you collect and how long you keep it. 4. Lock the doors. Use unique strong passwords, a password manager if possible and multi-factor authentication on email, banking and cloud tools. Remove access for staff who leave on their last day. 5. Update devices. Install security updates on phones, computers and routers, and remove software you do not use. 6. Back up and test. Keep copies of important data separate from the main system, and test that you can restore them. Backups protect against ransomware and accidents. 7. Control vendors. When you use an outside service that handles customer data, ask what they do with it and where it is stored, and put it in writing. 8. Plan for a breach. Decide who does what in the first hour: isolate the device, change passwords, preserve logs, contact your adviser and note the time. The 72-hour reporting window described in the report is short if you have no plan. 9. Train everyone. Phishing messages remain a common route in. Teach staff to check links and sender addresses, and to report suspicious messages. 10. Review quarterly. Check who has access, whether backups work and whether new tools have been added.

An invented example

A small online retailer keeps orders in a spreadsheet shared with five people through a link anyone can open. It changes the setting to named access, removes two former staff, switches on multi-factor authentication for email and sets a weekly backup. The change takes an afternoon and removes the most obvious risks. The scenario is invented.

Costs and help

Many of the steps are free or low-cost. For more advanced needs, associations and cluster bodies may offer shared services. Compare insurance options for cyber incidents, noting exclusions.

Cautions

We are not lawyers. The requirements depend on your size, activities and the notifications that apply. Use this as a starting point for a conversation with a qualified adviser. Editorial analysis based on the EY-FTCCI report (2026, undated), the Vi Business study (CXOToday, 26 Jun 2026) and the Nasscom-Meta report (undated). Guidance is ours; not legal advice.