DPDP Act for Small Business: Lead Data Checklist

If you run a small business in India and keep customer enquiries in a notebook, a spreadsheet or WhatsApp chats, the DPDP Act for small business is now your concern too. The law has no special exemption for small firms. If you collect names and phone numbers from leads, you handle personal data, and the rules apply to you.

The good news: you do not need a legal team to start. You need to know where your leads come from, what you told them, and where their details are stored. This guide explains that in plain words, with a checklist you can finish this week.

Note: this is a practical guide, not legal advice. Check the official text from MeitY and talk to a lawyer for your specific case.

What the DPDP Act means for a small business

The Digital Personal Data Protection Act, 2023 sets rules for how businesses collect, use, store and delete personal data of people in India. The government notified the detailed DPDP Rules in November 2025, and the obligations are being phased in over time. Do not wait for the last date. Fixing habits now is cheaper than fixing a messy database later.

For a sales team, "personal data" mostly means the things already sitting in your lead list:

• Name, phone number and email address

• City, budget and what the person enquired about

• Call notes and chat history

In the law's language you are the "data fiduciary": the one who decides why and how the data is used. Your customers are "data principals".

The five rules that touch your leads

1. Ask clearly before you collect

Consent should be free, specific and clear. A form that says "Submit your details and we will call you about your enquiry" is far better than a pre-ticked box buried in small print. Tell people what you will use their data for, in simple language.

2. Use data only for the reason you gave

If someone filled your form to get a fee structure, that is not permission to add them to every promotional list. Use the data for the purpose they agreed to. If you want to send offers later, ask for that separately.

3. Make it easy to say no

People should be able to withdraw consent as easily as they gave it. If a lead says "please stop calling" or "delete my number", your team needs a clear way to record this and act on it quickly.

4. Keep only what you need, and only as long as you need it

Do you really need a lead's date of birth to send a brochure? Collect less. Also decide how long you keep cold leads. A five-year-old enquiry that never converted usually does not need to sit in your files.

5. Protect the data and have a plan if something goes wrong

An Excel file shared on five phones and two laptops is hard to protect. If a staff member leaves with a copy, you have no control. You should be able to say who can see what, and what you will do if data leaks.

Where small teams usually go wrong

Buying or borrowing lead lists

Bought lists are risky. You often cannot show that the people on them agreed to be contacted by you. If you use a list from an agent or aggregator, ask where the consent came from and what it covers.

Messaging on WhatsApp without permission

Adding a number to a broadcast list just because you have it is a bad idea, both for privacy and for your WhatsApp account. Send promotional messages only to people who agreed to hear from you, and always offer a way to opt out.

Leads scattered everywhere

When enquiries live in personal phones, chat apps, paper registers and old sheets, you cannot answer simple questions like "where did this person come from?" or "who has their number?". That is the real compliance problem, and it is also a sales problem. If this sounds familiar, read our post on the signs you have outgrown spreadsheets.

No one owns it

In most small businesses, one person should be responsible for how lead data is handled. It can be the founder or the sales manager. What matters is that someone decides the rules and checks them.

A simple lead-data checklist for this week

1. List your lead sources. Website forms, ads, walk-ins, phone calls, referrals, WhatsApp, purchased lists.

2. Check each form. Does it say clearly why you are collecting the data and how you will contact the person?

3. Remove what you do not need. Cut optional fields that your team never uses.

4. Move leads into one place. One system with logins is easier to protect than many files.

5. Control access. Give each team member only the leads they work on.

6. Write a stop-contact process. When a lead asks to stop, who marks it, and how fast?

7. Set a clean-up date. Pick a period after which old, inactive leads are reviewed and deleted.

8. Brief your team. Ten minutes in a team meeting is enough to cover the basics.

How a CRM helps, and what it does not do

A CRM will not make you compliant by itself. Compliance depends on how you ask for consent and how you use the data. But a good small business CRM makes the habits above much easier:

• One home for leads. Enquiries from forms and websites land in one place instead of personal phones.

• Clear ownership. Each lead is assigned to a team member, so you know who is handling whom.

• A record of every touch. Calls and follow-ups are tracked in the pipeline, so you can see what happened and when.

• Follow-up reminders. Your team contacts people when planned, and not at random.

When you compare tools, ask each vendor how they store data and who can access it. Do not assume the answer.

FAQs

Does the DPDP Act apply to very small businesses?

Yes. The Act does not carve out a general exemption for small businesses. If you collect personal data from customers or leads in India, you should follow its basic rules. Check the official text for any exemptions that may apply to you.

Can I still call or WhatsApp people who filled my enquiry form?

Yes, for the purpose they agreed to, such as replying to their enquiry. Be clear on the form about how you will contact them. For promotional messages beyond that, ask for separate permission.

What should I do with old leads in my spreadsheet?

Review them. Keep leads that are still active and have a clear reason to be there. Delete or archive the rest, and avoid messaging people when you cannot say where their details came from.

Do I need a consent form for every lead?

You need to be able to show that the person knowingly shared their details for a stated purpose. A clear sentence on your web or enquiry form can do this. A lawyer can help you word it for your sector, such as clinics, insurance or education.

Is a CRM required under the DPDP Act?

No. The law does not require any particular software. A CRM simply helps you keep lead data in one controlled place with clear ownership and records.

Handling lead data well builds trust, and trust helps you close deals. If you want your enquiries, follow-ups and pipeline in one organised place, try LeadGo and see how it fits your team.