Data Privacy Week takes place every January. EthicsComputer registered as an official Champion of Data Privacy Week in 2023, 2024 and 2026, alongside being a Cybersecurity Awareness Month Champion every year since 2023.
For Indian businesses, privacy is no longer only good practice: the Digital Personal Data Protection (DPDP) Act, 2023 makes it a legal duty. Below is what the campaign is about and a practical checklist you can start on this week.
Quick answer: Data Privacy Week is an annual campaign held in late January around Data Privacy Day (28 January), led by the National Cybersecurity Alliance. It encourages people to take control of their personal data and organisations to respect it. Champions are organisations that register to promote the campaign; EthicsComputer was a Champion in 2023, 2024 and 2026.
What is Data Privacy Week?
Data Privacy Day marks the anniversary of the signing of Convention 108, the first international treaty on data protection, on 28 January 1981. In 2022 the National Cybersecurity Alliance expanded the day into a full week. The message has two sides: individuals should understand and manage what they share, and businesses should collect only what they need and protect it properly.
What does being a Champion mean?
A Champion registers with the National Cybersecurity Alliance and commits to sharing privacy guidance with its staff, customers and community. It is free, and it is not a certification or an endorsement. Our audited certifications are ISO/IEC 27001:2022 (information security), ISO 9001:2015 and ISO 20000-1:2018.
Why privacy is now a legal duty in India
The DPDP Act, 2023 applies to any business that handles digital personal data of people in India: customers, employees, leads, patients, students. The DPDP Rules were notified in November 2025, and most obligations for businesses apply 18 months after that. The main duties are:
- Give a clear notice and take consent before collecting personal data, in English or any of the 22 languages of the Eighth Schedule.
- Use the data only for the purpose you collected it for, and erase it when that purpose is over.
- Take reasonable security safeguards to prevent a breach.
- If a breach happens, inform the Data Protection Board and every affected person.
- Get verifiable parental consent before processing a child's data (under 18).
- Publish a contact for questions and complaints, and act on requests to access, correct or erase data.
Penalties are heavy: up to ₹250 crore for failing to take reasonable security safeguards, and up to ₹200 crore each for failing to report a breach or meet the obligations for children's data.
A privacy checklist for Indian businesses
| # | Step | What "done" looks like |
|---|---|---|
| 1 | Map your personal data | A list of what you collect, where it is stored, who can see it and why you need it. |
| 2 | Collect less | Forms ask only for what the service needs; no "just in case" fields. |
| 3 | Clear notice and consent | Plain-language notice on every form and app, with consent records you can produce. |
| 4 | Lock down access | Role-based access, MFA for staff, encryption for stored and transferred data. |
| 5 | Check your vendors | Contracts with CRM, hosting, payroll and marketing vendors that cover security and deletion. |
| 6 | Set retention periods | A written schedule for how long each type of data is kept, and deletion that actually happens. |
| 7 | Plan for a breach | Who decides, who informs the Data Protection Board and affected people, and who reports to CERT-In within 6 hours. |
| 8 | Handle requests | A named contact and a simple process for access, correction, erasure and complaints. |
| 9 | Protect children's data | Age checks and parental consent wherever minors may sign up. |
| 10 | Train your team | Everyone who handles customer data knows the rules and how to report a mistake. |
Privacy habits to share with your staff
- Never share an OTP, and treat unexpected UPI "collect" requests as fraud until proven otherwise.
- Share a masked Aadhaar (downloadable from UIDAI) instead of a full copy wherever possible.
- Review app permissions on your phone; remove location, contacts and microphone access an app does not need.
- Check privacy settings on WhatsApp, Instagram and LinkedIn, and limit who can see your number and profile details.
- Use separate email addresses for work and personal sign-ups.
How we can help
EthicsComputer helps businesses prepare for the DPDP Act: data mapping, security safeguards, VAPT of the systems that hold personal data, and a breach response plan. See our DPDP Act compliance service or read how a DPDP security audit works.
Not sure where your business stands on privacy?
Tell us how you collect and store customer data, and we will suggest the first three steps.
About the author
Vinay Grover founded EthicsComputer in Rohtak, Haryana in 2018 as a cybersecurity practice and leads its VAPT, software architecture and AI automation work. EthicsComputer is ISO 9001, ISO/IEC 27001 and ISO 20000-1 certified.
