DPDP Act compliance checklist for Indian businesses
Reviewed against the law as of 28 September 2026
A 12-step DPDP Act 2023 and DPDP Rules 2025 checklist: inventory, lawful basis, notice, consent, security, breaches, erasure, rights and vendors.
The Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 are short compared with GDPR, but they touch almost every system that holds customer or employee data. Most obligations apply from May 2027, eighteen months after the Rules were notified on 14 November 2025. This checklist turns the law into twelve pieces of work, in the order that usually makes sense.
1. Build a personal data inventory
You cannot give an accurate notice, answer an access request or report a breach without knowing where personal data lives. List:
- every system, database, bucket, SaaS tool and spreadsheet that holds personal data;
- what categories it holds (names, contacts, Aadhaar, PAN, financial, health, children's data);
- who the data is about: customers, employees, prospects, vendors' staff;
- where the system is hosted and which vendors can reach it.
Surveys of teams are a start, but they miss copies: test databases restored from production, exports in shared drives, logs full of e-mail addresses. Scanning systems directly finds them.
2. Record why you hold each dataset
For each dataset, record the purpose, the lawful basis (consent or a legitimate use under section 7), the processing activities that use it, and how long you need it. This record of processing is the backbone of every other obligation.
3. Check your lawful basis
The Act allows processing on two grounds only: consent, or a legitimate use from the closed list in section 7, such as data a person voluntarily provided for a specific purpose, employment purposes, legal obligations and medical emergencies. There is no general "legitimate interests" ground as in GDPR. Anything that fits neither needs consent or must stop.
4. Rewrite your notices
A consent request must be accompanied or preceded by a notice that is understandable on its own, and describes the personal data, the specific purpose, how to withdraw consent, how to exercise rights and how to complain to the Data Protection Board. People must be able to read it in English or any language in the Eighth Schedule of the Constitution. See consent and notice.
5. Fix consent capture and withdrawal
Consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and as easy to withdraw as to give. When someone withdraws, you and your processors must stop processing within a reasonable time. Keep a ledger that shows which notice version each consent was given against. The burden of proving consent is on you.
6. Put reasonable security safeguards in place
This is where the largest penalty sits: up to ₹250 crore for failing to take reasonable security safeguards to prevent a breach. The Rules describe minimum measures, including encryption, obfuscation or masking, access control, logging and monitoring of access, backups for continuity, and keeping logs for at least one year. In practice, check:
- no personal data store is publicly accessible;
- encryption at rest for databases and storage holding personal data;
- MFA for every human with console or administrative access;
- dormant accounts and old access keys removed;
- audit logging enabled, retained and reviewed;
- backups of personal data stores exist and restore.
7. Prepare for breaches
Every personal data breach must be reported to the Data Protection Board and to each affected person, with no materiality threshold. The Board expects an initial intimation without delay and a detailed report within 72 hours. CERT-In separately expects reportable cyber incidents within six hours. Write the playbook, name the owners and rehearse it. See breach notification and CERT-In six-hour reporting.
8. Set retention and erasure
Personal data must be erased once the purpose is served or consent is withdrawn, unless a law requires you to keep it. Define retention per dataset, automate deletion, and make processors delete too. See retention and erasure.
9. Handle Data Principal rights
Publish how people can request a summary of their data, correction, completion, updating or erasure, and nominate someone to act for them. Respond within ninety days. Track each request with a clock and keep proof of what you did. See Data Principal rights.
10. Review vendors and transfers
You remain responsible for processing done on your behalf. Engage processors only under a valid contract covering security, breach notice and deletion, and check that their evidence is current. Cross-border transfers are allowed except to countries the government restricts by notification, but sector regulators may impose stricter rules.
11. Check children's data and special duties
If you process data of anyone under eighteen, you need verifiable parental consent and must not track, behaviourally monitor or target advertising at children, subject to exemptions in the Rules. If you may be notified as a Significant Data Fiduciary, plan for a DPO, DPIAs and independent audits.
12. Keep evidence, continuously
When the Board inquires, it will ask what you did and when. Keep evidence of each control: configuration snapshots, query results, signed-off procedures, and a record of who changed what. Evidence that is collected automatically and re-checked regularly is worth far more than a yearly self-assessment.
A note on CERT-In
The CERT-In Directions of April 2022 already apply and overlap with DPDP security work: six-hour incident reporting, 180 days of logs kept in India, clocks synchronised to NIC or NPL time servers, and a designated point of contact. Do both at once.
How TrustNiq helps
TrustNiq automates steps 1, 2, 6 and 12 by scanning your systems, and tracks steps 4, 5, 7, 8, 9 and 10 with ledgers, clocks and evidence. Every control links to the section of the Act or the CERT-In direction it supports. Start a free trial to see your own results.
Frequently asked questions
How long does DPDP compliance take?
For a mid-size organisation, building an accurate data inventory and fixing the main security and notice gaps usually takes several months. The eighteen-month phase-in to May 2027 leaves limited time once procurement and engineering work are included.
Do we need a Data Protection Officer?
Only Significant Data Fiduciaries must appoint a DPO under the Act. Every Data Fiduciary must publish the business contact details of a person who can answer questions about personal data processing.
Is a DPDP audit mandatory?
An independent data audit is mandatory for Significant Data Fiduciaries. Other organisations are not required to commission one, but they must be able to show the Data Protection Board that they meet their obligations.
Sources
- Digital Personal Data Protection Act, 2023 (MeitY)meity.gov.in
- PIB: DPDP Rules, 2025 notifiedstatic.pib.gov.in
- CERT-In Directions, 28 April 2022cert-in.org.in
This article is general information about Indian law as published at the date above, written to help organisations plan their compliance work. It is not legal advice. Check the official text and take advice on your own facts.