MPR
VENTURES
Data protection kit · Small business edition

Get data-law
ready in one
weekend.

The plain-English DPDP survival kit for Indian shops, salons, clinics, traders and service firms, before the law bites on 13 May 2027.

9
steps, ticked off
one a week
6
fill-in templates
ready to use
12
question self-check
to score your risk
1
staff poster to
print and stick

EDITION 1 · OCTOBER 2026
WWW.MPRVENTURES.IN

Read this first

Why this is worth
one weekend of your time

01

If you keep customer names and numbers in WhatsApp, Excel or a billing app, India's Digital Personal Data Protection (DPDP) law applies to you. Most owners don't know it yet. That's your head start.

₹250 cr

maximum fine for failing to keep personal data secure

13.05.27

the date most duties start for every business that holds personal data

No

automatic exemption for small businesses. Size doesn't let you off

Three everyday situations. Each one is a breach.

The salon

The lost phone

The front-desk phone with 2,000 client chats is left in an auto. No screen lock. Every name, number and appointment is now exposed.

The trader

The leaver

A sales executive quits and joins a competitor. The customer Excel he kept on his personal phone goes with him.

The clinic

The wrong group

A patient list meant for the accountant is forwarded to a WhatsApp group of 40 people by mistake.

The good news: most of what the law asks is basic good practice that costs little or nothing: locks, passwords, clear consent, a named contact person, and a plan for when things go wrong. This kit gives you every one of them, ready to fill in.

What you get when you finish

MPR Ventures · DPDP Weekend Kit02
Self-check · 5 minutes

How exposed are you?

04

Tick every statement that is true for your business today. Count the ticks, then find your score below.

Customer numbers are saved on staff members' personal phones.
Our shop or office phone has no screen lock, or everyone knows the PIN.
Several people share one login for our billing app, email or cloud drive.
Two-step login is not switched on for email and WhatsApp Business.
We send offers to every customer, whether or not they asked for them.
We have no privacy notice on our website, forms or counter.
We photograph or photocopy customer ID cards "just in case".
Former staff could still log in to at least one of our systems.
We have never deleted old customer data. We keep everything forever.
We don't know what our vendors do with the data we share with them.
If a phone with customer data was lost today, nobody knows what to do first.
We collect data about children (under 18) without a parent's consent.
My score:ticks out of 12
0–2
Well placed

Use the templates to put your good habits in writing.

3–6
Exposed

Do the weekend plan this month. Start with Step 4, Lock it down.

7–12
High risk

Do the weekend plan this weekend. Retake this test in 30 days.

MPR Ventures · DPDP Weekend Kit05
The 9-step roadmap

Nine steps to compliant

05

Seven of the nine steps cost nothing but time. Do one a week and you'll finish with months to spare.

1Free

Map your data

Know every place data lives and who can open it.

2 hours

2Free

Collect less

Every field you don't need is risk you don't need.

1 hour

3Free

Tell and ask

A privacy notice plus consent lines everywhere you collect data.

2 hours

4Free

Lock it down

Passwords, two-step login, screen locks, remove leavers.

1 hour

5Free

Plan for a breach

Who does what in the first 72 hours.

1 hour

6May cost

Keep logs

Switch on activity history. Some apps charge for it.

1 hour

7Free

Name a contact

One person who answers customers' data requests.

30 min

8Free

Bind your vendors

Data terms in writing from everyone who touches your data.

1 hour

9May cost

Delete the old

Set how long you keep data, then clean out yearly.

2 hours

Pick your start: if your self-check score was 3 or more, start with Step 4. Locks and passwords stop most real-world leaks, and they take an hour.
MPR Ventures · DPDP Weekend Kit06
Template 4 · Step 5

Breach response plan

06

A breach is any leak, loss or unauthorised access: a lost phone, a hacked email, a leaver taking the customer list, a file sent to the wrong person. Fill in the names now, while things are calm.

Breach lead · decides and reports
Name Phone
Tech help · passwords, devices
Name Phone
Customer communication
Name Phone
Legal or CA adviser
Name Phone

The first 72 hours

HOUR 0–1
Stop the leak

Change passwords, log out all devices, lock or wipe the lost phone, cut the leaver's access.

SAME DAY
Find out

What data, whose, how many people, how it happened, since when.

WITHOUT DELAY
Tell people

Tell affected customers what happened, the risk, and what to watch for. Send the Board an initial report.

BY HOUR 72
Full report

Send the Data Protection Board a detailed report. Confirm the current process with your adviser.

Then, within 2 weeks

Fix the cause so it can't happen again, and record everything in the breach log on the next page.

Lost phone? First 10 minutes: call your tech help, use Find My Device to lock it, and log WhatsApp out from WhatsApp Web's linked devices.
MPR Ventures · DPDP Weekend Kit12
Template 6 · Print and stick near the counter

Customer data:
our house rules

DO
  • ✓  Use only the work phone and work login for customer data
  • ✓  Lock your phone and screen every time you step away
  • ✓  Ask before sending any data outside the business
  • ✓  Report a lost phone or odd message straight away
  • ✓  Delete data we no longer need, as per policy
DON'T
  • ✕  Save customer numbers on your personal phone
  • ✕  Share passwords, even with colleagues
  • ✕  Forward customer lists on personal WhatsApp
  • ✕  Photograph ID cards unless told to
  • ✕  Take any customer data with you when you leave
Something went wrong?

Tell this person immediately:

Name Phone
Team sign-off · I have read and will follow these rules
Name / signature Name / signature Name / signature Name / signature Name / signature Name / signature
MPR Ventures · DPDP Weekend Kit15