Privacy Training That Works for Small Teams
The DPDP Act never says 'train your staff', but it holds you to what they do; here is a 90-minute module, four role add-ons, a calendar and a way to prove it all happened.
- CATEGORY
- Blog post · Training
- POSITION AS OF
- October 2026
- READING TIME
- 4 min read
- TAGS
- Training, Small business, Security safeguards, DPDP Act
Many personal data incidents in a small company start with a person, not an attacker: a spreadsheet sent to the wrong client, a support agent who confirms an account detail to a caller, a developer who pastes production records into a chatbot to debug a query. The Digital Personal Data Protection Act, 2023 (the DPDP Act) does not tell you to train your staff. It does make you answer for what they do. Here is a programme a team of five to fifty can run without a learning platform.
What the law asks for
We searched the Act and the DPDP Rules, 2025 for a training duty. There is none: the Act never uses the words "training" or "awareness", and the Rules mention training only in the name of a government department. Training still matters, for three reasons.
- Organisational measures. Section 8(4) requires a data fiduciary (the business that decides why and how personal data is used) to implement "appropriate technical and organisational measures to ensure effective observance" of the Act and Rules. Rule 6(1)(g) applies the same idea to security safeguards. In our view a business whose staff handle personal data daily cannot show effective observance if they have never been told the rules.
- Reasonable safeguards. Section 8(5) requires reasonable security safeguards against breaches, and misdirected emails and phished passwords are breaches people cause.
- Penalties. In setting a penalty, the Data Protection Board weighs whether the business acted to mitigate a breach and "the timeliness and effectiveness of such action" (s.33(2)(e)). In our view, staff who recognise an incident and escalate it in minutes are what make mitigation timely.
Some sector rules are explicit. The RBI's 2026 cybersecurity directions for commercial banks make awareness programmes "mandatory for all new recruits", require annual training for lower and middle management and for the Board, and require periodic checks of employees' awareness (paras 202 to 204). SEBI's Cybersecurity and Cyber Resilience Framework of 20 August 2024 lists an annual cybersecurity training programme (PR.AT.S1) for all regulated entities. CERT-In's July 2025 audit guidelines do not mandate training, but contemplate social-engineering tests that "evaluate overall awareness" (para 15.2.2(iii)). Small vendors to banks and brokers will meet these demands in their contracts.
The 90-minute core module
Run it for everyone, live or recorded.
| Minutes | Topic | What staff should leave with |
|---|---|---|
| 0 to 15 | Our data | What personal data we hold, about whom, and where |
| 15 to 30 | Five habits | Collect only what is needed; use it only for the stated purpose; share only through approved tools; keep it only as long as the schedule says; report anything odd at once |
| 30 to 45 | Consent and children | When we rely on consent; what withdrawal means; why under-18s need a parent's consent |
| 45 to 60 | Requests and complaints | How to spot a rights request or grievance and route it the same day |
| 60 to 80 | Incidents | What counts as a breach, including accidental disclosure and loss of access; who to call; a five-minute drill |
| 80 to 90 | AI tools, devices and a quiz | No customer data in unapproved AI tools; ten questions |
Trayambic's data inventory blog shows how to build the first block.
Role-based add-ons
Add 20 to 30 minutes for each group that handles data differently.
- Support: verify identity before disclosing anything; never ask for or read out one-time passwords; log every rights request and grievance (Rule 14 sets a 90-day outer limit for grievances).
- Sales and marketing: record consent for every outreach list; honour withdrawal across all tools; do not buy or scrape lists.
- Engineering: no production data in test environments; keep the one year of logs Rule 6 requires; build deletion that reaches vendors. Our privacy-by-design whitepaper goes further.
- HR: keep medical and inquiry files apart and know what s.7(i) covers. POSH Act s.19(c) already requires regular awareness programmes, so fold privacy into them. Our employee data whitepaper maps each stage.
A calendar that sticks
| When | Who | What |
|---|---|---|
| Within two weeks of joining | Every joiner | Core module, before access to customer data |
| January | Everyone | Refresher and policy attestation |
| April | Support, sales | Add-on and a misdirected-email or phishing test |
| July | Engineering, HR | Add-on |
| October | Leadership and incident team | Tabletop exercise |
| After an incident or law change | Affected teams | 15-minute briefing |
Our tabletop blog has a ready script. Aim to have everyone through the core module before 13 May 2027, when the main duties commence.
How to evidence it
A training record is useful only if it survives a question from a client, an auditor or the Board.
- Keep an attendance log: name, role, date, module version and trainer.
- Archive the slides or recording for each version.
- Record quiz scores against a pass mark, with a retake.
- Collect a signed or click-through attestation to your data protection policy.
- Log drill results and the fixes that followed.
- Report completion to leadership quarterly, naming anyone overdue.
- Keep training records at least as long as the incident records they may need to explain.
The short version
Training is the cheapest organisational measure you can adopt and among the easiest to prove. Ninety minutes, four add-ons, a calendar and a log will not satisfy a regulator on their own, but they show a business that took s.8(4) seriously. That is why Trayambic's startup budget whitepaper makes a staff briefing part of its first action.
Key takeaways
- No DPDP provision expressly requires staff training; the Act never uses the words 'training' or 'awareness'.
- Sections 8(4) and 8(5), Rule 6(1)(g) and the s.33(2)(e) mitigation factor still make trained staff the practical way to show compliance.
- Banks and SEBI-regulated entities already face explicit training rules: RBI 2026 cyber directions paras 202 to 204 and SEBI CSCRF PR.AT.S1.
- A 90-minute core module, short role add-ons for support, sales, engineering and HR, and a quarterly calendar fit a team of five to fifty.
- Evidence matters as much as delivery: attendance, versioned material, quiz scores, attestations and drill results.
The DPDP Act in 15 Terms: A Plain-Language Glossary
Fifteen of the 28 definitions in section 2 of the DPDP Act decide whether your data is covered, who carries the duty and what counts as a breach.
Your First DPDP Task: A Data Inventory in Two Weeks
The DPDP Act never asks for a data inventory, yet notices, access requests, erasure, breach scoping and proof of consent all depend on one.
Run a Breach Tabletop Exercise Before May 2027
A 90-minute scripted drill, with injects from the first email to the 72-hour Board report, will show where your breach plan breaks before a real incident does.