The DPDP Act and your paper records

What the Act actually reaches

Four ideas carry most of the practical weight for a records holder, and none of them needs a legal degree:

• Purpose. Data may be used for what you told the person, and nothing else. A KYC copy kept for a loan file becomes a problem when it is “also handy” for marketing.
• Minimisation. Collect what the purpose needs. Photographing the reverse of an Aadhaar card to “verify a signature” is over-collection by any reading.
• Retention. Delete when the purpose ends. Not “archive forever, it costs nothing” — the cost is the breach you did not have to be exposed to.
• Reasonable security and notification. Protect it, and tell the person and the Data Protection Board when you fail to.

The part that surprises people: the compliance machinery — consent records, erasure, access requests — assumes you can find a record. An office that cannot locate a 2019 file in five minutes cannot honour an erasure request in thirty days. Searchability is a compliance control, not a convenience.

Do the inventory first; it is a one-week job

Before buying anything, answer five questions per record class. On one sheet of paper, for the whole office. It is the single highest-value compliance task available to a small organisation in India:

Paper is not exempt because it is paper

The Act’s security and breach duties bite on any personal data you process, and an open almirah in a shared office corridor is a security failure that no amount of server-side encryption fixes. Three concrete moves, in order of effect per rupee:

1. Stop duplicating. The single largest reduction in exposure is destroying the “reference copies” — the ID photocopies, the extra printouts, the photographs on personal phones. Keep one authoritative record.
2. Lock the class, not the room. Diagnosis sheets, minors’ admissions files and financial originals get separate, named custodians. A padlock on the whole rack teaches everyone to work around the padlock.
3. Put a clock on it. A written destruction schedule with a signature line per year. Erasure you can prove is worth more than encryption nobody asks about.

Digitising without importing the problem

Digitisation multiplies copies, which is the opposite of minimisation — unless you decide the rules before the scanner starts. The five decisions that keep a digitisation project lawful by construction:

• Encrypt at capture, not at rest. If the file never exists in a readable form on a shared machine, a stolen laptop is not a breach.
• Tie every record to a purpose and a date. Retention should be a field, not a memory. If your archive cannot answer “what expires in 2031”, you will keep everything forever.
• Redact on the way in, not on the way out. Drop the ID number, keep the fact that ID was verified.
• Log opens and exports. An access log is how you answer “who leaked it” in an hour instead of ever.
• Make erasure a query, not a project. One search for a person’s name, one delete, one receipt. That is the whole test of a records system.

Small and medium: what is realistically expected

Simplified obligations exist for smaller entities, and “simplified” means less paperwork, not fewer duties. A shop or a two-doctor clinic is expected to hold a plain-language consent line, a retention decision, and a phone number for a grievance contact. What is not expected is a data protection officer or a fifty-page policy nobody reads. The cheapest compliance win for a small business in India is not a policy document; it is deleting a drawer.

If you can’t delete it, you probably shouldn’t have collected it. Nearly every DPDP problem in a records room reduces to that sentence.

We wrote the tooling side of this deliberately: zero-knowledge encryption so a breach of our storage is not a breach of your data, per-field OCR that finds the person’s name in Odia or Hindi so erasure is a search, and an export of every extracted field so a subject request does not need our cooperation at all. For the specific sector consequences, the healthcare and retail notes go into retention windows.

Questions this raises