Ask a small business owner whether they handle personal data and most will say no. Then look at their website. There is a contact form asking for a name, phone number and email. The entries go to someone’s Gmail, get copied into a Google Sheet, and the phone numbers end up in a WhatsApp broadcast list.
That is personal data, and from May 2027 the way you collect and use it is governed in full by the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025.
This is a practical reading for small businesses, checked on 20 October 2026. It is not legal advice. If you handle health records, children’s data or large volumes, talk to a lawyer.
The timeline in one paragraph
The government notified the DPDP Rules on 14 November 2025 with an 18-month phase-in, according to the PIB explainer on the Rules. The consent manager provisions start around November 2026, and the main duties for businesses (notice, consent, security, breach reporting and data rights) apply from May 2027, as law firms such as Lakshmikumaran & Sridharan set out. There have been media reports that the government may shorten the timeline. Plan for May 2027 and treat anything earlier as a pleasant surprise you were ready for.
Seven months sounds like plenty. It isn’t, if your enquiries are spread across a form tool, three inboxes, a spreadsheet and an agency’s CRM.
Does it apply to a small business?
Yes. The Act applies to anyone who decides why and how digital personal data is processed. The law calls that a “data fiduciary”. A two-person studio with a contact form is one.
Size changes how much you have to do, not whether the law applies. The heavier duties, such as independent audits and impact assessments, are for “significant data fiduciaries”, which the government designates based on volume and risk. A typical small business won’t be one.
What the law expects, in plain terms
From the PIB summary and the Act:
- A clear, standalone notice. Before you collect personal data on the basis of consent, you tell people what you collect and the specific purpose, in clear language. It must be separate from other terms, not buried in a 4,000-word privacy policy.
- Real consent. Free, specific, informed and unambiguous, with a clear action. A pre-ticked box does not count.
- Withdrawal as easy as giving consent. If someone ticked a box to receive offers, they need an equally simple way to stop.
- A contact for data questions. You must publish contact details for queries about personal data, for example a designated person or a Data Protection Officer.
- Answers to rights requests within 90 days. People can ask to see, correct, update or erase their data. You have a maximum of 90 days.
- Reasonable security. Encryption or access controls, logs, backups, and contracts with anyone who processes data for you. Commentary on the Rules notes that logs should be kept for at least a year.
- Breach notice without delay. If enquiry data leaks, you tell the affected people in plain language what happened and what they can do, and you report it to the Data Protection Board.
- Delete what you no longer need. Keep data only as long as the purpose needs.
The penalties are large enough to be taken seriously. Up to ₹250 crore for failing to keep reasonable security safeguards, up to ₹200 crore for failing to report a breach or for violations about children’s data, and up to ₹50 crore for other violations. Nobody expects a small studio to get the maximum. The numbers tell you how seriously the government treats this.
Your enquiry form, field by field
Start with the form, because that is where most of your personal data enters.
Ask for less. Every field is data you now have to protect, explain and eventually delete. Do you need a full address to send a quote? Do you need a date of birth? If not, remove the field. A shorter form usually converts better too.
Put the notice next to the button. One or two lines right above “Send” work better than a link in the footer. Something like:
We use your name, phone and email only to reply to this enquiry and send you a quote. We keep enquiries for 12 months. To see or delete your data, write to privacy@yourdomain.in.
Then link to the full privacy notice for the details.
Separate the purposes. Replying to the enquiry is one purpose. Adding someone to a newsletter or a WhatsApp offers list is another. The second needs its own unticked checkbox.
Record the consent. Store the timestamp, the version of the notice shown, and which boxes were ticked, alongside the enquiry. If you can’t show what someone agreed to, you can’t rely on it. This record also helps with TRAI’s new rules on follow-up calls, which we cover in our guide to the 2026 calling rules.
Test the error and success messages. If a form fails silently, people re-enter their details somewhere else and your data spreads further. Our checklist for testing your contact form covers this.
Then follow the data after “Send”
The form is only the start. Map where an enquiry goes in the next 24 hours:
- Form tool or website database. Who can log in? Is two-factor authentication on?
- Email notification. Which inboxes receive it? Does a former employee still have access?
- Spreadsheet or CRM. Is the sheet shared with “anyone with the link”? Link-shared sheets are an easy way for enquiry data to end up with people you never meant to share it with.
- WhatsApp. Numbers saved on a staff member’s personal phone are very hard to delete on request.
- Agencies and vendors. Your web developer, ad agency, chatbot or AI calling vendor all process data for you. You need a written agreement that they keep it secure and delete it when you ask.
- Analytics and ad pixels. Make sure form field values are not being sent to analytics or ad platforms by accident. Auto-tracking tags can capture more than you expect, so check what they send.
Write this map down. It is one page, and it is what you will need when someone asks you to delete their data or when something goes wrong.
A one-afternoon action list
- Remove form fields you don’t need.
- Add the short notice above the submit button and a separate, unticked marketing checkbox.
- Publish a privacy contact email that someone actually reads.
- Turn off “anyone with the link” sharing on enquiry spreadsheets.
- Switch on two-factor authentication for the form tool, email and CRM.
- Set a retention period, for example 12 months for enquiries that didn’t become customers, and put a calendar reminder to delete.
- Ask each vendor that touches enquiry data how they store and delete it.
- Write a short note on what you’ll do if a laptop or account is compromised: who to call, how to tell customers.
None of this needs a big software purchase. Most of it is settings and a bit of writing.
Where we can help
When we build a business website, we can set up the enquiry form with a short notice, separate consent for marketing, spam protection and one place where enquiries are stored instead of five inboxes. Our analytics and consent setup work makes sure tracking tags don’t pick up form data. If you already have a site, the launch checklist is a free starting point.
The DPDP rules are easier to meet for a small business than they sound. The hard part is the mess that builds up when nobody owns the enquiry data. Fix that, and compliance mostly follows.