DA9: Running automation for a business
Personal data and permission
🎯You'll be able to
Handle personal data lawfully and carefully in workflows: purpose, consent, minimum data, access, retention and the DPDP Act basics.
🏠The everyday picture
A tailor keeps your measurements so your next order fits. You'd be upset if those measurements were pinned on the shop wall, sold to another shop, or kept for years after you stopped visiting.
📘What it really is
-
Automations move personal data such as names, phone numbers, addresses and purchase history. In India, the Digital Personal Data Protection Act, 2023 (DPDP Act) and its rules set duties for businesses handling it. Other countries have their own laws, such as the GDPR in Europe.
-
Practical principles for automation work (check details with the client's adviser for legal questions):
- Purpose: use data for the reason it was collected; an order phone number isn't automatic permission for marketing;
- Consent and notice: tell people what you collect and why, and record consent where needed (DA8);
- Minimum data: send each system only the fields it needs;
- Retention: keep data only as long as needed; set execution history and logs to clear after a sensible period (DA2);
- Security: credentials in the store, least access (DA6), signed webhooks (DA7);
-
Requests: be able to find, correct or delete a person's data across connected systems when asked.
-
Know where data goes: every tool in a workflow is another place personal data lives (DA3).
📝A worked example
Sharma Textiles' data map for customer details:
| System | Data | Why | Kept for |
|---|---|---|---|
| Shop | Name, phone, address, orders | Orders and delivery | As long as the account is active |
| CRM | Name, phone, orders summary, consent | Sales and follow-up | Active, plus a set period |
| Courier | Name, phone, address | Delivery | Per courier's policy |
| n8n executions | Full payloads | Troubleshooting | 14 days |
| Run log | Order ID, counts | Monitoring | 1 year, no personal details |
Making the map showed the run log had been storing full phone numbers. You changed it to store only order IDs and counts.
🌍Where it's used
- Any workflow with customer data: most of them.
- Marketing automation, where consent matters most.
- Client due diligence: larger clients ask how their data is handled.
📝Case scenario
A customer asks Sharma Textiles to delete their details. The shop deletes the account, but the person keeps getting WhatsApp offers because their number is still in the CRM and a campaign sheet. You add a deletion checklist covering every system in the data map, and a workflow step that removes the contact from campaign lists when the CRM record is marked "delete requested".
🖱️Try it
Make a data map for your Sharma Textiles workflows: each system, which personal data it holds, why, and for how long. Find one place where you can store less.
⚠️Common mistakes
- Copying all fields "just in case". Sign: workflows store addresses they never use. Fix: pass only the fields the purpose needs.
- Treating any phone number as permission to message. Sign: marketing messages to people who only made an enquiry. Fix: check recorded consent before marketing.
🛠️For your project
Project 3 flags contacts whose consent is unknown instead of guessing, and the capstone data map records every personal data field. This is general guidance, not legal advice.
✅Quick check
Does a phone number collected for delivery give permission to send marketing messages?
Show the answer
No. Marketing needs its own permission; data should be used for the purpose it was collected.
Why make a data map?
Show the answer
To know where personal data lives, so you can protect it, limit it and delete it when asked.