The DPDP Act, 2023: what freelancers and agencies need to know

If you store client names, emails, or phone numbers anywhere, digitally, that makes you a data handler under India's Digital Personal Data Protection Act, 2023 (DPDP Act). You don't need to be a large company for this to apply.

The two roles the Act defines

• Data Fiduciary: the party that decides why and how personal data is processed. For your own account details, that is you, or the platform you use, depending on the data.
• Data Processor: a party processing data on someone else's behalf. If you store a client's customer list to run a campaign for them, you are acting as a processor for that data.

What it practically requires

• Consent: you generally need clear consent before collecting and using someone's personal data for a specific purpose.
• Data minimization: collect what you actually need, not everything you could ask for.
• Security safeguards: reasonable protection against data being leaked or accessed without authorization.
• Grievance handling: a way for someone whose data you hold to ask what you have and request it be corrected or deleted.

What this means day to day

For most freelancers, this doesn't mean hiring a lawyer. It means: don't collect more client information than the project needs, keep it somewhere reasonably secure rather than in a plain spreadsheet you email around, and have a straightforward way to delete a former client's data if they ask.

Helium Suite's own Privacy Notice is structured around these same principles, and includes a Data Rights Request form for exactly this kind of request.