Customer data rules are now law. Is your business ready?
India’s Digital Personal Data Protection (DPDP) rules apply to every business that collects customer details — through a website form, a WhatsApp chat, a guest register or an ID photocopy. We make small businesses and hotels ready, in plain language, at a small-business price.
- Website notices, consent and forms fixed by us
- Guest ID and WhatsApp habits made safe
- Breach plan, retention and staff guidance
- Documents reviewed by a partner lawyer
Your customer data is everywhere.
Most small businesses never decided to collect data — it just piles up: enquiry forms, WhatsApp chats, billing software, guest registers and ID photocopies. The DPDP Act makes the business responsible for all of it.
Website & forms
Contact, booking and quote forms that collect names and numbers without a clear notice or consent.
Guest IDs & registers
Aadhaar and passport photocopies, paper registers and phone photos kept for years.
WhatsApp & staff phones
Customer details shared in staff chats and stored on personal phones.
Software & vendors
Booking engines, CRMs, payroll and IT providers handling data on your behalf, often without written terms.
Built for small businesses, not banks.
Enterprise consent software can cost up to ₹15 lakh a year and a part-time data protection officer ₹2–8 lakh a year (figures quoted by Inc42). A 20-room hotel or a local clinic needs something simpler that actually gets done.
Typical compliance route
- Long legal reports, little implementation
- Software priced for large companies
- Website and forms left unchanged
- Staff habits never addressed
Xuru DPDP-Ready
- We change your website and forms ourselves
- Plain-language notices in English and an Indian language
- Practical rules for IDs, WhatsApp and registers
- Documents reviewed by a partner lawyer
How DPDP-ready is your business?
Answer 10 quick questions. You’ll get a readiness score and the gaps to close first — then, if you like, send it to us for a fixed quote.
0 of 10 answered
A self-check is a quick indicator, not legal advice. A readiness check maps your actual data and gaps.
From messy data to DPDP-ready.
A complete process, done with your team in weeks, not months.
Map
We list what customer data you collect, where it sits, who sees it and how long you keep it.
Fix the website
Plain-language privacy notice, consent on every form, a data-request route and a grievance contact.
Fix daily habits
Rules for ID copies, WhatsApp, registers and staff phones — and a retention schedule.
Paperwork
Breach plan, vendor checklist and staff guidance, reviewed by a partner lawyer.
Keep current
Monthly care: requests handled, notices updated and quarterly checks.
Start with a check. Stay ready monthly.
Every package starts with a written, fixed quote. Larger businesses and multi-branch groups are quoted after the readiness check, with a fixed price agreed before we start. Hotels: get DPDP, scam protection, Form C and more in one plan with Hotel Safe & Compliant.
Readiness Check
Know where you stand in a week.
- Data map: what you collect, where it’s kept, who sees it
- Website, forms and privacy notice reviewed
- Gap report ranked by risk
- Fixed quote for the fixes
Set-up
For shops, clinics, agencies and small offices.
- Privacy notice in plain English + one Indian language
- Consent checkboxes and notices on every website form
- Data request and grievance contact set up
- Retention schedule and breach plan
- Staff guidance (one page) and vendor checklist
- Final documents reviewed by a partner lawyer
Hotel & Guest-house Pack
Built for properties that handle guest IDs every day.
- Everything in Set-up, for hotel workflows
- Guest ID handling: digital checks instead of photocopies where available
- Front-desk and WhatsApp rules for staff
- Booking engine and OTA data review
- Foreign-guest Form C routine: tool set-up, 24-hour checklist and monthly check
- Monthly care included (rights requests, updates, checks)
Monthly Care
Stay compliant as rules and your business change.
- Handle access, correction and deletion requests
- Keep consent records and notices up to date
- Quarterly check of website and forms
- Updates when new rules or guidance arrive
Xuru is a technology and implementation partner, not a law firm, and nothing on this page is legal advice. Where documents need legal sign-off, they are reviewed by a partner lawyer. Timelines shown are based on published rules and indicative dates and may change; no provider can guarantee that a business will never face a complaint or penalty.
Be ready before 2027.
Tell us about your business. We reply within one working day with next steps and a fixed price for your readiness check.
- Hotels, guest houses, clinics, shops, agencies and offices
- Gujarat and across India
- Plain language — English, Hindi or Gujarati
Thank you, .
Your request has reached our team. We’ll reply within one working day with next steps and a fixed quote. For anything urgent, message us on WhatsApp.
Does the DPDP Act apply to small businesses?
Yes. It applies to businesses that handle digital personal data of people in India, including data that is collected on paper and later digitised. Extra duties apply to large “significant” data handlers, but the basics — notice, consent, security, rights requests and breach reporting — apply to everyone.
What are the deadlines?
The DPDP Rules were notified on 14 November 2025 with an 18-month transition. Full enforcement is expected around May 2027. These dates are indicative and may change, so it is safer to start now.
What do I need on my website?
A clear privacy notice, a notice and consent on every form that collects personal data, a way for people to ask for access, correction or deletion, and a contact for data questions. We set all of this up for you.
We are a hotel. Can we still take ID proofs?
Yes — you still need to verify guests. The aim is to take only what you need, keep it safely and for no longer than necessary. Digital Aadhaar checks by QR code or the Aadhaar app are being proposed in place of photocopies; we help you move to them where available.
Is this legal advice?
No. We are a technology and implementation partner. We fix your website, processes and documents, and a partner lawyer reviews the documents that need legal sign-off.
How long does it take?
A readiness check takes about a week. Most small businesses are set up within three to four weeks, depending on how quickly we can review your forms, software and processes with you.
Websites, payments, digital marketing, AI automation, consultancy and practical technology training — for businesses and aspiring professionals worldwide.
Saturday – Sunday: closed