If you run a clinic, a coaching academy, an interiors studio or a travel desk, your phone is full of other people's details. Names, numbers, scans, fee discussions, a parent saying their child is struggling in maths.
Then you see "DPDP Act" in the news again and wonder: does this apply to me, and what do I actually have to do?
This post is a plain answer. It is not legal advice. Talk to a lawyer or your CA before you act on any of it.
What is in the news
The Digital Personal Data Protection Act became law in August 2023. The Rules that make it workable were notified in November 2025, with an 18-month phased timeline, as Entrepreneur India reported. That points to around May 2027 for most duties. KPMG's guidance note is a good further read.
This week it is back in the headlines because, as Inc42 reports, 21 news publishers, through the Digital News Publishers Association, have gone to the Supreme Court to challenge parts of the Act, with a hearing scheduled for 27 October. Their argument is about journalism and sources. It is not about clinics or coaching classes.
So what does that mean for you? Two honest points:
- The case may change parts of the law. We do not know how.
- Nothing in it says small businesses are off the hook. The law is about anyone who decides why and how personal data is used.
Does it apply to a small service business?
Probably, in the parts that matter. If you collect a phone number and a name to answer an enquiry and then keep that chat, you are handling personal data. The same Entrepreneur India piece lists the basics: a clear, simple notice saying what you collect and why, reasonable security, telling people if there is a breach, and erasing data once you no longer need it.
It describes an 18-month transition for SMEs and says they are not subject to the extra duties for "Significant Data Fiduciaries". It does not describe a general small-business exemption, so do not assume you have one. Ask your adviser.
Six questions to ask this week
- Where do my customer chats actually live? On one owner's phone? Three staff phones? A WhatsApp group, a spreadsheet, a notebook at reception? Write the list down. A group chat is not a desk, and it is also very hard to account for.
- Do people know why I am asking for their details? A short line at the point of collection works: "We use your number to reply about your enquiry and to remind you of your slot." No big legal paragraph.
- Can I find everything I hold about one person? If a parent asks "what do you have on my child?", could you answer in a day? If the answer lives in four places, probably not.
- Can I delete it when it is no longer needed? An enquiry from two years ago that never turned into a visit. Who deletes it, and when?
- Who can see what? A new front-desk joiner should not be able to scroll through every patient's messages. A spreadsheet shared with everyone is the usual weak spot.
- If something leaks, who do I tell and how fast? A staff member loses a phone with the clinic WhatsApp on it. Do you know the first three steps?
If you can answer four of six today, you are ahead of most. If you can answer none, that is normal, and it is a good week to start.
Where this goes wrong in real businesses
It is rarely a hacker. It is a coaching academy where each counsellor keeps parents' chats on a personal phone, and one of them leaves. It is a real-estate broker with a spreadsheet of buyers' budgets on a shared drive. It is a contact saved on someone's phone and nothing else.
The common thread is that the conversation is scattered, so nobody can say what is held, by whom, or whether it is still needed.
Where PROXe fits
We will be careful here. PROXe does not make a business compliant with any law, and we are not claiming that. Compliance is a mix of your notice, your processes and your tools.
What we can say is this. Scattered chats are the hardest thing to account for. PROXe keeps the conversation with each person in one thread across the channels you use, so your team is working from one record instead of five phones. When someone steps in, they see the whole conversation and the customer does not have to repeat themselves. And if your voice agent calls people, say it is an AI up front.
Having one place for each person's conversation is a good base for questions 1, 3 and 5 above. The notice, the deletion rules and the breach plan are still yours to set.
It works the same for clinics, coaching academies, real estate and other businesses with a steady flow of enquiries. Plans are on the pricing page.
The takeaway
You do not need to read the whole Act this week. You need to know where your customer chats live, tell people why you collect their details, and be able to delete them.
If you want to see what one thread per customer looks like for your own enquiries, book a demo.
Related
Recent
Google clicks are falling. What to do with the ones you get
AI answers on Google mean fewer clicks to your site. If you run a clinic, academy or service business, here is how to treat every visitor who still comes.
October 26, 2026 · 4 min read
Should your AI caller say it's an AI?
AI voices now sound human. If an AI answers your clinic or academy phone, here is what to tell callers, what it may say, and when a person steps in.
October 25, 2026 · 5 min read
WhatsApp's built-in AI: what your desk still decides
Meta's Business AI now answers WhatsApp chats for small businesses in India. Here is what a clinic, academy or real estate desk still has to decide.
October 24, 2026 · 5 min read
