If your business keeps customer, lead or employee details, India’s Digital Personal Data Protection Act, 2023 probably applies to you. This is an overview, not legal advice.
The key ideas
- Data Principal: the person the data is about, such as a customer or employee.
- Data Fiduciary: the business that decides why and how the data is processed. That is usually you.
- Data Processor: a service that processes data on your behalf, such as software you use.
What fiduciaries are expected to do
- Tell people clearly what data you collect and why, and ask for consent where it is needed.
- Use the data only for the purpose you gave.
- Keep it accurate and protect it with reasonable security safeguards.
- Let people see, correct and erase their data, and have a way to handle complaints.
- Report a personal data breach as the law requires.
- Take extra care with children’s data.
What you can do this month
- List where you store personal data.
- Check that your forms say why you ask for each detail.
- Turn on two-factor sign-in and set roles so only the right people see customer data.
- Decide who handles a data request when one arrives.
For decisions about your own compliance, speak to a lawyer.