You're likely a Data Processor. Here's what that means.
Clients may send you data about their users, like lead lists or support tickets. You then usually act for them. The DPDP Act calls you a Data Processor. The client is the Fiduciary.
Not sure if DPDP applies to you? Take the 2-minute self-check →
Do these first. 1. Law: your client may use you only under a valid contract (Section 8(2)). Good practice: say in it what you may do, how you keep data safe, and when you delete it. 2. Good practice: use only the data you need. 3. Good practice: delete the data when the job ends, and keep a note. 4. Good practice: if data leaks, tell the client at once. The client must tell the Board (Section 8(6)).
Start here
Readiness Checklist for freelancers
A short checklist for your client contracts and how you handle data.
OpenDeep dives
Do DPDP duties apply to me?
Working solo doesn't take you out of scope. Run the 2-minute self-check to see whether you're a Data Fiduciary for your clients' users.
Run it nowWritten by Sandesh Kokate, reviewed against primary sources.Connect on LinkedIn →