Why customer data needs protecting, and what the DPDP Act asks

Every clinic, school, shop and accounts firm holds pieces of its customers' lives: a phone number, an address, a health history, a child's photo. On its own each piece says little. Joined with pieces held elsewhere, which AI can now do in seconds, it can describe a person well enough to deceive or target her. From 13 May 2027 the DPDP Act makes looking after those pieces a duty for every business that holds them: tell people why the data is collected, keep it safe, erase it when the purpose is over, and tell people and the Board when it leaks G.S.R. 843(E) Rule 7.

What does a business hold about its customers?

Take one ordinary day for one customer. At nine she fills a form at a clinic: name, age, phone number and the reason for the visit, and the receptionist sends a photo of the form to the doctor. At eleven her son's school app asks for his photo and class. At one a delivery app learns her address, her gate number and the hours she is at home. At four a courier leaves a label with her name and phone number at the door.

Each of those was a business. Each now holds one piece of her day. That has always been true of shops and clinics. What has changed is what can be done with the pieces.

Why does one small detail matter now?

A phone number on its own is harmless. So is an address, a photo or a list of past orders. Matching them used to be slow work: someone had to sit with lists and join them by hand. AI tools now do that matching in seconds, from a number on one list, a name on another and a voice in a public video.

The joined picture is what makes a fraud convincing. In April 2024 the Tamil Nadu Police cyber crime wing warned of callers using AI to copy the voice of a family member and ask for money.

In June 2023, media reports said a Telegram bot returned personal details of people registered for COVID vaccination to anyone who typed in a phone number. The Ministry of Health and Family Welfare called the reports baseless and said CERT-In's first finding was that the bot did not draw directly on CoWIN's systems. Wherever the details came from, the pattern is the one that matters here: details collected for one purpose, gathered together and handed to strangers.

When a piece leaks from a business, its customer cannot tell where the picture came from. She knows only that she trusted someone with her details.

Does it matter where a leak starts?

Not to the customer, and not under the Act. In May 2021 Air India said a cyberattack on its passenger system provider had exposed data of about 45 lakh passengers. The attack was on a vendor; the passengers were Air India's. The same month, reports said data from about 18 crore Domino's India orders had been put up for sale; Jubilant FoodWorks said no financial information was accessed.

The DPDP Act puts that responsibility in writing. A business is responsible for processing done on its behalf by a Data Processor, "irrespective of any agreement to the contrary" (s.8(1)), and may engage one only under a valid contract (s.8(2)) (duty). The data a vendor holds for a business is still its customers' data.

What does the DPDP Act ask of a business?

From 13 May 2027, a business that decides why and how personal data is processed has five plain duties among others:

• s.5 Give a notice before or with each request for consent, saying what data is collected and why (duty).
• s.8(5) Protect personal data with reasonable security safeguards, including data processed by its vendors (duty).
• s.8(7) Erase personal data once consent is withdrawn or the purpose is over, and have its vendors erase it too (duty).
• ss.11 to 13 Answer a person's requests to see, correct or erase her data, and her complaints.
• Rule 7 Tell each affected person and the Board about a breach without delay (duty), and send the Board a detailed report within 72 hours of becoming aware of it (duty).

The penalty for failing to take reasonable security safeguards goes up to ₹250 crore s.33, Schedule item 1. The DPDP compliance checklist lists every duty with its clause and start date.

Does the Act apply to a small business?

What habits protect customer data?

Six habits cover most of the ground, and none needs a technology team:

1. Collect only what is needed. A form that does not need a date of birth should not ask for one.
2. Say why. One short notice, in a language the customer reads.
3. Lock it, and know who holds the key. Which staff, which apps, which phones.
4. Erase on time. Data a business no longer holds cannot leak from it.
5. Know the vendors. Who stores, prints, delivers or messages for the business, and what each one holds.
6. Know the first call if something leaks. Who decides, who tells customers, who tells the Board, and by when. The DPDP breach reporting page sets out each notice and the 72 hour report.

Most of these need a decision and a record of it, more than any new system.

Why is careful handling good for business?

People choose the clinic that keeps their reports private and the school that keeps a child's photo out of open groups. Care with data is something a business can show: a clear notice, a simple way to ask for a copy, a quick answer when someone wants details erased. Where most businesses have not yet thought about it, that care is a reason to be chosen.

Fohrkast dates each of these duties for the business and keeps the evidence. Request access »