Small firms hold a surprising amount of sensitive data: clients' financial records, identity documents, salary details, contracts. Losing it, or sharing it with the wrong person, damages trust and can break the law.
India's Digital Personal Data Protection Act, 2023 and Singapore's Personal Data Protection Act both expect organisations to protect the personal data they hold, whatever their size. You don't need an IT department to take sensible steps.
This article is general guidance, not legal advice. Check the specific obligations that apply to your firm with a professional adviser.
Know what you hold
Make a simple list:
- What personal data do you collect (names, phone numbers, PAN or NRIC numbers, bank details, salaries)?
- Why do you need it?
- Where is it kept: email, laptops, shared drives, software?
- Who can see it?
You can't protect what you don't know you have.
Collect less, keep less
- Don't ask for documents you don't need.
- Delete old data you no longer need to keep. Statutory record-keeping periods still apply: keep what the law requires, and no more.
Control who can see what
- Give each person access only to what their role needs.
- Use separate accounts for each person, never a shared login.
- Remove access the day someone leaves.
Protect sign-ins
- Use strong, unique passwords and a password manager.
- Turn on two-step sign-in for every system that holds client data.
Stop emailing sensitive documents
Email attachments get forwarded, stored on phones and left in inboxes for years. Use a secure portal or a system with proper access control to exchange documents with clients.
Have a plan for when something goes wrong
- Know who to tell inside the firm.
- Know when you must notify the authorities and the people affected. Both laws have breach notification rules.
- Keep a record of what happened and what you did.
Choose software carefully
When you use online software, you're trusting it with your clients' data. Ask:
- Where is the data stored, and is it encrypted?
- Is each customer's data kept separate?
- Is there an activity log of who did what?
- Can you export or delete your data?
How MSMEPulse helps
MSMEPulse keeps each firm's data separate, supports two-step sign-in, uses roles and permissions to control who sees what, keeps an activity log of changes, and gives clients a secure portal for documents so they don't need to be emailed. MSMEPulse support can only see your workspace when an Admin allows it, and every page they view is recorded.
