DPDP Act
What is DPDP Act? India's Digital Personal Data Protection Act, 2023. It sets rules on asking for consent, using personal data only for the stated purpose, and erasing it when a person asks.
In plain words
The Act is India's law on digital personal data: names, phone numbers, emails, addresses, anything that identifies a person. Your business is the "data fiduciary" (it decides why and how the data is used). The person is the "data principal".
In short, tell people what you collect and why, ask for consent for that purpose, collect only what you need, keep it secure, and delete it when the purpose ends or the person withdraws consent, unless another law requires you to keep it. People can ask to see, correct or erase their data.
A CA firm collected 400 clients' mobile numbers to send GST due-date reminders. The partner now wants to invite the same clients to a paid webinar.
The consent was for reminders, not for marketing. The firm should ask for fresh consent for the webinar, record when and how it was given, and stop at once for anyone who says no. Employee records, such as payroll and bank details, are personal data too.
Why it matters
- Penalties: the Act's schedule goes up to ₹250 crore for a failure such as not keeping reasonable security safeguards.
- Proof: when a client asks "when did I agree to this?", you need a dated record of the consent and the wording they saw.
- Trust and contracts: larger customers now ask vendors and service providers how they handle personal data.
Want to see the consent record and the erasure steps on a sample client? We can show both.
How Kinnow handles it
Marketing sends go through the Consent & Deliverability Gate. Consent is recorded per channel, address and purpose with the time. No consent means no send, and nothing overrides that. Marketing campaigns (Reach) can export the consent record, including the wording shown at the time, for one address when you need to prove it.
Erasure requests reach files, search and the AI's copy, while records the law requires you to keep stay (see Delete for real, keep what law requires). On financial records Kinnow clears non-essential contact details and keeps the tax record. Veil keeps bank, tax and ID numbers away from AI services.
Limit: your privacy notice, your choice of purposes, and any report to the Data Protection Board stay with you and your adviser. Kinnow gives you the records and controls; it does not make you compliant on its own.
Ask us how consent, erasure and Veil, our privacy layer would work for your client list or your staff records.
Questions
What is DPDP Act?
India's Digital Personal Data Protection Act, 2023. It sets rules on asking for consent, using personal data only for the stated purpose, and erasing it when a person asks.
Does the DPDP Act apply to a small business?
Yes, if you handle digital personal data in India. There is no general exemption for small businesses, although the Government can relax some duties for classes such as startups. Check the current rules with your CA or legal adviser.
If a customer asks us to delete their data, do we have to delete invoices too?
Not where another law requires you to keep the record, such as tax and accounting records. In Kinnow, an erasure clears non-essential details such as email, phone and bank account and keeps the taxable record. Confirm retention periods with your CA.