DPDP Act 2023: What Lucknow Businesses Must Do With Customer Data

India's Digital Personal Data Protection Act, 2023 (DPDP Act) establishes rules for how organisations collect and process personal data in digital form. Almost every Lucknow business with a website, app, CRM or customer database handles personal data: names, phone numbers, addresses, emails, health or education information. This overview explains the key ideas in practical terms.

This article is general information, not legal advice. Rules under the Act are being notified and implemented in phases, so consult a legal professional for your specific obligations and timelines.

Key Terms

• Data Principal: the individual whose data is processed, such as your customer
• Data Fiduciary: the business deciding why and how data is processed, which is you
• Data Processor: a vendor processing data on your behalf, such as a hosting or software provider
• Consent Manager: a registered entity that helps individuals manage consent

Core Principles

Lawful purpose and consent

Personal data should generally be processed with clear consent for specified purposes, or for certain legitimate uses permitted by the law.

Notice

When requesting consent, provide a clear notice explaining what data is collected, why, and how individuals can exercise their rights.

Purpose limitation

Use data only for the purpose for which it was collected. Data collected for order delivery shouldn't automatically be used for unrelated marketing without appropriate consent.

Data minimisation

Collect only what you need. Asking for unnecessary details increases risk without adding value.

Accuracy

Take reasonable steps to keep data accurate, especially when it is used for decisions.

Storage limitation

Don't keep personal data longer than necessary for the purpose.

Security safeguards

Implement reasonable security measures to prevent data breaches.

Rights of Individuals

Individuals have rights such as accessing information about their data, correcting and erasing data, grievance redressal, and nominating someone to exercise rights in certain situations. Businesses need processes to handle these requests.

Children's Data

Processing children's personal data involves stricter requirements, including verifiable parental consent. Schools, coaching institutes and edtech businesses should pay special attention.

Practical Steps for Lucknow Businesses

• Map your data: what personal data you collect, where it's stored, who accesses it and why
• Update privacy notices on your website and apps in clear language
• Review consent flows: forms, sign-ups and marketing opt-ins
• Minimise collection: remove unnecessary form fields
• Secure your systems: access controls, encryption, backups and updated software
• Review vendors: ensure hosting, CRM and software providers handle data responsibly under contracts
• Prepare for breaches: detection, response and notification procedures
• Set up grievance handling: a clear contact for privacy requests
• Define retention periods and delete old data responsibly

Website and App Changes

• Clear consent checkboxes, not pre-ticked boxes, for marketing communications
• Updated privacy policy
• Cookie and tracking disclosures where relevant
• Account deletion or data request options
• Secure forms and storage

Privacy-Ready Development at Coding Warriors

Coding Warriors builds websites and applications with privacy by design: consent management, data minimisation, secure storage, access controls and data request workflows. Explore our cybersecurity services and web development, or contact us.

Frequently Asked Questions

Does the DPDP Act apply to small businesses?

The Act applies broadly to digital personal data processing. Specific exemptions or obligations may vary; consult legal advice.

Can I still send marketing messages?

Yes, with appropriate consent and easy opt-out options.

What about data collected before the Act?

Existing data may also require notices and appropriate handling. Seek legal guidance on transition requirements.