A practical preparation guide

DPDP compliance checklist for Indian organisations

Turn the DPDP Act and Rules into a set of reviewable work items. Start by understanding what personal data you handle, why you use it, who supports that processing, and what evidence your team can produce.

Use this as a working aid, not a compliance certificate. The Act has phased commencement, and the right actions depend on your processing, role, exemptions and other applicable laws.

Start the checklist Read the DPDP Act summary

How to use this page

Check the work and keep the evidence

For each item, note an owner, a target date and where the supporting evidence lives. A checked box means your team has reviewed the item; it does not mean a regulator has approved the control or that your organisation is compliant.

Your selections are saved in this browser only. They are not sent to DPDPConsentKit.

0 items checked

01 · Know your data and role

Scope and accountability

Build a reliable picture of the processing before selecting controls. The Act applies to digital personal data in the circumstances it specifies, with defined exclusions.

Map personal data across the organisation.Record what is collected, who it relates to, where it comes from, where it moves, and which systems or teams can access it.Evidence: data inventory, system map or process register.
Write down the purpose for each use.Connect each data field and workflow to a specific business purpose. Flag uses that have no clear owner or documented reason.Evidence: purpose register linked to forms, apps and internal workflows.
Identify the Data Fiduciary and each Data Processor.For each activity, record who determines the purpose and means of processing and which service providers process data on that organisation’s behalf.Evidence: responsibility map and list of service providers.
Check whether the Act applies to each activity.Consider digital collection, offline data later digitised, processing outside India connected with offering goods or services in India, and the Act’s exclusions.Evidence: scope assessment with the assumptions and facts recorded.

02 · Explain and authorise processing

Purposes, notices and consent

For each purpose, work out the legal basis and make sure the person receives the information and choice required for that basis.

Record the permitted basis for each purpose.Identify whether processing relies on consent or a legitimate use specified in the Act. Do not treat a general business interest as a separate basis unless the Act provides for it.Evidence: purpose-to-basis register with the relevant provision noted.
Review each notice at the point data is collected.Check that notices describe the personal data and specific purpose in clear language, independently of unrelated information, and tell people how to withdraw consent, exercise rights and complain.Evidence: current notice versions mapped to each collection flow.
Plan notice access in the required language.Section 5 provides for notice in English or an Eighth Schedule language chosen by the Data Principal. Review the website, app and offline journeys you operate.Evidence: language coverage and approved notice versions.
Check how consent is requested and recorded.Where consent is the basis, check that it is specific, informed, unconditional, unambiguous and given through a clear affirmative action for data necessary for the stated purpose.Evidence: sample consent journey, notice version, choice and timestamp records.
Test the withdrawal route from the person’s point of view.Confirm that withdrawing consent is as easy as giving it, and identify the systems and teams that must act when consent is withdrawn.Evidence: tested withdrawal flow and resulting process record.
Set a review step when a purpose or data use changes.Before adding a new use, assess whether the existing notice and basis cover it or whether the person needs new information or a new choice.Evidence: product or process change review with privacy sign-off.

03 · Give people a working route

Data Principal requests and grievances

Make request channels and grievance handling easy to find and track. See our DPDP data rights portal guide for an intake and response workflow.

Publish clear routes and make sure requests reach the people who can verify, investigate and respond to them.

Publish a contact for privacy questions.Choose a monitored business contact that can answer questions about processing and route requests to the right team.Evidence: published contact details and an internal escalation owner.
Set up a process for rights requests.Plan how to receive and handle requests for access information, correction, completion, updating or erasure, and nomination as provided by the Act.Evidence: request procedure, identity checks, response templates and case log.
Maintain a grievance redressal route.Make the route easy to find, assign responsibility for reviewing grievances and track them through resolution.Evidence: published route, assigned owner and grievance register.
Include the right to nominate in your request planning.Decide how the organisation will receive and route a nomination request made under the Act.Evidence: documented intake and escalation procedure.

04 · Protect data and respond to incidents

Security safeguards and breach response

The Rules describe security safeguards and a staged notification process. Match technical controls with an incident response plan that can produce the required information.

Review safeguards for the systems that hold personal data.Assess access controls, encryption or other protective measures, monitoring, backups and the ability to detect, investigate and remediate unauthorised access.Evidence: control review, access records, monitoring and recovery procedures.
Confirm logging and retention requirements with security owners.When Rule 6 commences, it specifies safeguards that include relevant logs and personal data retention for at least one year for the purposes stated there, unless another applicable law requires otherwise.Evidence: logging configuration and approved retention schedule.
Write and rehearse a personal data breach response plan.Set escalation contacts, incident facts to capture, decision owners, communication channels and a method for tracking actions from awareness onward.Evidence: incident plan, contact tree and exercise notes.
Prepare for both Board submissions.Plan for an initial intimation without delay and an updated, detailed report within 72 hours of awareness, unless the Board permits more time following a written request.Evidence: draft information checklist, report owner and escalation timeline.
Prepare a clear notice for affected Data Principals.Be ready to explain the breach, likely relevant consequences, mitigation, steps people can take and a contact for questions, without delay.Evidence: approved communication workflow and accessible message template.
Check for other incident reporting duties.Review sector rules, contracts, regulator directions and other laws that may impose separate requirements for the same incident.Evidence: incident obligations map with owners and timelines.

05 · Manage the full data lifecycle

Retention, erasure and service providers

Connect the reason for holding data to a retention decision, and make sure processor arrangements support the organisation’s own obligations. See our DPDP data retention and erasure guide for the Rule 8 periods and a schedule-building approach.

Assign a retention rule to each purpose.Identify when a purpose is complete, whether another law requires continued retention and how a withdrawal or request changes the decision.Evidence: purpose-based retention schedule and legal holds process.
Test erasure across systems and service providers.Trace how a deletion decision reaches active systems, backups, exports and processors, while accounting for records that must lawfully be kept.Evidence: deletion workflow, processor confirmation and sampled completion record.
Review contracts with Data Processors.Confirm there is a valid contract for processing on the Data Fiduciary’s behalf and that responsibilities for safeguards, incidents, requests and deletion are understood.Evidence: current processor list, signed contracts and review dates.
Review data sharing and transfer arrangements.Record who receives data, why they receive it, what protections apply and whether any government restriction or other law affects a transfer.Evidence: recipient and transfer register with contract references.

06 · Check conditional requirements

Children, Significant Data Fiduciaries and exceptions

Some requirements depend on who your service is for, whether the Government has notified you as significant, or whether a defined exemption applies.

Identify services that process children’s personal data.The Act defines a child as an individual under 18. Where applicable, plan for verifiable parental consent and review restrictions on detrimental processing, tracking, behavioural monitoring and targeted advertising.Evidence: age-related data flows, consent process and exemption assessment if relevant.
Check whether Significant Data Fiduciary requirements apply.Monitor whether the Central Government has notified your organisation or class. Additional duties apply to a Significant Data Fiduciary, including a Data Protection Officer based in India, an independent data auditor, periodic assessments and audits.Evidence: applicability review and, if notified, assigned owners and assessment plan.
Document any exemption you rely on.Confirm the exact legal provision, facts and conditions for an exemption. Do not assume that an industry, organisation size or general business purpose creates an exemption.Evidence: written assessment approved by the appropriate legal or privacy owner.

The checklist is intentionally review-oriented. Assign owners and dates in your own action tracker; the checkboxes only record progress in this browser.

07 · Plan around the notified dates

The DPDP framework has phased commencement

The Rules and the Act do not all commence at once. Use the official notifications to confirm which provisions apply at each stage.

13 November 2025
Selected institutional and administrative provisions of the Act and Rules commenced on publication.
13 November 2026
Rule 4 and certain provisions of the Act are scheduled to commence one year after publication.
13 May 2027
Most substantive duties under the Act and most operational Rules are scheduled to commence after 18 months.

Sources: Act commencement notification and MeitY’s Rules documents and corrigendum.

Primary sources

Read the law behind the checklist

A useful first review

Check the parts of your website visitors can see

The website readiness check can help identify visible issues and questions to investigate. It does not assess every internal process or certify compliance.

Open the readiness check