DPDP Act 2023 & Rules 2025: A Practical Compliance Guide for the Jewellery Sector

The Digital Personal Data Protection (DPDP) Act, 2023, along with the DPDP Rules 2025, marks a major shift in how businesses handle personal data in India. For jewellery businesses—where customer trust, high-value transactions, and long-term relationships are central—compliance is about more than just avoiding heavy fines. It is essential for protecting customer trust and operational reputation, because your company decides why and how personal data (like customer profiles, KYC records, and staff files) is processed, it acts as a "Data Fiduciary" under the law. This guide breaks down what that means in practice and offers a clear, manageable roadmap to get your operations fully compliant.

1. WHERE DOES DPDP APPLY IN A JEWELLERY BUSINESS?

The law applies to any personal data collected digitally or gathered on paper and later digitized. In the day-to-day operations of a jewellery company, this typically covers three main areas:

• Customer Touchpoints: Data gathered for loyalty schemes, custom design requests, e-commerce purchases, billing, and mandatory KYC verification for high-value purchases (e.g., PAN card details).
• Employee & HR Records: Staff onboarding files, payroll details, performance reviews, and biometric attendance logs.
• Store Surveillance: CCTV footage recorded at showrooms and workshop premises, as it captures identifiable images of customers, visitors, and staff.

2. LAWFUL PROCESSING & MANAGING CONSENT

Under the new framework, you can only process personal data if you have explicit consent or a valid, legally recognized "legitimate use":

Getting the Notice Right:

Before or at the exact moment you ask for customer or employee data, you must present a clear, jargon-free notice. This notice must clearly state:

• An itemized list of the exact data points being collected.
• The precise purpose behind collecting it (e.g., "To issue your invoice and process warranty claims").
• How individuals can exercise their rights, withdraw consent, or file a complaint.
• The option to view the notice in English or any of the 22 languages listed in the Eighth Schedule of the Indian Constitution.

Rules Around Consent:

Consent cannot be buried in long, unreadable terms and conditions. It must be free, specific, informed, and backed by a clear affirmative action (such as ticking an unchecked box). Furthermore, withdrawing consent must be just as quick and simple as giving it.

3. KEY OBLIGATIONS FOR YOUR COMPANY

As a Data Fiduciary, overall responsibility stays with your company—even if you outsource tasks to third-party vendors.

4. HONOURING INDIVIDUAL DATA RIGHTS

Your business needs straightforward internal workflows to handle requests from customers and staff (referred to as Data Principals):

• Right to Access: Individuals can request a clear summary of the personal data you hold on them, along with details on who it has been shared with.
• Right to Correction & Erasure: You must promptly correct inaccuracies, update old entries, or erase records when requested (provided legal retention rules don't override the request).
• Grievance Handling: Establish an easily accessible channel to resolve complaints. You must respond within a reasonable window (not exceeding 90 days). Individuals must use this system before escalating matters to the official Data Protection Board.
• Right to Nominate: Individuals can formally designate someone else to manage their data rights on their behalf in the event of death or incapacity.

5. MANAGING DATA BREACHES

A data breach includes any unauthorized processing, accidental disclosure, loss, or alteration of personal data. If a breach occurs, your team must take immediate, dual action:

• Report to the Data Protection Board: Send an initial notice describing the event and its potential impact without delay, followed by a comprehensive incident report within 72 hours.
• Inform Affected Individuals: Directly notify every impacted customer or employee without delay. Detail what happened, the potential risks involved, the corrective actions taken, and steps they can take to safeguard themselves.

6. LEGAL PENALTIES FOR NON-COMPLIANCE

The DPDP framework imposes substantial financial penalties to enforce strict accountability:

• Failure to implement reasonable security safeguards: Up to ₹250 crore.
• Failure to report a data breach to the Board or affected individuals: Up to ₹200 crore.
• Breach of any other provision under the Act: Up to ₹50 crore.

7. IMMEDIATE ACTION PLAN FOR YOUR MANAGEMENT TEAM

To move toward full compliance seamlessly, focus on these tactical steps:

• Conduct a Data Discovery Audit: Map out every channel where personal data enters your business—POS systems, digital registration desks, website forms, repair requests, and store CCTV setups.
• Revise Privacy Notices & Consent Forms: Rewrite your store notices, billing forms, and website privacy policies into plain language that explicitly covers DPDP requirements.
• Audit Third-Party Vendor Contracts: Review agreements with your software providers, cloud hosts, and digital agencies to ensure binding data protection clauses are in place.
• Strengthen Technical Controls: Work with your IT team to deploy end-to-end encryption, strict user role permissions, regular security audits, and log management.
• Appoint a Compliance Lead: Assign a dedicated Data Protection Officer or clear point of contact to manage customer requests, oversee internal data handling, and direct emergency breach protocols.

8. HOW JTS LEX CAN SUPPORT YOUR COMPLIANCE JOURNEY, IF NEEDED?

Navigating data privacy laws requires balancing regulatory demands with practical business operations. JTS Lex offers specialized legal advisory services to help jewellery enterprises build and maintain robust, custom compliance frameworks:

• Comprehensive Privacy Audits & Data Mapping: Evaluating your current retail, POS, digital, and HR data flows to identify compliance gaps and high-risk exposures under the DPDP Act & Rules.
• Custom Policy & Notice Drafting: Formulating plain-language privacy policies, bilingual store notices, consent architecture, and website privacy terms tailored specifically to the jewellery sector.
• Vendor Agreement & DPA Structuring: Drafting and negotiating Data Processing Agreements (DPAs) with third-party software providers, payroll vendors, e-commerce partners, and logistics agencies.
• Data Breach Protocol & Incident Response: Designing standardized escalation pathways and breach-notification response plans to ensure compliance with the mandatory reporting rules.
• Grievance Mechanism Setup: Establishing compliant operational procedures and response templates for handling customer and employee data requests (access, correction, erasure, and grievances).