Get your gallery ready for the DPDP Act
From 13 May 2027, every Indian gallery is answerable for the collector data it holds: where it lives, who can see it, who agreed to hear from you, and how fast you answer when someone asks. Here is what the law asks of a gallery, and how Artfolio helps.
13 Nov 2025
Rules notified
The DPDP Rules were published and the Data Protection Board of India was set up.
13 Nov 2026
Consent managers
Registered consent managers can start operating.
13 May 2027
Full obligations apply
Notice and consent, security safeguards, breach reporting, people's rights and retention limits all apply to your gallery.
The DPDP Act, in gallery terms
Your collector list is personal data
Names, phone numbers, emails, addresses, PAN and GSTIN of individuals, purchase history and notes about a collector are all personal data. That includes spreadsheets, WhatsApp chats and phone contacts once they are in digital form.
Your gallery is the Data Fiduciary
You decide why you hold the data and what you do with it, so you are responsible for it under the Act, even when software or a freelancer processes it for you.
People must be told, and asked
Before collecting personal data you give a clear notice of what you collect and why. Marketing needs consent that the person actively gives and can withdraw as easily.
People can ask what you hold, and to delete it
A collector can ask for a summary of their data, ask you to correct or erase it, nominate someone to act for them, and complain to you and then to the Data Protection Board.
Breaches must be reported
If collector data leaks or is lost, you must inform the Data Protection Board and each person affected, with a detailed report to the Board within 72 hours.
The penalties are large
Penalties go up to ₹250 crore for failing to protect personal data with reasonable security safeguards.
10 steps for a DPDP-ready gallery
- 01List every place collector data lives: spreadsheets, WhatsApp, Gmail, phones and old software.
- 02Bring it into one system your gallery controls, with access only for staff who need it.
- 03Write down why you hold each kind of data: sales, invoicing, shipping, marketing.
- 04Publish a privacy notice and link it from every form that collects personal data.
- 05Record marketing consent (who agreed, when and how) and make unsubscribing easy.
- 06Turn on two-factor sign-in for everyone who can see collector data.
- 07Decide how you will answer "what data do you hold on me?" and "please delete me".
- 08Keep invoices for as long as tax law requires, and delete other data once you no longer need it.
- 09Prepare a breach plan: who investigates, and who informs the Board and the people affected.
- 10Name a person or role who answers privacy questions, and publish how to reach them.
The tools a gallery needs, in one place
Everything below works in Artfolio today.
One place for collector data
Contacts, sales, invoices, enquiries and notes live in one gallery workspace instead of spreadsheets and phones, so you know exactly what you hold.
Hosted in Mumbai, India
Your database, sign-in, uploaded files and backups are hosted in Mumbai, India (AWS ap-south-1), and the Artfolio app runs on servers in Mumbai.
Access only for the right people
Roles and permission templates decide who can see collector details and prices, and every team member can turn on two-factor sign-in.
Each gallery's data kept separate
Row-level security in the database keeps your data isolated from every other gallery.
Audit trail
Changes to key records, payments and permission changes are logged with who made them and when.
Unsubscribe on every campaign email
Campaign emails carry an unsubscribe link, and people who unsubscribe are left out of future campaigns.
Data export
Export your core records (artworks, artists, contacts, sales, invoices, exhibitions, consignments and opportunities) as CSV files at any time.
Daily backups and encryption
Data is encrypted in transit and at rest, and backed up every day in Mumbai.
Consent records
For every contact: whether they agreed to email or WhatsApp marketing, when, how, and the exact wording they saw. Withdrawals are recorded the same way, and every campaign and automated email checks them before sending.
Privacy notice on every form
Your website's enquiry, newsletter, viewing-room, checkout and artist-submission forms link to your own privacy notice, which you edit in Settings. Enquiry and checkout forms add an optional, unticked marketing checkbox in your words, and a tick is recorded with the notice version the person saw.
Answer data requests in minutes
Download everything you hold on one person, or print a readable summary for them. Erase their data in one step: when invoices, sales or consignments must be kept by law, Artfolio keeps only what those records need and erases the rest.
Privacy request tracker
Log requests to see, correct or erase data, to stop marketing, and complaints, each with a 30-day due date, so nothing slips past the deadline.
DPDP readiness dashboard
One page showing what is done and what is left: privacy contact named, notice reviewed, how many contacts have recorded consent, overdue requests and team members without two-factor sign-in.
Re-permission campaign
Ask contacts with no consent record to confirm they want to hear from you. Their yes or no is recorded on their contact with your wording, and nobody is asked twice in 30 days.
Require two-factor sign-in for the whole team
Make an authenticator code mandatory for everyone in your gallery, with a 7-day grace period so nobody is locked out.
What stays with your gallery
- Decide why you collect each kind of personal data and use it only for that.
- Keep your privacy notice accurate, and answer people's requests on time.
- Report breaches to the Data Protection Board and to the people affected.
- Control personal data outside Artfolio too: WhatsApp groups, laptops, printed lists and other vendors.
- Take legal advice for your situation. Artfolio provides tools; it does not make your gallery compliant by itself.
Frequently asked
Does the DPDP Act apply to my art gallery?
Yes, if you hold digital personal data about individuals in India, such as collectors' names, phone numbers, emails, addresses or purchase history. Data typed into spreadsheets, phones or WhatsApp counts once it is digital. There is no general exemption for small businesses.
When do galleries have to comply?
The DPDP Rules were notified on 13 November 2025. Most obligations for galleries, including notice and consent, security safeguards, breach reporting and people's rights, apply from 13 May 2027.
Does the DPDP Act require my data to be stored in India?
No. Personal data can be processed outside India except in countries the Government restricts. Artfolio hosts your database, files and backups in Mumbai, India anyway.
Can I still send WhatsApp and email campaigns to collectors?
Yes, with their consent. Each person should have actively agreed to hear from you, and must be able to withdraw as easily as they agreed. For existing contacts, send a notice and ask them to confirm.
What if a collector asks me to delete their data?
You should erase it once it is no longer needed, unless a law requires you to keep it. Tax invoices, for example, must be kept for the period GST law sets, so you keep what the invoice needs and erase the rest.
What are the penalties under the DPDP Act?
Penalties go up to ₹250 crore for failing to take reasonable security safeguards, and up to ₹200 crore for failing to report a breach.
Will using Artfolio make my gallery compliant with DPDP?
No software can do that on its own. Artfolio gives you the tools: one India-hosted place for collector data, access controls, audit trails, consent records, notices and request handling. Your gallery stays responsible for how it uses personal data, and you should take legal advice for your situation.
See it with your own collector data
A free 20-minute walkthrough: where your data would live, who can see it, and what is left to do before May 2027.
This page is general information about India's Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025. It is not legal advice; take advice for your gallery's situation. Questions about how Artfolio handles data: privacy@artfolio.ai. See also our privacy policy, data processing addendum and sub-processors.