A practical, step-by-step checklist for Indian companies to assess and demonstrate compliance with the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025. It covers scoping, data mapping, notice and consent, Data Principal rights, security safeguards, breach response, vendor contracts, cross-border transfers, Significant Data Fiduciary obligations, and Board-level governance and record-keeping.

DPDP Compliance Checklist for Indian Companies

1. Scoping and role

• Confirm the Act applies: digital personal data processed in India, or processed outside India for offering goods or services to people in India
• Classify each activity as Data Fiduciary, Data Processor, or joint fiduciary
• Assess Significant Data Fiduciary (SDF) risk: volume and sensitivity of data, risk to rights, and other factors
• Check which exemptions could apply (personal or domestic use, legal or judicial functions, etc.)
• Map overlapping laws: IT Act and CERT-In directions, sectoral rules (RBI, SEBI, IRDAI), and GDPR if you handle EU data

2. Data inventory

• Record each category of personal data, its source, purpose, storage location, and who can access it
• Cover every population: customers, employees, job applicants, shareholders, vendors' staff, website visitors
• Map data flows to processors, group companies, and any cross-border recipients
• Assign a business owner to each data set

3. Lawful basis

• Tag each processing activity as consent-based or a "legitimate use" (employment, legal obligation, medical emergency, State functions, etc.)
• Document the basis and keep it under review
• Check whether existing consents collected before the law meet the new standard

4. Notice

• Issue a standalone notice covering the data collected, the purpose, how to exercise rights, how to withdraw consent, and how to complain to the Data Protection Board
• Use clear, plain language and offer it in English and the Eighth Schedule languages where applicable
• Send fresh notices for legacy data, where consent was given before the Act
• Keep dated versions of every notice

5. Consent

• Consent must be free, specific, informed, unconditional, unambiguous, and given by clear affirmative action
• No bundling of consent for unrelated purposes, and no pre-ticked boxes
• Withdrawal must be as easy as giving consent
• Keep consent records (who, when, what version, what purpose)
• Decide whether to work with registered Consent Managers

6. Children and persons with disability

• Verify age and obtain verifiable parental or guardian consent for anyone under 18
• Prohibit tracking, behavioural monitoring, and targeted advertising aimed at children
• Apply guardian consent rules for persons with a disability who have a lawful guardian
• Check whether any statutory exemptions apply to your case

7. Data Principal rights

• Access: a summary of the data processed and who it was shared with
• Correction, completion, updating, and erasure
• Grievance redressal: a published mechanism with a defined response time (the Rules set an outer limit, which I recall as 90 days; please verify)
• Nomination of another person to exercise rights on death or incapacity
• A request register with turnaround tracking and escalation

8. Security safeguards

• Encryption, masking, or tokenisation of personal data
• Access controls and the principle of least privilege
• Logging and monitoring of access, with logs kept for the minimum period the Rules prescribe (recalled as one year; please verify)
• Backups and continuity arrangements
• Regular security testing and audit
• Security obligations written into contracts with processors

9. Breach response

• A documented incident response plan with named owners
• Notify each affected Data Principal without delay
• Report to the Data Protection Board without delay, followed by a detailed report within the Rules' deadline (recalled as 72 hours; please verify)
• Run CERT-In reporting (6 hours for specified incidents) in parallel with the DPDP process
• Keep a breach register and post-incident review

10. Retention and erasure

• Set a retention schedule for each data category, tied to purpose and to statutory retention requirements (Companies Act, tax, labour laws)
• Erase data when the purpose is served or consent is withdrawn, unless law requires retention
• Instruct processors to erase as well
• Check whether pre-erasure notice rules apply to your sector

11. Processors and vendors

• Have a valid contract with each processor covering permitted use, security, breach reporting, sub-processors, and deletion or return of data
• Remember that the fiduciary stays responsible for processor lapses
• Carry out vendor due diligence and periodic review

12. Cross-border transfers

• Identify all transfers outside India
• Check the Government's list of restricted countries and any sectoral localisation rules
• Update contracts and notices to reflect transfers

13. Governance and accountability

• Board or committee approval of a data protection policy, with periodic reporting to the Board
• Publish contact details of the person who answers Data Principals' questions
• Assign clear internal ownership (legal, IT, HR, marketing)
• Run role-based staff training and keep attendance records
• Maintain a compliance calendar and gap register
• Note that penalties can reach ₹250 crore per breach category

14. Additional items if you are an SDF

• Appoint a Data Protection Officer based in India who reports to the Board
• Appoint an independent data auditor
• Conduct an annual Data Protection Impact Assessment and audit
• Perform due diligence on algorithmic and technical systems
• Prepare for possible data localisation directions

15. Secretarial and record-keeping

• Board resolution adopting the policy and appointing responsible officers
• Minutes recording review of data protection risk
• Update the risk register and consider disclosure in the Board's Report or risk section where relevant
• Keep an evidence file for each item above, in case the Board asks for proof