The Digital Personal Data Protection Act now applies to businesses of every size that handle personal data digitally. The practical starting points are knowing what data you hold, collecting only what you need, getting clear consent, and being able to delete on request.
Data protection law stopped being an enterprise topic. If you run ads, collect leads, or keep customer records in India, the DPDP framework applies to you, and enforcement attention has been growing through 2025 and 2026.
The good news is that early compliance for a small business is mostly hygiene, not lawyers. Map where personal data lives, from form tools to spreadsheets to WhatsApp exports. Most firms are startled by their own sprawl, and shrinking it is half the work.
Four moves this quarter
Collect less: every form field you drop is risk you no longer carry. Say clearly what you collect and why, in plain language on the forms themselves. Establish one process to find and delete a person's data on request. Lock access down to the people who need it.
None of this is only legal defence. Customers notice restraint with their data, and trust is a conversion factor everywhere on your site.