A Customer Shared Their Data With You. Now What?
Many small business owners hear "data privacy law" and immediately think it only applies to large corporations. But if you collect customer names, phone numbers, emails, or addresses, the DPDP Act may already apply to you-and understanding it is simpler than you think.
PRIVACY LAW
ZxtarAI
6/16/20263 min read
A Customer Shared Their Data With You. Now What?
Meet Priya. She runs a boutique. And she just became a Data Fiduciary.
Priya owns a small clothing boutique in Pune. She keeps a WhatsApp group of 200 loyal customers. She sends them offers, takes orders on Instagram DMs, and maintains a simple Excel sheet with names, phone numbers, and birthdays so she can send a personal discount on their special day.
Sweet. Thoughtful. And - as of India's Digital Personal Data Protection (DPDP) Act 2023, with rules notified in November 2025 - now a legal responsibility.
Priya is what the law calls a Data Fiduciary - any person or business that decides why and how personal data is collected. It does not matter that she is not a tech company. It does not matter that her "database" is an Excel file. The moment she collected those names and phone numbers, the DPDP Act applied to her.
🔒Keep Data Secure
You must have "reasonable security safeguards." For most small businesses, this means strong passwords, locked devices, and not sharing customer data carelessly.
👶Extra Care for Children
If any customer is under 18, you must get verifiable consent from their parent or guardian before processing their data. No exceptions.
✅Get Proper Consent
Pre-ticked boxes do not count. Silence does not count. The customer must actively agree — and must be able to withdraw that consent anytime
📋 Give a Privacy Notice
Before collecting data, tell customers - in plain language - what you are collecting, why, and how they can ask you to delete it. No legal jargon allowed.
🗑 Delete When Done
Once the purpose is served - the order delivered, the campaign over - you must delete the data. Hoarding old customer lists is no longer acceptable.
🚨Report a Breach
If customer data is leaked or stolen, you must notify the Data Protection Board and the affected customers promptly - without delay.
âš The most important thing to know: The DPDP Act applies to every business that processes digital personal data in India - regardless of size. There are no automatic exemptions for small shops, freelancers, or sole proprietors. If you collect a customer's name, number, email, or address digitally, you are covered.
So what exactly does the law ask of you?
Think of it this way. Before you take someone's personal data, you need to do three honest things: tell them why you want it, ask their permission clearly, and keep it safe. That, in its simplest form, is the heart of DPDP compliance. Here is what that means practically:
What happens if you ignore it? The penalties are real.
This is where it gets serious. The DPDP Act carries penalties that can shake any business - large or small. The Data Protection Board of India is operational and empowered to investigate and fine.
Yes — these are maximum penalties designed for large corporations. But the law does not set a lower cap for small businesses. Being small is not a defence. Being unaware is not a defence.
What should Priya - and you - do right now?
The Real Takeaway
The DPDP Act isn't asking small business owners to become privacy lawyers. It's asking them to be responsible custodians of customer information.
If your business collects names, phone numbers, email addresses, delivery details, or any other personal information, you're not just managing orders. You're managing trust.
And in today's digital world, trust may be one of the most valuable assets a business can have. Because customers don't just buy products.
They buy confidence that their information is safe in your hands.
#DPDPAct #DataPrivacy #SmallBusiness #DigitalTrust #DataProtection #PrivacyCompliance #CyberSecurity #CustomerTrust #BusinessGovernance #DataSecurity #PrivacyAwareness #DigitalBusiness #TrustMatters #ZxtarAI
Disclaimer: This article is intended for educational and awareness purposes only and should not be considered legal, regulatory, or compliance advice.
(c) ZxtarAI - Empowering Digital Trust Through AI, Privacy, Security, and Governance Insights.