India's DPDP Act for boutiques and tailors: what to do with customer data
A plain guide to the Digital Personal Data Protection Act for stitching businesses — names, phone numbers and measurements — and the consent and privacy tools that help.
VirtueTailor3 min read
The short answer
Under India's Digital Personal Data Protection Act, 2023, a tailoring shop that keeps customers' names, phone numbers, addresses, photos and measurements must tell them why, get their consent, keep the data safe, and let them see, correct or erase it. Software that records consent, handles privacy requests and keeps each shop's data separate does most of this work for you.
Customer trust is fragile.
Numbers in a diary, photos in the owner's gallery, measurements on loose sheets — and a new privacy law that applies to every business, small ones included.
Customers who come back, and stay protected
- Customer book with full history
- Consent recorded with a link the customer can open
- Requests to see, correct or erase data
- A grievance contact
- Each shop's data kept separate
Does the DPDP Act apply to a small tailoring shop?
Yes. The Digital Personal Data Protection Act, 2023 applies to any business that handles digital personal data of people in India, whatever its size. A customer's name, phone number, address, photograph and body measurements are all personal data. The DPDP Rules were notified in November 2025, with most duties coming into force in phases over the following eighteen months.
What does a shop have to do?
- Tell the customer what you collect and why — in plain words, in a language they read.
- Get consent that is clear and specific, and record it.
- Use the data only for that purpose — making their garments and contacting them about them.
- Keep it safe — not in an open notebook or a shared phone gallery.
- Let them see, correct or erase it when they ask.
- Give them someone to complain to — a grievance contact.
- Delete what you no longer need, except what another law tells you to keep.
Measurements and photos are personal data
Body measurements and fitting photos are more sensitive than most shops treat them. Keep them inside the shop's account, visible only to staff who work on that customer's garments, and never forward them on personal WhatsApp.
What about erasing a customer?
When a customer asks to be erased, remove their name, phone numbers, email, address, measurements and notes. Bills are different: GST law requires invoices to be kept for years, so the bill stays with the name replaced. Good software does both in one step.
How VirtueTailor helps
Consent with a link
The customer gets a link explaining what the shop keeps and why, in their language, and their consent is recorded.
Privacy requests
Requests to see, correct or erase data arrive in one list, with the steps to answer them.
A grievance officer
A public contact page for privacy complaints.
Separate and in India
Each shop's data is kept separate from every other shop's, and it is hosted in India.
Trust also comes from keeping customers informed. See tracking every garment for the tracking link and WhatsApp updates.
Questions
Does the DPDP Act apply to small businesses like tailors?
Yes. It applies to any business handling digital personal data of people in India, whatever its size. Customer names, phone numbers, photos and measurements are personal data.
Are customer measurements personal data?
Yes. Body measurements relate to an identifiable person, so they are personal data and should be kept securely and shared only with staff who need them.
Can a customer ask a boutique to delete their data?
Yes. Customers can ask to see, correct or erase their personal data. Invoices may still have to be kept under tax law, with the personal details removed.
Try it in your own shop
Free to start. Our team will help you bring your customers and measurements in.