DPDP Act Compliance Checklist: What Indian Businesses Need to Do

Hero Summary

India's Digital Personal Data Protection (DPDP) Act, 2023 applies to organizations — "data fiduciaries" — that decide why and how personal data is processed. The DPDP Rules, 2025, notified on 14 November 2025, introduced an eighteen-month phased compliance period, which places most obligations around May 2027. A practical readiness program covers eight areas: know your data, give clear notices, manage consent and other lawful bases, secure the data, prepare for breaches, handle individual rights, govern vendors, and assign accountability. This checklist walks through each.

Executive Summary

Compliance with a privacy law is easier when it is broken into concrete tasks with owners. This checklist is organized around what the DPDP Act and Rules ask of a data fiduciary. It is a readiness aid, not legal advice: the Act, the Rules, and any further notifications are the authoritative sources, and organizations in regulated sectors must also meet sector-specific requirements. Items that depend on details in the Rules are flagged so you can confirm them in the official text.

Where the law stands {#status}

Parliament enacted the DPDP Act on 11 August 2023. The Government of India notified the DPDP Rules, 2025 on 14 November 2025, and the Rules introduce an eighteen-month period for phased compliance. In practice, this places most data fiduciary duties — notices, consent, security safeguards, breach intimation, children's data, and rights fulfilment — around May 2027, with the provisions that set up the Data Protection Board taking effect earlier. Confirm exact commencement dates in the official notification. The Act rests on seven principles: consent and transparency, purpose limitation, data minimisation, accuracy, storage limitation, security safeguards, and accountability. Penalties can reach ₹250 crore for failing to maintain reasonable security safeguards, ₹200 crore for failing to notify a breach or for violations relating to children, and ₹50 crore for other violations.

1. Know your data {#data}

• Identify every system, application, spreadsheet, and processor that holds personal data.
• Record what categories of personal data you hold, whose data it is, and why you process it.
• Map how data flows: where it is collected, where it moves, who receives it, and whether it leaves India.
• Keep the inventory current — a snapshot taken once goes out of date quickly. See Data Mapping and Records of Processing Under DPDP.

2. Notices {#notices}

• Give individuals a clear notice, before or at the time of requesting consent, that explains what personal data is collected and for what purpose.
• According to the Government's explainer on the Rules, every data fiduciary must issue a separate consent notice that is clear and easy to understand and that explains the specific purpose.
• Explain how individuals can exercise their rights and how to complain.
• Review website, app, and form notices against actual practice.

3. Consent and lawful basis {#consent}

• For each purpose, decide whether you rely on consent or on one of the legitimate uses the Act allows, and document the choice.
• Where you rely on consent, make it free, specific, informed, and given by clear affirmative action, limited to the stated purpose.
• Make withdrawal as easy as giving consent, and act on it.
• Keep records of what each person consented to and when. See Consent Management Under DPDP.

4. Security safeguards {#security}

• Put reasonable security safeguards in place to protect personal data — the Act treats failure to do so as the most serious category of violation.
• Apply access controls, encryption where appropriate, logging and monitoring, patching, and secure development practices.
• Test regularly through VAPT and review controls against a recognized baseline.
• Retain system logs as required by applicable rules; CERT-In's April 2022 directions, for example, require ICT system logs to be kept for 180 days.

5. Breach response {#breach}

• Write and rehearse a breach response plan with roles, templates, and decision rights.
• Be ready to inform the Data Protection Board and each affected individual, and to tell individuals without delay what happened, the possible impact, what you have done, and who to contact.
• Align DPDP duties with CERT-In's six-hour reporting rule and any sector regulator's requirements. See Data Breach Response Under DPDP.

6. Individual rights {#rights}

• Provide a way for individuals to request access to information about their data, correction, completion, updating, and erasure, and to nominate someone to act for them.
• Respond within the period the Rules set — the Government's explainer states a maximum of ninety days.
• Publish contact details for a person who can answer questions about personal data, and set up grievance redressal.

7. Retention and erasure {#retention}

• Define a retention period for each category of personal data and the reason for it.
• Erase data when consent is withdrawn or the purpose is no longer served, unless the law requires you to keep it.
• Make sure processors delete data too. See DPDP Data Retention and Erasure.

8. Vendors and processors {#vendors}

• List every processor and third party that handles personal data on your behalf.
• Put a valid contract in place that binds each processor to your security, breach-notification, deletion, and audit requirements — you remain responsible for personal data processed on your behalf.
• Assess vendors before onboarding and review them periodically. See Third-Party and Vendor Risk Management Under DPDP.

9. Children's data {#children}

• If you process personal data of anyone under 18, obtain verifiable consent from a parent or lawful guardian, unless an exemption applies, and avoid processing that harms a child's wellbeing. See Children's Data Under DPDP.

10. Governance and accountability {#governance}

• Assign an accountable owner for DPDP compliance and report to senior management or the board.
• Determine whether you may be designated a Significant Data Fiduciary, which carries extra duties. See Significant Data Fiduciary Under DPDP.
• Check whether transfers of personal data outside India are affected. See Cross-Border Data Transfers Under DPDP.
• Keep evidence — policies, assessments, training records, and decisions — so you can show what you did.
• Review the program at least annually and whenever the law, your systems, or your purposes change.

How Threat ResQ fits {#threat-resq-fit}

• PrivacyIQ is Threat ResQ's privacy management platform. Its published capabilities include a data inventory of data assets, processing activities, and data flows; technical discovery; explainable findings mapped to DPDP obligations; a technical readiness view per obligation; evidence; privacy requests; vendor governance; and an incident register. It is a platform that supports a privacy programme: it is not a certifying authority, does not grant or imply a "DPDP compliant" status, and does not manage consent.
• getTRAC automates evidence collection and control mapping across frameworks.
• Threat ResQ's Compliance Consulting service supports regulatory readiness.

FAQ {#faq}

What is the DPDP Act? India's Digital Personal Data Protection Act, 2023, which sets rules for how organizations may process the digital personal data of individuals, gives individuals rights over their data, and created the Data Protection Board of India to oversee compliance.

When do businesses have to comply with the DPDP Rules? The Rules, notified on 14 November 2025, introduced an eighteen-month phased compliance period, which places most obligations around May 2027. Confirm exact dates in the official notification.

What are the penalties under the DPDP Act? Up to ₹250 crore for failing to maintain reasonable security safeguards, up to ₹200 crore for failing to notify a personal data breach or for violations relating to children, and up to ₹50 crore for other violations.

Where should a business start with DPDP compliance? With a data inventory — knowing what personal data you hold, why, where it lives, and who it is shared with — because notices, consent, security, retention, rights requests, and vendor management all depend on it.

Does DPDP replace sector regulations such as RBI and SEBI requirements? No. DPDP adds a general privacy law; regulated sectors continue to meet their own regulators' requirements, so both sets of obligations apply. Confirm how they interact for your organization.