Where this comes from
This guide summarises the Press Information Bureau's explainer on the Digital Personal Data Protection Rules, 2025. The government notified the Rules on 14 November 2025, and they give effect to the DPDP Act, 2023. The Rules set an eighteen-month period for phased compliance, so the full duties arrive in stages. This is a plain summary for a shop, clinic or salon that keeps a list of customers. It is not legal advice, and a lawyer should check anything specific to your business.
What the law asks of a business that keeps customer data
In the law's words you are a Data Fiduciary: you decide why and how personal data is used. The explainer lists these duties:
- A clear consent notice that explains the specific purpose for which you collect and use the data. Consent must be clear, informed and easy to understand, and people can withdraw it at any time.
- Collect only what you need, keep it accurate, keep it only as long as needed, and keep it safe. These are among the seven principles: consent and transparency, purpose limitation, data minimisation, accuracy, storage limitation, security safeguards and accountability.
- Show clear contact information for questions about personal data.
- If there is a breach, tell the affected people without delay, in plain language: what happened, the possible impact, the steps taken and who to contact.
- Children: verifiable consent from a parent or guardian is needed, unless the processing is for essential services such as healthcare, education or real-time safety.
What customers can ask you
People can ask to see their data, correct or update it, and in certain situations have it removed. They can also name someone to act for them. The Rules say you must deal with these requests within ninety days. Decide now who in your business receives them and how: a phone number and an email on your shop's page and bill are enough to start.
Why the penalties are worth knowing
The explainer states the highest penalty, up to 250 crore rupees, for failing to keep reasonable security safeguards. Not telling the Board or the affected people about a breach, and breaking the duties about children, can each draw up to 200 crore rupees. Any other violation can draw up to 50 crore rupees. These are maximums, but they show the law treats security and breach notice seriously.
A starter plan (our advice)
- List what you collect (names, phone numbers, addresses, photos) and why. Delete what you do not need.
- Put a short consent line where you collect data, for example on the booking form: what you will use the number for, and who to contact to stop.
- Keep the list in one place with a password, not in many chat groups.
- Write down who answers requests and how long you keep each type of data.
- Ask a lawyer to review it before the phase-in ends.
List the customer data you keep and delete what you do not need.
How this post was made: an AI drafted it from the official pages listed under Sources, every figure was checked against those pages, and the Reveaxa team approved it before it was published. Our own advice is marked as such. If a source changes, we update the post and its date.
Reveaxa guide reference: RVX-B-dpdp-act-and-your-customer-list