A low-cost starting plan. General legal information only. Verify current rules and dates, and whether any relaxation applies to you.
Five first steps
- List what you collect. Customer, employee and vendor data, forms, apps, cookies, CCTV and where each is stored.
- Cut what you do not need. Collect only data needed for a stated purpose.
- Fix your notice and consent screens. Plain language, purpose stated, easy withdrawal.
- Name a contact. A person to receive requests and grievances, and a written process to respond.
- Secure the basics. Access control, backups, encryption where possible, and staff awareness.
Vendors
If cloud, payroll, marketing or CRM vendors handle personal data for you, use written contracts that require them to protect it and to tell you of a breach.
Prepare for a breach
Decide in advance who investigates, who is told, and how affected individuals and the Board are notified. See the breach response guide.
Do not wait for the last date
Building these habits takes time. Starting now spreads the cost.
Related: Data protection (DPDP) · All data protection guides · Send an enquiry
Important disclaimer: This article is general legal information, not legal advice. It does not create a lawyer-client relationship and is not an advertisement or solicitation under Bar Council of India rules. Verify current statutes, rules and judgments before relying on it.
