Compliance Guidance

40 staff? You may already have a data problem.

5 April 20263 min read·DPDPA Editorial Team

General Business

A small team can collect a LOT of people's information without realising it.

40 staff? You may already have a data problem.

Is your growing business already in trouble?

You have 40 people working for you. Feels small, right? But think about this — you have salary slips, Aadhaar copies, customer phone numbers, resumes, WhatsApp groups, and shared Google folders. All of that is people's information. And most businesses have no idea where it all sits. The new data protection law — DPDPA — says you are responsible for all of it. Today.

4 things a 40-person company is already doing

1You use 12 to 15 apps and tools — Tally, WhatsApp, Google Drive, Zoho, and more.
2Multiple people have admin access — HR, accounts, owner, sometimes even a vendor.
3Customer phone numbers and Aadhaar copies sit in shared folders with no lock.
4Nobody has made a list of where all this information is stored.

What does this mean for YOUR business?

Imagine your HR person shares a folder with salary slips on WhatsApp. Your accountant has a copy of 50 customer PAN cards on his laptop. A vendor can see your Google Sheet with customer phone numbers. This is normal for most small businesses. But under DPDPA, if any of this leaks, you are responsible. You will have to answer — who had access, why, and what you did to protect it. Most 40-person businesses cannot answer these questions today.

Who Is Affected

You use 12 to 15 apps and tools — Tally, WhatsApp, Google Drive, Zoho, and more.
Multiple people have admin access — HR, accounts, owner, sometimes even a vendor.
Customer phone numbers and Aadhaar copies sit in shared folders with no lock.
Nobody has made a list of where all this information is stored.

3 things you can do this week

List every app and folder where customer or staff information is saved.

Remove admin access from anyone who does not truly need it.

Check if your business is ready. Takes 3 minutes. Visit saralprivacy.com/assessment

“A growing company becomes a data machine long before it feels big.”

Free — takes 3 minutes

Is YOUR business ready for DPDPA?

Answer a few simple questions. Get your free Readiness Score — sent to your email or WhatsApp.

Check My Readiness →

Disclaimer: This briefing is for educational purposes only and does not constitute formal legal advice. Consult a qualified data protection lawyer for formal legal opinions specific to your business.

Free checkCheck your readinessGet your free Readiness Score →Free resourceDownload the GuideComplete DPDPA guide →