DPDP Act for Solar Businesses: Aadhaar, Bills and WhatsApp Data

Picture a normal week. A customer sends last month's electricity bill on WhatsApp, then a cancelled cheque, then, because nobody said otherwise, an Aadhaar card front and back. Your rep forwards all three to a team group and saves them to his gallery. The file closes, and two years later those images still sit on three phones and a laptop.

India's Digital Personal Data Protection Act, 2023 (the DPDP Act) is written about exactly that habit. It makes your firm the decision-maker for the data and says how you ask, protect, keep and delete it, and what you do when it leaks. Our DPDP Act glossary entry has the short definition. This guide turns it into paperwork.

Everything below comes from the Act, the DPDP Rules, 2025 in the Gazette, and PIB, UIDAI, CERT-In and MNRE documents opened on 31 October 2026. It is general information, not legal advice: have your lawyer read the sample texts. You get a data map, notices in English and Hinglish, a retention schedule, a breach checklist and one habit to run them: the Four-Stamp Folder.

Key takeaway. The DPDP Act treats a solar installer as a data fiduciary for every customer's phone number, bill and bank detail. Its core duties (notice, consent, safeguards, breach intimation, erasure) start eighteen months after the Gazette of 13 November 2025, around mid-May 2027. Collect less (MNRE's July 2024 portal manual shows no Aadhaar field). Say why before you ask, record who got each copy, and delete on a date.

Where the DPDP Act stands on 31 October 2026, and what it can cost

Only part of the DPDP Act is in force today. The Board sections began on 13 November 2025. The duties that bind an installer, and the penalty sections, begin eighteen months after the Gazette, around mid-May 2027. The dates come from MeitY's notification G.S.R. 843(E) of 13 November 2025 and Rule 1 of the DPDP Rules, 2025.

The Gazette is dated 13 November 2025; PIB, 14 Nov 2025 reports the Rules as notified a day later and gives the eighteen-month phasing. A PIB release of 16 May 2026 quotes the MeitY Secretary: fully enforceable from 13 May 2027. Confirm the day with your adviser.

Does it cover you? Probably. The Act covers digital personal data, including paper data digitised later (section 3), so a WhatsApp photo counts. A "person" includes an individual, a firm and a company (section 2), so a proprietorship is covered like a private limited company. Section 17(3) lets the Government exempt notified classes, including recognised startups, from the notice duty and a few others. We found no such notification.

What it can cost. The Schedule to the Act sets ceilings, not fixed fines. The Board may impose a penalty only after an inquiry finds a breach significant and after hearing you (section 33).

The data map: what a solar business holds, and who really needs it

A data map is a one-page list of every kind of customer data you hold, why you hold it and who else gets it. You cannot write a notice, retention rule or breach message without it.

Our customer onboarding flow shows where the data first arrives. Sort every item by who asks for it, as our PM Surya Ghar documents list does. MNRE's July 2024 portal manual (Master Manual for RTS 1.1) asks for an electricity bill from the last six months, bank details with a cancelled cheque or passbook, and the signed vendor agreement. It has no Aadhaar or PAN field.

Aadhaar: the one document most installers should stop collecting

MNRE's PM Surya Ghar portal manual does not ask for the customer's Aadhaar. It shows no Aadhaar field, and its plant photo screen carries a red note: "Please do not upload Aadhaar Card file." The customer enters bank details in their own login, and MNRE's July 2025 guidelines say the consumer must submit the account details and cancelled cheque or passbook scan on the portal.

A state agency or DISCOM may still ask for Aadhaar on its own portal. Ask for that in writing and use the copy for that upload only.

What UIDAI says. The clearest official yardstick is guidance for entities that verify Aadhaar offline. A solar installer is not automatically one of them, so it is a benchmark, not a binding rule.

Ignore the forwards. A UIDAI regional release of 27 May 2022 about Aadhaar photocopies "stands withdrawn with immediate effect" (PIB, 29 May 2022).

If an Aadhaar arrives anyway, do not forward it, delete it from the chat and the phone gallery, reply "We do not need your Aadhaar for this application, so we have deleted it. Please do not send it again", and log the date on the file.

Notice and consent: what to say before you ask, with texts you can copy

Send a short notice before you ask for any document, and keep the reply. Section 5 says a request for consent comes with, or after, a notice stating the data and the purpose, how the person can use their rights, and how to complain to the Board. Section 6(10) puts the burden on you to prove the notice and the consent. The Act and Rule 3 add the points below.

Rule 3(c) also asks for a link to your website or app, hence the [website link] slot; drop it if you have none. The Rules say "at the minimum", so your lawyer may add items. The Act names English or an Eighth Schedule language, while many teams type Hindi in Roman letters, as in the second sample. Ask whether Roman script is enough, and keep a Devanagari or Gujarati version too.

Sample notice, English. Replace the brackets and send it before the first document request.

Sample notice, Hinglish. The same content in Roman Hindi, as typed on WhatsApp.

Why "Reply YES" and not a pre-ticked box? Consent must be "free, specific, informed, unconditional and unambiguous with a clear affirmative action" (section 6(1)), and the reply is your saved proof. Keep marketing out of this message; ask for it separately. Our WhatsApp spam rules guide covers messaging.

Is notice always needed? Not on the wording. Section 7(a) allows processing for the purpose a person voluntarily provided their data for. A bill sent for a quote covers the quote and nothing more. Send the notice anyway: it costs one message and is your proof. For existing customers, section 5(2) asks for a notice "as soon as it is reasonably practicable" after commencement.

WhatsApp document collection and staff phones

WhatsApp is where customers already are, so the question is how to use it without scattering copies. The risk is the copies: the gallery image, the forward, the screenshot. Accidental disclosure is a breach (section 2(u)), so a bill sent to the wrong customer counts.

Staff phones. Most reps use their own phones, and your firm answers for what its staff do with customer data (section 8(1)). Pick rules you can enforce: a screen lock, no gallery sync to a personal cloud, media auto-save switched off, and removal from customer groups plus a delete-and-confirm step on exit. Our field sales team guide covers tracking staff, and the remote site survey guide covers video calls. Once a quarter, count the customer documents in a rep's gallery together.

Sharing with the DISCOM, bank, crew and CRM vendor

You answer for the data even when someone else holds it. Section 8(1) makes you responsible for processing "undertaken by it or on its behalf by a Data Processor". Section 8(2) allows a processor only "under a valid contract". Section 8(3) says that data disclosed to another fiduciary must be complete, accurate and consistent.

Under section 11(1) a customer can ask for "the identities of all other Data Fiduciaries and Data Processors with whom the personal data has been shared". If your folder records who got what, you answer in minutes (the HANDED stamp below).

What to ask any CRM vendor, in writing. These apply to any CRM, spreadsheet tool or cloud folder. Do not accept a verbal "yes".

1. 1

   Will you sign a contract covering my customers' data?

   Section 8(2) requires one. Ask for clauses on security, deletion and breach notice.

2. 2

   Where is the data stored, and can you say so in writing?

   Rule 15 allows transfers abroad, subject to conditions the Government may set by order for foreign States and their agencies.

3. 3

   How is it protected, and who can see what?

   Rule 6 lists encryption, masking or tokens, access control and logs as minimum safeguards. Ask for per-person permissions and access records.

4. 4

   How fast will you tell me about a breach?

   Your own Rule 7 clocks start when you become aware.

5. 5

   Can you delete one customer's data on request, and what happens when I leave?

   You must erase on a valid request and cause your processor to do so (sections 12(3), 8(7)(b)).

Retention: when a customer folder should be deleted

The Act sets no fixed retention period for a solar business, so write your own. Section 8(7) says erase data when consent is withdrawn "or as soon as it is reasonable to assume that the specified purpose is no longer being served, whichever is earlier", unless a law requires you to keep it. The fixed three-year periods in the Third Schedule to the Rules cover only e-commerce and social media firms with at least two crore users and gaming intermediaries with fifty lakh. You are none of these.

Two provisions apply and the Rules do not join them. Section 8(7) of the Act says: "A Data Fiduciary shall, unless retention is necessary for compliance with any law for the time being in force, ... (a) erase personal data, upon the Data Principal withdrawing her consent or as soon as it is reasonable to assume that the specified purpose is no longer being served, whichever is earlier". Rule 8(3) of the Rules says: "Without prejudice to sub-rules (1) and (2), a Data Fiduciary shall retain, in respect of any processing of personal data undertaken by it or on its behalf by a Data Processor, such personal data, associated traffic data and other logs of the processing for a minimum period of one year from the date of such processing, for the purposes as specified in the Seventh Schedule, after which the Data Fiduciary shall cause such personal data and logs to be erased, unless further retention is required for compliance with any other law for the time being in force or notified by the Government." Rule 6(1)(e) also asks for one year of logs.

Both exist. Neither the Act nor the Rules say how they combine for a small business. The cautious step below breaks neither text. It is a working choice, not a ruling.

1. Set each delete date by the s.8(7) trigger: consent withdrawn, or the day the purpose ends.
2. Do not erase personal data or processing logs sooner than one year after the processing, the minimum Rule 8(3) names. Erase after that unless a tax or other law needs the record longer. Your CA gives the tax periods.
3. Write the decision down in the folder: trigger date, erase date, who decided, and any law you kept it under.
4. Do not promise "deleted in 30 days" in a notice. Promise what you will do, then do it.

Illustrative retention schedule. The periods show the shape, not legal advice. Read each "delete" date in the table as the s.8(7) trigger. The actual erase date is the later of that date and one year after the processing, unless a law needs the record longer. Take tax and company-law periods from your CA.

Give customers their own warranty papers at handover (our handover checklist lists them) so you hold less. In a dispute, audit or warranty claim, mark the folder "legal hold" and do not delete. Section 17(1)(a) exempts processing needed to enforce a legal claim from most duties.

The Four-Stamp Folder: one customer file, four dates

The Four-Stamp Folder gives every customer file four stamps: ASKED, HELD, HANDED and BINNED. Each has a date and an initial. Together they answer what a regulator or customer will ask: did you tell me, where is it, and who else has it.

Worked example, illustrative. A 4 kW home job in Surat, one rep, a DISCOM application, no loan. The customer is made up.

Two months later the customer asks, "Who has my bill?" The answer is a two-line reading of the HANDED and HELD entries, not a search of three phones. The folder does not make a notice valid. It makes the questions answerable.

Customer rights, children's data and family folders

A customer can ask to see, correct, update or erase their data, complain, and name someone to act for them. These rights start with the eighteen-month provisions.

The Act asks customers to use your grievance route first (section 13(3)), and Rule 9 requires you to publish a contact and mention it in every response to a rights request. PIB gives 90 days as the maximum to respond (PIB, 17 Nov 2025). Aim for 30 days as your own practice.

Children. Anyone under 18 is a child (section 2(f)). You need verifiable parental consent before processing a child's data, and you may not track or monitor a child's behaviour (section 9). Solar firms meet this in family folders and in site photos with children on the terrace. Ask the adult only for what the job needs, refuse children's documents, and crop children out of kept photos.

Breach checklist: the first hour, the first 72 hours

A personal data breach is any unauthorised processing, or accidental disclosure, sharing, loss or alteration, that compromises the confidentiality, integrity or availability of personal data (section 2(u)). A lost phone with customer bills is one, and so is a bill sent to the wrong chat. A customer forwarding their own bill is not.

Steps 5 and 6 reflect Rule 7, which starts with the eighteen-month provisions, so prepare for them now.

1. 1

   Contain it

   Lock or wipe the device, change passwords, ask a wrong recipient to delete.

2. 2

   Write down the time you noticed

   The clocks run from when you become aware. Note who found it and how.

3. 3

   Record what, who and how many

   Which data, which customers, how it leaked, who may have seen it.

4. 4

   Ask your adviser about CERT-In

   Direction (ii) of the CERT-In Directions of 28 April 2022 says: "Any service provider, intermediary, data centre, body corporate and Government organisation shall mandatorily report cyber incidents as mentioned in Annexure I to CERT-In within 6 hours of noticing such incidents". Annexure I lists "Data Breach" and "Data Leak". CERT-In's FAQs (May 2022) answer "Who do these ... Directions ... apply to?" with "Service providers, intermediaries, data centres, body corporate, ... and Government organisations ... as applicable to them. Individual citizens are not covered", and quote section 43A of the IT Act: "body corporate" means "any company and includes a firm, sole proprietorship or other association of individuals engaged in commercial or professional activities". We do not say whether your business is covered. Read both documents, and if you decide it is, report in the format on cert-in.org.in.

5. 5

   Tell the Data Protection Board

   Rule 7(2): without delay, the nature, extent, timing and likely impact. Within 72 hours (longer if the Board allows), the updated facts, measures taken, fixes, and what you told customers.

6. 6

   Tell each affected customer, without delay

   Rule 7(1): in plain words, by a contact mode they gave you: what happened, what it means for them, what you are doing, what they should do, and who to call.

7. 7

   Fix it and write the lesson

   Change the routine that failed and record the date. That record helps under section 33(2).

Sample breach message to a customer.

If an Aadhaar image is involved, UIDAI's 72-hour notice in its January 2023 guidance may also apply. Ask your adviser.

How QuickEstimate fits

This guide is about your habits, and a CRM cannot do them for you. Quickest Solar CRM does not make your firm compliant, and this article says nothing about where any CRM stores data or how it protects it. Put the five vendor questions above to us, as to any vendor, in writing.

What the product offers is about people and records. You can add team members with permissions, so not every rep sees every lead. You can set customisable stages, labels and follow-up reminders and log activities on a lead (also on several leads at once). A label or logged activity can record ASKED and HANDED, and a reminder can carry the BINNED date. Bulk import from Excel brings a spreadsheet in (see our Excel migration guide), after which you delete the old copies.

• Security: read what we publish about how we handle data, as you would for any vendor, and put your questions to us in writing.
• See it in a demo: ask how team permissions work for your set-up, and bring your data map.

What to do this week

1. Draw your data map. List every document type you hold and cross out each item only you ask for.
2. Send the notice to your next five leads. Use the English or Hinglish sample after your lawyer has read it, and save each YES in the job folder.
3. Pick one place for customer documents and one delete day. Move the files, clear chats and galleries, and set a monthly bin date.
4. Write a one-page breach card with the steps, phone numbers and the decision-maker's name.
5. Check meity.gov.in monthly for any amendment to the Rules or the dates.

Frequently asked questions

Does the DPDP Act apply to a small solar installer?

Yes, as far as the text shows. The Act covers digital personal data, and a person includes an individual, a firm and a company. Section 17(3) lets the Government exempt classes such as startups from some duties, but we found no such notification. Assume you are covered.

Is the DPDP Act in force now?

Only in part. Notification G.S.R. 843(E) of 13 November 2025 brought the Board provisions into force at once, and sections 3 to 17 and 28 to 34 (penalties) after eighteen months, around mid-May 2027. Check MeitY for amendments.

Can I ask customers to send Aadhaar on WhatsApp?

Not unless a named authority requires it in writing. The July 2024 PM Surya Ghar portal manual has no Aadhaar field and says not to upload an Aadhaar file. UIDAI's guidance of 10 January 2023 says verifying entities should generally not store the number afterwards.

Do I need written consent to collect an electricity bill for a quote?

The Act allows consent or certain legitimate uses. Section 7(a) covers data a customer voluntarily gives for a specified purpose, such as a quote, for that purpose only. Send a short notice anyway and keep the reply, because section 6(10) puts the burden of proof on you.

How long can I keep customer documents?

The Act sets no fixed period for a solar business. Section 8(7) says erase data once it is reasonable to assume the purpose is over, unless a law requires you to keep it. Rule 8(3) separately names a minimum of one year from the date of processing for personal data and logs. The Rules do not say how the two combine, so do not erase sooner than one year after processing, write your own schedule, and take tax record periods from your CA.

What if a customer asks me to delete their data?

Section 12(3) says erase it unless you need it for the specified purpose or a law requires you to keep it. A customer under warranty may still need you to hold contact and system details. Rule 8(3) also names a one-year minimum, and the Rules do not say how it works with an erasure request. Delete bill and bank copies once that year has passed, answer within the time you publish and no later than ninety days, and write down what you kept and why.

What are the penalties for a data breach?

The Schedule sets ceilings: up to ₹250 crore for failing to keep reasonable security safeguards, up to ₹200 crore for not intimating a breach, and up to ₹50 crore for any other provision. The Board decides after an inquiry and a hearing, weighing the nature of the breach, mitigation, repeat conduct and proportionality (section 33(2)).

Do I have to report a data breach to the government?

Under Rule 7 of the DPDP Rules, once it is in force, tell the Data Protection Board without delay and give details within seventy-two hours, and tell each affected person without delay. CERT-In's 28 April 2022 Directions separately say that a "body corporate" and other listed bodies shall report incidents in Annexure I, which includes "Data Breach" and "Data Leak", within 6 hours of noticing. We do not say whether your business is covered. Read the Directions and CERT-In's FAQs on cert-in.org.in.