India's data protection deadline is May 2027: a checklist for small businesses

The timeline

• 13 November 2025: Rules notified; the Data Protection Board of India established.
• 13 November 2026: Rules for Consent Managers take effect. Most small businesses don't need to do anything for this.
• 13 May 2027: The main obligations apply: notice and consent, security safeguards, breach notification, children's data and people's rights over their data.

Why it applies to small businesses

The law is not only for large tech companies. If you collect customer names, phone numbers or addresses through a website form, WhatsApp, a billing system or a CRM, you are handling personal data. Larger, data-heavy companies may be designated "Significant Data Fiduciaries" with extra duties, but basic duties apply to everyone.

A seven-month checklist

1. List your data. Write down where customer data lives: WhatsApp chats, phone contacts, Excel sheets, billing software, CRM, Google Forms, ad platforms. Note who can access each.
2. Collect only what you need. Drop fields you never use, such as date of birth on an enquiry form.
3. Tell people why. Every form should say what you collect and why, with a clear consent checkbox and a link to your privacy policy.
4. Secure the basics. Use strong passwords and two-factor login on email, WhatsApp Business and your CRM. Don't share customer lists in personal WhatsApp groups.
5. Plan for breaches. Reports suggest breaches must be reported within 72 hours. Decide now who in your team does what if a laptop is stolen or an account is hacked.
6. Keep activity logs. Commentators point to keeping access logs for one year. Most business software can do this if you switch it on.
7. Answer requests. Name one person to handle requests to see, correct or delete data, and publish their contact details.
8. Check your vendors. Your CRM, website host and marketing agency handle your customers' data. Make sure contracts cover security and deletion.
9. Delete what you no longer need. Set a retention period and clean old lists once a year.

Want help mapping your customer data and putting simple processes in place? Book a free discovery call.