Small businesses: how to protect employee, salary and customer data on office PCs
In a small business, the "HR system" is often an Excel sheet on the owner's laptop, and the customer database is a folder of invoices and a phone-number list. Salaries, PAN and Aadhaar copies, bank details and customer addresses all sit on PCs that several people use. Here's a practical way to protect that data without enterprise software.
Which data needs protecting
- Payroll: salary sheets, payslips, bank account numbers, PF and ESI details.
- Employee records: PAN, Aadhaar, offer letters, appraisal notes.
- Customers: contact lists, addresses, invoices, GST details, payment records.
- Business secrets: pricing, supplier rates, accounts.
Why it matters now
- DPDP Act, 2023: any business that processes customers' or employees' digital personal data is a data fiduciary. Rule 6 of the DPDP Rules, 2025 requires reasonable security safeguards, including encryption, obfuscation or masking, access controls, access logs and backups, from around 13 May 2027. The maximum penalty for failing to take reasonable security safeguards is ₹250 crore.
- Everyday risks: a staff member leaving with a pen drive, a stolen laptop, a shared reception PC, ransomware.
Set it up in an afternoon
- Give everyone their own Windows account on shared PCs, and keep admin rights to the owner.
- Install Clavis Encrypt on the PCs that hold sensitive files (no administrator rights needed).
- Create a vault for HR and payroll that only the owner or HR person knows the password to, and keep the recovery key in a safe. With Clavis Pro, add separate vaults for accounts and sales.
- Encrypt the payroll workbook, employee folders and customer lists. Pro encrypts whole folders and can watch a folder so new files are encrypted automatically.
- Edit the salary sheet with Pro's Open: it opens in Excel and is re-encrypted when you close it.
- Back up encrypted files weekly to an external drive kept off-site, or to the cloud with Premium's encrypt-to-cloud-folder.
- When someone leaves, change the passwords of the vaults they knew.
Options compared
| Approach | Cost | Protects a stolen laptop | Protects files copied to a pen drive |
|---|---|---|---|
| Excel password | Free | Weak (many tools remove it) | Weak |
| BitLocker / Device encryption | Free (edition-dependent) | Yes, when off | No |
| Cloud HR / payroll software | Monthly fees | Data is on the provider's servers | Exports are unprotected |
| Clavis Encrypt | Free; Pro one-time $19 | Yes | Yes: copies stay encrypted |
Questions
How can a small business protect employee salary data?
Keep payroll files encrypted on the PC, restrict the vault password to the owner or HR, give staff separate Windows logins, and keep encrypted backups. Clavis Encrypt encrypts files offline with AES-256-GCM; Pro adds folders and automatic encryption for a one-time $19.
Does the DPDP Act apply to small businesses?
Yes. Any business that processes digital personal data of customers or employees is a data fiduciary under the DPDP Act, 2023. Rule 6 of the DPDP Rules, 2025 sets security safeguards, including encryption, access control, logs and backups, from around May 2027.
Is an Excel password enough to protect a salary sheet?
Not on its own. Excel's file password is better than nothing, but sheet-protection passwords are easily removed and the file name still reveals what it is. Encrypting the whole file hides its name and contents.
What should I do when an employee who knew the password leaves?
Change the vault password and, ideally, re-encrypt the files with the new one. Clavis lets you change a vault password in Settings.
Sources
- DPDP Rules, 2025 — Rule 6, reasonable security safeguards (text)
- Scrut — DPDP Rules 2025 practical guide and timelines
- Clavis Encrypt — security design (AES-256-GCM, Argon2id)
This guide explains general practice, not legal advice. Laws and rules change; check the current text or ask a lawyer for your situation.