Your first month plan for DPDPA — step by step

What does this mean for YOUR business?

Say you run a small school. In Week 1, you list student Aadhaar cards, parent phone numbers, and fee receipts. In Week 2, you check that only the principal and accountant can see this. In Week 3, you note down your SMS vendor and fee software company. In Week 4, you update your admission form to ask permission before using parent WhatsApp numbers. That's it. Four weeks. Five steps. Your business is already ahead of most.

Who Is Affected

• Week 1: Write down all the information your business collects. Phone numbers, Aadhaar, PAN, resumes — list everything.
• Week 2: Check who in your team can see customer or staff information. Remove access if not needed.
• Week 3: Make a list of all vendors who handle people's information. Your CA, courier partner, software app — all of them.
• Week 4: Update your consent notice and check how long you keep old data. Delete what you no longer need.