A Practical Introduction to India’s DPDP Framework
A straightforward starting point for small and growing businesses seeking to understand privacy and data protection in India.
English 한국어
Businesses of every size handle information connected to individuals. Customer contact details, employee records, account information, website enquiries, and marketing lists may all involve personal data.
India’s data protection framework is therefore relevant not only to large technology companies, but also to smaller organisations that collect or use personal data as part of their ordinary activities.
What is personal data?
Personal data generally refers to information connected to an identifiable individual. It may include names, contact details, employment information, customer records, online identifiers, and other information associated with a person.
Where might a small business handle personal data?
Common examples include:
- Website contact forms and customer enquiries
- Employee and applicant records
- Customer accounts and transaction records
- Email marketing lists
- Vendor and business-contact information
- Cloud services and business software
A practical place to begin
Before preparing detailed policies, a business can first understand its current data practices. This is often called data mapping or data inventory work.
A simple review can begin with five questions:
- What personal data does the business collect?
- Why is each type of data needed?
- Where is the data stored?
- Who can access or receive the data?
- How long is the data retained?
Privacy and security should be considered together
Understanding why information is collected is only one part of data protection. Businesses should also consider how that information is secured, who has access to it, and what happens when it is no longer required.
What comes next?
Future Haecera articles will examine privacy notices, consent, data retention, vendor relationships, security practices, and practical preparation for small and growing businesses.
This article provides general educational information. It is not legal advice and should not replace advice based on the specific circumstances of an organisation.