A photocopy counter handles some of the most sensitive documents in ordinary commerce — Aadhaar copies, PAN cards, bank statements, marksheets, medical records, property papers and court filings. Most owners treat this casually, not out of indifference but because nobody has ever told them what a reasonable standard looks like. This guide sets out what the law actually requires, what is realistically achievable in a one-person shop, and what you can honestly tell a customer who asks.

Start with what you are actually holding

Before any legal question, look at what passes across your counter in a normal week. Indian counters handle a distinctive and unusually sensitive set of documents, and knowing the list makes the risk concrete rather than abstract.

• Identity documents: Aadhaar, PAN, passport, voter ID, driving licence — usually as photocopies, often for a form.
• Financial documents: bank statements, pay slips, cheque images, loan applications, bank letterheads.
• Educational records: marksheets, certificates, transcripts, migration certificates, project submissions.
• Medical documents: prescriptions, reports, insurance claims. Frequently the most sensitive and the least discussed.
• Property and legal: registration papers, leases, court filings, agreements, notarised copies.
• Financial instruments: cheque images and signed forms. These are the ones where care genuinely matters.

A counter is not a bank and does not need bank-grade controls. But it is holding a customer's identity documents, and it should be able to answer one question honestly: what happens to this file after the print?

What the DPDP Act 2023 requires

The Digital Personal Data Protection Act 2023 applies to data processed in connection with a digital facility or online service. A counter that only takes paper files is arguably outside its scope. A counter running a web-based upload portal is very likely inside it, and the practical obligation is the same either way: be clear about what you do with personal data and do only what you have said you do.

The single most useful change here is the shortest: do not ask for a phone number you do not need. A WhatsApp-based intake requires you to collect and retain customer contact details permanently, because that is how messaging apps work. A browser upload does not require any personal data at all. That is a privacy improvement, not a feature trade-off.

A practical retention policy

Whatever channel you use, you need a written rule with a number in it. Vague answers are not a policy.

• Set one window and use it for everything. Twenty-four hours after upload is a defensible default for a print counter, and it is long enough to reprint anything you botched.
• Make deletion automatic, not manual. Manual deletion depends on somebody remembering, and it will not happen consistently.
• Apply the same window to phone copies, computer copies and backups. A policy that covers only the obvious location is not a policy.
• Keep the deletion audit simple — a count of files removed and when. You do not need a log file, but you should be able to say the process is running.
• Have a shorter window for medical and identity documents if you can. There is no reason to hold a prescription scan any longer than a bill receipt.

Twenty-four hours is worth stressing because it is longer than most people expect and short enough to be credible. A counter that keeps files for a year "in case of reprint" is creating a problem it does not need. The reprint case is real, but a day covers it, because a customer who has not collected their print has usually moved on.

Physical security at the counter

Most of the real exposure is physical rather than digital, and it is worth an honest look.

• Clear the printer output tray frequently. Printed Aadhaar copies left in a tray are the most common way a customer's identity document becomes visible to the next person in the queue.
• Do not leave misprints in the bin. A rejected Aadhaar print is still a customer's identity document. Shred it.
• Shred rather than tear. Tearing an Aadhaar copy leaves most of the number readable.
• Do not accept cheque images to print and then leave them on the counter "for a minute".
• Lock the shop when you close. The physical risk to a locked counter is far lower than the cyber risk, and it is the one most owners never implement.
• Keep collected-but-unclaimed prints somewhere customers do not have to reach past other customers' documents to get them.

The output tray is the single most important thing on this list. It is public, it is unattended for most of the day, and it is where a stranger can photograph an Aadhaar copy with a phone. Clear it every few hours.

What to tell a customer who asks

You will be asked, and the answer should be short and specific. Vagueness reads as evasion.

Being able to demonstrate deletion beats promising it. If a customer asks and you can point at a screen showing a deletion time, the answer is credible in a way that reassurance never is.

What you should not do

• Do not keep a personal document "in case they come back". This is the single most common privacy failure at a counter and it is always well intentioned.
• Do not use a customer's document as a test file, a sample, or an example.
• Do not photograph customer documents for your own records. Nothing about your business requires it.
• Do not ask for identification in order to print an identification copy. It is a privacy failure to demand more data than the job requires.
• Do not leave documents on the counter while you step away, including for two minutes.

What to put in writing

A short printed notice at the counter does more than any policy on a website, because the customer reads it at the moment they care.

• One sentence on how long you keep files.
• One sentence confirming you do not need a phone number.
• One sentence saying that misprints are shredded rather than discarded.
• A sentence telling customers to keep their own original, because you cannot return a file after deletion.

Four sentences, at the counter, in the language your customers actually speak. That is a better privacy notice than most small businesses in India have, and it takes an afternoon to write.

Where to go next

For the intake side that removes most of this exposure, our guide to ending the WhatsApp queue explains why collecting customer contact details is the avoidable part of the old arrangement. For the setup, our contactless counter guide covers what the customer actually experiences. And for the machine side, our guide to securing your counter PC covers the technical lockdown that protects files while you still hold them.