Playbook · MSMEs
A practical 30-day rollout for the MSME owner-operator who already wears five hats and just needs DPDP done — without hiring a compliance consultant or reading the full Act.
Day 1 (~30 min)
Day 2–7 (~3 hrs across the week)
Day 8–30
When: Once at first interaction; refresh annually for active customers.
Purposes:
Retention: 8 years from last transaction (Income Tax + GST). Marketing consent revocable at any time.
When: At signup or point of capture; explicit opt-in.
Purposes:
Retention: Active until withdrawn; 30-day grace period for in-flight campaigns then full purge.
When: Once at hire.
Purposes:
Retention: 7 years post-exit (Industrial Disputes Act §7 + IT). Exit interview / review notes purged at 7 years.
When: Per vendor relationship; renew if vendor's purpose changes.
Purposes:
Retention: As long as the vendor relationship exists; data-erasure clause kicks in within 90 days of termination.
| Record type | Retention | Source |
|---|---|---|
| Customer KYC + invoices | 8 years from last transaction | IT Act §44AA + GST |
| Sales books / accounting | 8 years | IT + Companies Act |
| Tax returns + ITR proofs | 8 years | IT Act |
| Payroll + statutory filings | 7 years post-exit | ID Act §7 + EPF |
| Performance reviews | 7 years post-exit | ID Act §7 |
| Customer support tickets | 3 years from closure | Internal — minimisation |
| Marketing audience lists | Until withdrawn / 18 months idle | Internal — DPDP §8 |
| Vendor / processor agreements | 3 years post-termination | Limitation Act + DPDP |
| CCTV (factory / shop) | 30 days unless incident | Internal — POSH / safety |
Edit at /dpo/retention. Each row is a signed RS-* artifact with the legal source recorded.
Every cloud / SaaS tool you use that processes Indian customer data outside India is a §16 cross-border transfer. The DPB hasn't blacklisted any country yet (as of 2026), but you must register the transfer and state your safeguard. A vendor audit will ask for this list.
Common MSME transfers to register:
In /dpo/transfers/new the "MSME / SaaS vendor" scenario template pre-fills these one-by-one.
Customer database exported by ex-employee
An ex-sales employee is suspected of having taken the customer list to a competitor.
Phishing → spoofed PAN cards uploaded by fake customer
Investigation reveals 12 customer accounts were registered with fraudulent PAN cards by an attacker; KYC data is now polluted.
WhatsApp broadcast sent to opted-out customers
Marketing team accidentally sent a Diwali offer to a list that included 200 customers who had withdrawn marketing consent.
MSMEs face audits from three sides: their own corporate buyers (vendor questionnaires), GeM listings, and increasingly the DPB. All three want the same evidence.
"Show me your privacy notice + grievance officer."
Public link to /privacy or /dpo/policies. The grievance officer's name + email are in /dpo/governance — both are on signed PL-* artifacts.
"Show me consent for my data (as a buyer's customer)."
/dpo/consent — filter by customer email, download the signed CR-* receipt PDF.
"What's your retention policy and have you done deletions?"
/dpo/retention shows the schedule. /dpo/erasure-jobs shows scheduled / executed deletions with proof of completion.
"Show me your vendor list and cross-border transfers."
/dpo/vendors and /dpo/transfers. Each entry is a signed VN-* / TN-* artifact.
"Have you had a breach? How did you handle it?"
/dpo/incidents — Sanad shows count by severity, MTTR, and signed IR-* artifacts proving the timeline.
"Are your endpoints encrypted, patched, and AV-protected?"
/dpo/sentinel/dashboard — live posture from Sentinel-equipped endpoints with signed heartbeats.
Sign up, pick the MSME tier matching your turnover, and your console arrives with templates + retention + sector dashboard pre-loaded.
Start an MSME tenantSector-specific question? Email us.