Every field you ask for is your responsibility under DPDPA.
You made a Google Form or WhatsApp broadcast list. You asked for name, phone, email, maybe date of birth. Seemed harmless, right? But under the new DPDPA law, every field you collect is your responsibility. If you cannot explain WHY you need it, you should not be collecting it. This applies to your shop, your school, your small office — everyone.
Say you run a coaching class. Your admission form asks for Aadhaar number. Do you really need it? Probably not. Or your shop collects customer phone numbers for billing. Then you use that list for Diwali offers. That is not allowed without permission. Even your email tool or WhatsApp broadcast list counts. If an agency runs ads for you and collects leads, you are still responsible. Check every form. Ask: why is this field here?
Open every form you use and remove fields you cannot explain.
Add a simple YES checkbox before adding anyone to your broadcast list.
Check if your business is ready. Takes 3 minutes. Visit saralprivacy.com/assessment
“The form is where data discipline begins.”
Free — takes 3 minutes
Answer a few simple questions. Get your free Readiness Score — sent to your email or WhatsApp.
Check My Readiness →Take our free 3–5 minute industry assessment to find out your compliance risk level.
Take Free Assessment →Free Download
The Complete DPDPA Compliance Guide
Plain English. Everything your business needs to understand the DPDP Rules 2025 — written for founders, not lawyers. Now in 7 Indian languages.
Download the Guide →5 Ready-to-Use Templates
Start complying — not just reading
Privacy Notice, Consent Language, Data Inventory, DSR SOP, Vendor Register. Delivered free to your email.
2-min reads, plain English, every morning. Free forever.
