List the personal data you collect
Names, phone numbers, emails, addresses, IDs, health or payment details. Note where each sits (software, Excel, registers, WhatsApp) and why you hold it.
Publish a clear privacy notice
In plain language, in English and an Indian language, given before or when you collect data. How to write one.
Collect consent before using data
A separate, unticked checkbox or explicit “I agree” for each purpose, especially marketing and WhatsApp messages.
Record every consent
Who, what purposes, when, how, and which notice version. You may need to prove it.
Make withdrawal easy
As easy as giving consent: a link, a reply on WhatsApp, a button on your website.
Name a contact for data questions
Publish their email or phone in your notice.
Handle access, correction and deletion requests
Have a process, track each request, and answer grievances within 90 days.
Delete data you no longer need
Set retention periods (keep tax records as the law requires) and erase the rest.
Use reasonable security safeguards
Strong passwords and two-factor login, limited staff access, encryption or masking, backups, and access logs.
Keep logs for at least a year
Consent records and logs of access to personal data.
Sign data terms with vendors
Software, payment, SMS, courier and marketing agencies that process data for you must protect it too.
Plan for breaches
Who decides, how you contain it, how you inform affected people and the Data Protection Board, and the detailed report within 72 hours.
Get parental consent for children’s data
Verifiable consent of a parent before processing data of anyone under 18; no tracking or targeted ads at children.
Frequently asked questions
How long does DPDP compliance take for a small business?
With a tool like ConsentKaro, the notice, privacy centre and consent logging can be live in a day. Cleaning up old data, vendor terms and staff training usually takes a few weeks.
Do I need a lawyer for DPDP compliance?
Many small businesses can cover the basics themselves using templates and software. For complex cases such as large-scale health or financial data, or sharing data abroad, take legal advice.
Get DPDP-ready without a lawyer’s bill
ConsentKaro writes your privacy notice in English and Hindi, logs consent, and handles customer data requests. 14-day free trial, no card.
Start free trial → Take the free DPDP check