DPDPA Compliance Checklist
15-Point Guide for Indian Businesses

Under Section 6 of the DPDPA, you must obtain free, specific, informed, unconditional, and unambiguous consent from Data Principals before collecting or processing their personal data.

• Use clear opt-in checkboxes (not pre-ticked) at every data collection point
• Present a plain-language notice explaining what data is collected and why
• Ensure consent is given through affirmative action (click, check, sign)
• Do not bundle consent with terms of service
• Implement a mechanism for users to withdraw consent easily at any time
• Maintain records of when and how consent was obtained

Before or at the time of collecting personal data, provide a clear notice containing:

• An itemized description of the personal data being collected
• The specific purpose for each category of data processed
• How the Data Principal can exercise their rights under the DPDPA
• How to file a complaint with the Data Protection Board

The notice must be in clear, plain language. Consider providing it in Hindi and regional languages as well.

Purpose limitation is a core principle. You may only process personal data for the specific purposes communicated to the Data Principal at the time of consent.

• Document all purposes for which you process data
• Do not use data for new purposes without obtaining fresh consent
• Regularly audit your data processing activities
• Train employees and contractors on purpose limitation

Collect only the minimum personal data necessary to fulfill the stated purpose. Avoid collecting data "just in case".

• Review each form field and data collection point for necessity
• Remove or make optional any non-essential data fields
• Do not collect sensitive data (Aadhaar, biometrics, health) unless absolutely required
• Periodically review and prune unnecessary data

The DPDPA requires personal data be erased once the purpose has been fulfilled, unless retention is required by law.

• Define clear retention periods for each data category
• Implement automated deletion or anonymization
• Consider legal requirements (e.g., 7-year retention for financial records)
• Delete or anonymize data when a user withdraws consent or requests erasure

You must have functioning processes to handle the following Data Principal rights:

• Right to Access (Sec 11): Provide summary of data, processing, and sharing
• Right to Correction (Sec 12): Allow correction of inaccurate data
• Right to Erasure (Sec 12): Delete data on request
• Right to Nomination (Sec 14): Allow nomination for death/incapacity

Create response templates and track all requests with SLAs.

Every Data Fiduciary must have a process for Data Principals to raise and resolve grievances.

• Publish contact details of your grievance officer prominently
• Provide an easy mechanism (email, web form, phone) for complaints
• Acknowledge grievances within 48 hours
• Resolve complaints within prescribed timeframes
• Inform Data Principals of their right to escalate to the DPBI

Mandatory for Significant Data Fiduciaries; strongly recommended for all businesses handling personal data.

• Appoint a DPO or equivalent contact person
• Ensure the DPO is based in India (mandatory for SDFs)
• Publish DPO contact details on your website and privacy policy
• DPO should serve as point of contact for the Data Protection Board
• DPO should report to Board of Directors or senior management

Section 8(4) requires reasonable security safeguards to prevent personal data breaches:

• Encryption: TLS/SSL in transit, encryption at rest
• Access controls: Role-based access, MFA, least-privilege
• Regular audits: Security assessments and penetration testing
• Employee training: Staff training on data protection
• Incident response: Tested data breach response plan
• Secure disposal: Secure deletion from systems and backups

Failure can attract a penalty of up to ₹250 crore.

In the event of a personal data breach, notify:

• The Data Protection Board of India in prescribed form
• Each affected Data Principal

To be prepared:

• Breach detection and reporting procedure
• Designated breach response team
• Notification templates for Board and individuals
• Breach simulation drills and a breach register

Failure to notify can attract penalty up to ₹200 crore.

If your platform may collect data from individuals under 18:

• Implement age verification mechanisms
• Obtain verifiable parental consent before processing child data
• Do not engage in behavioral tracking of children
• Do not serve targeted advertising to children
• Do not process data detrimental to the child's well-being
• Allow parents/guardians to exercise rights on behalf of the child

Non-compliance penalty: up to ₹200 crore.

The DPDPA allows transfer of personal data outside India, except to countries restricted by Central Government.

• Identify all data flows outside India (cloud, third-party services)
• Monitor government notifications for restricted country lists
• Ensure contractual safeguards with foreign processors
• Document all cross-border transfers in your privacy policy

As a Data Fiduciary, you are responsible for the actions of your Data Processors.

• Maintain a register of all Data Processors
• Execute Data Processing Agreements (DPAs) with all processors
• Ensure processors implement appropriate security measures
• Conduct periodic audits of processor compliance
• Include breach notification obligations in contracts

Your privacy policy is the primary compliance document. It must clearly communicate:

• What personal data you collect and why
• How you process, store, and protect the data
• With whom you share the data
• Retention period
• Data Principal rights and how to exercise them
• DPO or grievance officer contact details

DPDPA compliance is not a one-time task. As regulations evolve:

• Conduct quarterly reviews of data processing activities
• Update your privacy policy on material changes
• Monitor government notifications for new rules
• Obtain fresh consent if processing purpose changes
• Train new employees on DPDPA during onboarding
• Maintain documentation for potential audits