DPDP for small businesses and MSMEs

A small business runs on contacts. The customer list is in the shop phone, orders arrive on WhatsApp, credit (udhaar) is tracked in a Google Sheet, invoices are in Tally or a billing app, and staff records sit in an Excel file on the owner’s laptop. None of it feels like a “database”, but it is digital personal data, and the DPDP Act applies to it in full. There is no SME exemption. Section 17(3) lets the government exempt notified classes of fiduciaries, including startups, from some duties, but no such notification has been issued. Udyam registration does not change this.

The good news is that a small business’s risk is concentrated in a few places, and most of the fixes cost little or nothing: fewer fields, separate permission for offers, locked phones, cleaned-up WhatsApp groups, and a named person who answers questions. The real risk sits in lost or shared phones, staff who leave with the customer list, offers sent without permission, and spreadsheets nobody ever deletes. This guide applies the Data Fiduciary playbook to small and micro businesses.

Are you a Data Fiduciary, a processor, or both?

• Shop, trader or local service business: you decide why customer details are collected and how they are used, so you are the Data Fiduciary for your customers, your staff and the individuals among your supplier contacts. This is true even if the business is a sole proprietorship and the data is on the owner’s personal phone. The “personal or domestic purpose” exclusion in section 3(c)(i) covers your family chats, not your customer list.
• Your vendors are your Data Processors: the billing or POS app provider, Tally hosting or the cloud backup, Google Workspace or Microsoft 365, the SMS or WhatsApp Business solution provider, your website or online-store builder, and the courier who delivers to customers. Your CA or accountant usually acts as your processor when they keep your books and file your returns from your data. You remain responsible for what they do with it (section 8(1)).
• Small manufacturer or distributor selling to businesses: most of your data is about other businesses, which is not personal data. The individuals behind them (proprietors, purchase managers, dealers’ phone numbers) are personal data, and so are your workers’ records.
• Freelancer or consultant with staff: you are a fiduciary for your own clients, staff and leads. When a client hands you their customer list to run a campaign, or their staff data to run payroll, you are usually their processor and should only use it as they instruct. See professional services if this is most of your work.
• Paper only: the Act covers personal data collected digitally, or collected on paper and digitised later (section 3(a)). A paper register that never leaves the drawer is outside it. Photograph that register for a WhatsApp group, type it into Excel, or scan it, and it is inside. In practice almost every small business is covered.

The data you hold

Data category	Where it usually lives	Typical purpose	Sensitivity	Typical retention
Customer names and mobile numbers	Shop phone contacts, WhatsApp Business, billing app	Bills, delivery, callbacks, repeat orders	Medium	While the customer keeps buying; review inactive contacts every year
WhatsApp chats, voice notes, photos sent by customers	Owner’s and staff phones, WhatsApp backups on Google Drive or iCloud	Orders, quotes, complaints, measurements, repairs	Medium to high (photos of homes, documents, faces)	Clear chats once the order and any dispute are closed
Delivery addresses and location pins	WhatsApp, Google Sheets, delivery boy’s phone	Home delivery, site visits	Medium to high (reveals home and routine)	Until delivery and the return or warranty period close
Credit (udhaar) ledger	Google Sheet, Khatabook-type app, Tally	Collecting dues	High (financial, can embarrass)	Until settled, then as accounting law requires
Invoices with customer details, GSTIN of proprietors	Tally, billing app, email	GST, accounts, warranty	Medium	The period tax law requires (ask your CA)
UPI and payment references	UPI app, bank statements, payment QR provider	Reconciliation, refunds	Medium to high	As accounting law requires
ID copies (Aadhaar, PAN, driving licence)	Phone gallery, WhatsApp, a folder on the laptop	KYC for some trades (SIM, gold, rentals, travel tickets), staff onboarding	High	Only where a law requires it; otherwise do not collect
Staff records: name, address, bank account, salary, attendance	Excel, payroll app, attendance app, owner’s phone	Wages, ESI and PF where applicable, attendance	High	During employment, then as labour and tax law require
Leads and enquiries	Google Forms, IndiaMART or JustDial lead inbox, Instagram DMs	Following up an enquiry	Low to medium	3–6 months if they do not convert
Marketing lists and broadcast groups	WhatsApp broadcast lists, community groups, SMS tool	Offers, festive greetings, new stock	Medium	Until the person withdraws
CCTV footage	DVR or NVR in the shop, cloud camera app	Theft prevention, staff safety	Medium to high	Short loop (for example 15–30 days) unless an incident is under review
Measurements, preferences or service history (tailor, optician, salon, AC repair)	Notebook photos, Sheets, service app	Repeat service	Medium (sometimes health-related)	While the customer is active
Supplier and dealer contacts	Phone, Tally ledgers, email	Purchasing, payments	Low to medium	During the relationship, then as accounting needs

Risk hotspots

1. The shop phone and the owner’s personal phone. One phone often holds every customer, every chat, the UPI app and the Google account. Failure: the phone is lost, stolen or handed to a repair shop unlocked, and everything is exposed. Control: a screen lock with a PIN or biometric, a separate work profile or a separate work phone, Find My Device turned on, WhatsApp two-step verification, and remote wipe tested once.
2. WhatsApp groups and broadcast lists. Customers get added to groups where every member can see every other member’s number. Failure: disclosure of hundreds of numbers to strangers, and promotional messages without consent. Control: use broadcast lists or WhatsApp Business messages, not groups, for offers; only add people who said yes; give a one-line way to stop (“Reply STOP”).
3. Staff who leave with the customer list. A salesperson who ran orders from their own WhatsApp takes the contacts to a competitor. Failure: unauthorised processing that you are answerable for, and a lost business asset. Control: business numbers on business-owned SIMs or WhatsApp Business accounts, a confidentiality clause in the appointment letter, and removal of access on the last day.
4. Google Sheets shared with “anyone with the link”. Credit ledgers and order trackers get shared with delivery staff, family members and sometimes the whole internet. Failure: a link forwarded once is a breach. Control: share with named Google accounts only, review “Shared with” every quarter, and keep the udhaar sheet separate from the delivery sheet.
5. ID copies nobody needs. Shops often photograph an Aadhaar card “for safety” for rentals, repairs or credit. Failure: high-sensitivity data held with no legal need, which raises the stakes of any breach. Control: collect ID only where a law requires it, prefer masked Aadhaar or DigiLocker verification where KYC is required, write the purpose on the record, and delete copies once the purpose is over.
6. Offers sent without permission. Festival greetings with discounts, new-stock broadcasts and bulk SMS go to everyone who ever bought. Failure: processing without consent for marketing, plus a TRAI problem for SMS and calls. Control: a separate, unticked opt-in for offers on WhatsApp, SMS or calls, recorded with the date and how it was given.
7. The billing app and Tally. Everyone logs in as “admin”, and old customer data never leaves. Failure: no way to know who saw or exported what. Control: one login per person, the least access each role needs, export disabled for counter staff, and the vendor’s audit log switched on and kept for at least a year (rule 6(1)(e)).
8. The CA, the website builder and the courier. You share full books, customer exports and addresses without any written terms. Failure: you stay responsible for their mistakes (section 8(1)) and have no contract as section 8(2) requires. Control: a short data processing addendum or engagement-letter clause: use only for your work, keep it safe, tell you about a breach quickly, delete or return it when asked.
9. WhatsApp and phone backups. Chat backups go to a personal Google Drive or iCloud, often unencrypted, and survive long after you delete chats. Control: turn on end-to-end encrypted backups in WhatsApp, back up to an account the business controls, and delete old backups when you clean up.
10. CCTV that sees too much. Cameras pointing at the street, a neighbour’s door, the staff changing area or a till screen showing card PINs. Control: point cameras only where security needs them, put up a sign, keep a short recording loop, and limit who can view or copy footage.

Legal basis, purpose by purpose

Purpose	Basis	Notes
Sending a bill or payment receipt to the mobile number the customer gave	7(a)	This is the Act’s own illustration under section 7(a), a pharmacy sending a receipt. Do not add offers to the same message.
Taking and delivering an order placed on WhatsApp or by phone	7(a)	Use the address and number only for this order unless the customer agrees to more.
Repairs, alterations, site visits and service follow-ups the customer asked for	7(a)	When the customer says they no longer need help, stop (see the broker illustration under section 7(a)).
Credit (udhaar) ledger and reminders of dues	7(a), for the credit the customer asked for	Keep reminders private and polite. Never post defaulters’ names in groups or on a board.
Invoices, GST records and books of account	Retention required by law; 7(d) for disclosures to tax authorities	Keep only what tax law requires and restrict access.
KYC where a law requires it (for example SIM sales, some gold or high-value cash sales)	Retention required by law; 7(d) where reporting to the State is required	Prefer masked Aadhaar or DigiLocker. Confirm the current requirement for your trade with counsel.
Promotional WhatsApp, SMS, calls and email	Consent, per channel	Also follow TRAI’s rules on commercial communication for SMS and calls.
Adding a customer to a WhatsApp group or community	Consent	Members see each other’s numbers. Prefer broadcast lists.
Customer reviews, testimonials and photos on Instagram or Google	Consent	Get it in writing (a WhatsApp “yes” is fine) and delete on request.
Staff wages, attendance, ESI and PF where applicable	7(i)	Employment purposes only. Do not use staff phones’ contacts or galleries. See employers and HR.
CCTV for theft and staff safety	Prevention and detection of offences, section 17(1)(c), for security use; 7(i) for staff	This is a common reading, not a settled one. Security duties in section 8(5) still apply. Do not use footage for marketing. Confirm with counsel.
Following up an enquiry from IndiaMART, JustDial or an Instagram DM	7(a)	Only about what they asked. Adding them to your offers list needs consent.
Sharing customer details with a supplier, brand or finance partner	Consent, naming who receives it	Unless it is needed to fulfil what the customer asked for (for example a warranty registration they requested).

Notices and consent: getting the screens right

Channel	Do	Don’t
Counter and billing	Ask “Do you want the bill on WhatsApp?” and take the number only if they say yes. Keep a printed one-page notice and a QR code to the full notice at the counter.	Refuse to bill a customer who will not give a number. Make “number for offers” part of the billing step.
WhatsApp Business	Put a short notice and the link in your profile and in the greeting message. Ask separately before adding someone to offers: “Can we send you new-stock offers here? Reply YES.”	Add people to groups without asking. Send offers to everyone who ever messaged you.
Phone orders	Say in one line why you need the address and number. Note in the order sheet if the customer agreed to offers.	Treat a phone order as permission for marketing calls.
Google Forms, website or online store	Put the notice above the form, list what you collect, and add a separate unticked box for offers.	Pre-tick boxes or hide offers consent inside “Terms”.
Paper forms and registers	Print the notice on the form, with a separate box for offers. If you later type it into a computer, record that consent was given on paper.	Photograph full registers into WhatsApp groups.
Field visits and delivery staff	Give staff a printed card with the notice and your contact for questions.	Let delivery staff save customer numbers on personal phones.
Social media DMs	Reply with your notice link when you collect an address or phone.	Repost a customer’s photo or message without asking.
Existing customers	Send one WhatsApp or SMS with the notice link and a way to choose (section 5(2)).	Assume everyone on the old list wants offers.

Rule 3 sets the minimum contents of a notice: it must be understandable on its own, give an itemised list of the personal data and the purpose for each, describe the goods or services or uses involved, and give a link and other means to withdraw consent, use rights and complain to the Board. A one-page notice can do all this. People must be able to read it in English or any of the 22 Eighth Schedule languages (section 5(3)). For a small business, have the notice ready in English, Hindi and your local language at the counter, and the others available on request.

Other laws you must line up with

• Income-tax Act and GST law: these require you to keep invoices and books for a set period. That overrides erasure requests for those records only. Confirm the current period with your CA.
• TRAI Telecom Commercial Communications Customer Preference Regulations (TCCCPR): promotional SMS and calls go through registered headers, templates and consent. DPDP consent and TRAI consent overlap but are not identical; keep both.
• Consumer Protection Act, 2019: misleading offers, forced bundling and dark patterns in your online store breach consumer law and can make consent invalid under section 6.
• Shops and Establishments Acts (state-wise) and the labour codes: registers of staff, wages and attendance must be kept. They are a legal reason to retain staff data after someone leaves. Confirm the current requirement with counsel.
• Employees’ State Insurance and Employees’ Provident Fund law, where they apply to you: these require certain staff identifiers. Collect what the scheme requires, no more.
• IT Act, 2000 and CERT-In Directions (2022): cyber incidents may need reporting to CERT-In on a shorter clock than DPDP. Small businesses are often unsure whether the directions cover them. Confirm the current requirement with counsel.
• Trade-specific KYC rules (for example SIM sales under telecom rules, high-value cash sales, gold and jewellery, travel bookings): these set what ID you must collect and keep. Where they do not apply, do not collect ID.

Retention and erasure

1. Section 8(7): erase personal data when the customer withdraws consent or when the purpose is clearly over, whichever comes first, unless a law requires you to keep it. For a small business this means: clear chats and addresses after delivery and any return or warranty period; remove leads who did not convert; delete ID copies once the job is done.
2. The one-year minimum: rule 8(3) requires you, and your processors, to keep the personal data, associated traffic data and logs of processing for at least one year from the processing. Then erase it unless another law needs longer. In practice: keep the billing app’s records and logs for a year, then purge what tax law does not need.
3. Legal holds: if a customer disputes a bill, a payment is under recovery, or the police ask about a theft, keep the relevant records until it is resolved. Write down what you are holding and why.
4. Third Schedule: the three-year inactivity rule applies only to e-commerce entities with 2 crore or more registered users, online gaming intermediaries with 50 lakh or more, and social media intermediaries with 2 crore or more. It does not apply to a small business, including a small online store.
5. Processors: ask your billing-app provider, cloud backup, SMS or WhatsApp provider and courier how they delete, and ask them to confirm when you request it.
6. Backups and phones: set a yearly clean-up day. Delete old WhatsApp chats and backups, old Excel exports in Downloads, and photos of customer documents in the phone gallery. Factory reset any phone before it is sold, exchanged or given to a family member.

Rights requests and grievances

• Channels: a WhatsApp number and an email address are enough. Publish them on the notice, the WhatsApp Business profile, your website (if you have one) and the counter. Say what identifier you need, usually the registered mobile number (rule 14(1)).
• Identity: confirm requests from the same number the customer uses with you, or with an OTP. Do not ask for an Aadhaar copy or any document you do not already hold.
• Access (section 11): tell the person what you hold (name, number, address, purchases, credit balance, consent to offers) and who you shared it with: the courier, the billing-app provider, the CA, any brand for warranty registration.
• Correction and erasure (section 12): correct addresses and numbers promptly; this matters for credit records too (section 8(3)). Erase contacts, chats, addresses and marketing consent on request. You may refuse to erase invoices and books the law requires you to keep, and credit records while dues are outstanding. Tell the person what you kept and why.
• Grievances: acknowledge within a day or two. Publish a resolution period within the 90-day ceiling in rule 14(3); 15–30 days is good practice and easy for a small business to meet. Mention your contact person in every reply (rule 9).
• Nomination (section 14): let a customer name someone who can act for them if they die or cannot act. This rarely comes up for a shop, but note it in your process, especially if you hold customer deposits, advances or gift vouchers.

Breach readiness

Likely scenarios:

• a lost or stolen phone with WhatsApp, contacts and the UPI app
• a shared Google Sheet link that went beyond its audience
• a former employee with the customer list
• a hacked email or Google account
• ransomware on the billing computer
• a CCTV clip shared on social media

Run-book:

1. Contain the same day: log out the WhatsApp linked devices, change passwords, use remote wipe, remove sharing on the sheet, revoke the ex-employee’s access.
2. Assess: what was exposed, how many people, and what could happen to them (scam calls, fraud, embarrassment over dues, physical safety if addresses leaked).
3. Notify each affected person without delay, through the number or email they use with you, covering everything rule 7(1) requires: what happened, the nature, extent and timing; the likely consequences for them; what you are doing about it; what they can do to protect themselves (for example, ignore calls asking for OTPs or payment); and who to contact.
4. Notify the Data Protection Board without delay with a description of the breach, then send the detailed report within 72 hours of becoming aware (rule 7(2)), covering the facts, mitigation, any findings about who caused it, steps to prevent a repeat, and the notices you sent to people.
5. Report to CERT-In where its directions apply, and file a police complaint for theft or hacking.
6. Learn: fix the cause (for example, move offers off personal phones), and record what you did.

The checklist

Phase 1: discover (days 0–30)

• [Leadership] Name one person in the business as the DPDP owner and contact person.
• [Leadership] List every phone, laptop and account used for business: SIMs, WhatsApp numbers, Google and email accounts, Tally, the billing app.
• [Ops] List every WhatsApp group and broadcast list that contains customers, and who created each.
• [Ops] List every Google Sheet, Excel file and form that holds customer, credit or staff data, and who it is shared with.
• [Finance] Find where ID copies (Aadhaar, PAN, licences) are stored, and whether any law requires them for your trade.
• [Ops] Check where the CCTV cameras point, how long recordings are kept and who can view them.
• [Leadership] List every vendor that sees personal data: billing app, cloud, SMS or WhatsApp provider, website builder, courier, CA.
• [Marketing] Find out who on your offers lists actually agreed to receive offers, and how.
• [HR] Check what staff data you keep, and whether staff use personal phones for customer work.
• [Ops] Check whether delivery staff and salespeople save customer numbers and addresses on their own phones.
• [Leadership] Check whether children are among your customers, students or class participants.

Phase 2: design and build (days 31–90)

• [Leadership] Write a one-page notice: what you collect, why, how to withdraw, how to make a request, how to complain to the Board, and your contact.
• [Leadership] Get the notice in English, Hindi and your local language; keep the others available on request.
• [Ops] Put the notice and a QR code at the counter, on the WhatsApp Business profile, on forms and on the website.
• [Ops] Make the phone number optional at billing unless the customer wants an e-bill, delivery or callback.
• [Marketing] Add a separate, unticked opt-in for offers on each channel, and record the date and how it was given.
• [Marketing] Move offers from WhatsApp groups to broadcast lists or WhatsApp Business messages, and add a “Reply STOP” line.
• [Marketing] Send existing customers one message with the notice link and a way to choose (section 5(2)); remove anyone who does not opt in.
• [Ops] Switch on screen locks, Find My Device and WhatsApp two-step verification on every work phone.
• [Ops] Turn on two-factor login for Google, email, the billing app and online banking.
• [Ops] Create one login per person in Tally and the billing app; remove shared “admin” use; limit exports.
• [Ops] Change sharing on every sheet to named people only; split the credit ledger from the delivery sheet.
• [Ops] Turn on encrypted WhatsApp backups to an account the business controls.
• [Ops] Ask your courier or delivery app whether customer numbers are masked, and share only what each delivery needs.
• [Marketing] Before sending promotional SMS, make sure your provider uses registered headers and templates under TRAI rules.
• [Finance] Stop collecting ID copies where no law requires them; where KYC is required, use masked Aadhaar or DigiLocker.
• [Finance] Delete ID copies, old exports and document photos you no longer need.
• [Leadership] Add a short DPDP clause to your CA engagement letter and to vendor terms: use only for your work, keep it safe, report breaches, delete on request.
• [Ops] Ask the billing-app provider whether its logs are kept for one year and whether data is hosted in India.
• [Ops] Point CCTV only where security needs it, put up a sign, set a short loop and restrict who can copy clips.
• [HR] Add a confidentiality and data clause to appointment letters, and a leaving checklist that removes access.
• [HR] Move customer work to business-owned SIMs or WhatsApp Business accounts where you can.
• [Leadership] Publish your contact, the request channels, the identifier you need and a grievance period of 15–30 days.
• [Ops] Keep a simple register (a sheet is fine) of requests and grievances with dates and outcomes.
• [Leadership] Write a one-page breach plan with phone numbers: who decides, who tells customers, who writes to the Board.
• [Ops] If children shop with you or join classes you run, do not add them to offers lists, and get a parent’s consent for anything beyond the sale.

Phase 3: operate (ongoing)

• [Leadership] Train staff once a year in 30 minutes: what not to forward, how to answer a request, what to do if a phone is lost.
• [Ops] Run a clean-up day every quarter: old chats, leads, exports, gallery photos and backups.
• [Marketing] Remove people who reply STOP within a day, from every list and tool.
• [Ops] Review sheet sharing and app logins every quarter, and on every staff exit.
• [Finance] Purge invoices and books once the period tax law requires has passed.
• [Leadership] Review vendor terms when you add or change a vendor.
• [Ops] Test remote wipe and account recovery on one phone every year.
• [Leadership] Run a 30-minute breach drill once a year (for example, a lost shop phone) against the 72-hour clock.
• [Ops] Factory reset any phone or laptop before it is sold, exchanged or sent for repair.
• [Leadership] Keep evidence of consents, withdrawals, erasures and staff training in one folder.
• [Leadership] Check every year whether the government has notified any exemption under section 17(3) and what it covers.

Where myconsentapp comes in

You need to	With myconsentapp	You still own
Ask for permission to send offers	Set up purposes (WhatsApp offers, SMS offers, reviews and photos) once. A QR code at the counter opens the hosted consent page, with each purpose as a separate toggle, off by default.	Putting the QR code where customers see it.
Record a yes given on paper or by phone	Record consent captured elsewhere (paper, phone, counter), marked as not verified by the person, in the same ledger as everything else.	Keeping the paper form.
Prove consent if someone complains	Each choice is signed and hash-chained against the exact notice version. The customer can get a receipt, and you can download an evidence pack.
Publish a notice in Indian languages	Versioned notices in English and all 22 Eighth Schedule languages, with the rights, withdrawal and Board-complaint block and your contact added automatically. Machine-translation drafts are flagged for review.	Checking the translation in your local language.
Check before a broadcast	Call the verify API; it returns not permitted immediately after a withdrawal.	Removing them from your WhatsApp list.
Answer requests and complaints	A rights inbox with SLA timers for access, correction, erasure and grievances; erasure closes with a structured proof.	The replies.
Keep track of vendors	A processor registry with contract dates and expiry flags, linked to the purposes each vendor serves.	Signing the terms with your CA and vendors.
Know when to delete	Retention days per purpose; the retention job tells you when access should end and opens erasure on withdrawal.	Deleting chats, sheets and phone data yourself.
Handle a breach	A breach register with the 72-hour clock, Rule 7 notices to customers in English and Hindi, and Board intimation and report documents.	Finding out what happened.

Not included: myconsentapp does not scan your phones, WhatsApp or spreadsheets for personal data, and it is not a security product. You still lock phones, clean up sheets and run your own backups.

Common mistakes

• Believing small businesses are exempt. They are not, unless the government notifies an exemption under section 17(3), and none exists.
• Refusing to bill a customer who will not give a phone number.
• Adding customers to WhatsApp groups where everyone can see everyone’s number.
• Running the business from the owner’s personal phone with no screen lock or two-step verification.
• Keeping photos of customers’ Aadhaar cards with no law requiring them.
• Sharing the udhaar sheet with “anyone with the link”.
• Letting staff keep customer numbers on their personal phones after they leave.
• Having no written terms with the CA, the billing-app provider or the courier.

Frequently asked questions

We are a two-person shop. Does the DPDP Act really apply? Yes, if you keep any customer or staff data in a phone, computer, app or cloud. The Act has no size threshold. Section 17(3) allows the government to exempt notified classes from some duties, but nothing has been notified. The penalties in the Schedule are maximums, and the Board must consider proportionality and the likely impact on you when it sets one (section 33(2)), but that is not a reason to ignore the duties.

Do I need consent to send a customer their bill on WhatsApp? No, if they gave you the number for that. Section 7(a) covers data a person voluntarily provides for a specified purpose, and the Act’s own example is a pharmacy sending a payment receipt by message. Telling customers plainly what you use their number for is still good practice. Offers in the same message need separate consent.

Can I keep sending festival offers to my old customer list? Only to people who agreed to receive them. Send the old list one message with your notice and a way to opt in, and keep only those who say yes. Section 5(2) requires you to send people who consented before the Act a notice as soon as reasonably practicable; you may continue until they withdraw, but only where they actually agreed to offers in the first place.

My CA has all my books. Is that a problem? No, but it needs to be in writing. Your CA usually acts as your processor, and section 8(2) requires a valid contract. A short clause in the engagement letter covering confidentiality, security, breach notice and deletion on request is usually enough.

Do I need a Data Protection Officer? No. Only Significant Data Fiduciaries must appoint one, and a small business is very unlikely to be notified as one. You must still publish the contact details of a person who can answer questions about your use of personal data (section 8(9), rule 9). The owner or manager can be that person.

Is a paper register outside the Act? Only if it stays on paper. The Act covers data collected digitally, or collected on paper and later digitised (section 3(a)). The moment you photograph, scan or type it into a phone or computer, it is covered.

Do I have to delete my CCTV footage? Keep it only as long as security needs, which is usually a short loop. Keep a clip longer only when there is an incident, a complaint or a police request. Footage is personal data, so protect who can view and copy it.

What is the cheapest thing I can do this month? Lock every work phone, turn on WhatsApp two-step verification, stop adding customers to groups, make the phone number optional at billing, and put a one-page notice at the counter. That covers most of the real risk.