DPDP Compliance Checklist for Enterprises

India’s Digital Personal Data Protection Act, 2023 (DPDP Act) and the DPDP Rules, 2025 become fully enforceable on 13 May 2027. [1][2][3] From that date, enterprises must meet legal duties on notice, consent, security, breach reporting, retention and individual rights. Penalties reach ₹250 crore for a single breach. [1]

As of October 2026, about seven months remain. Data mapping, consent redesign and vendor contract changes each take months, so the work has to start now.

This ServQual checklist turns the Act and the Rules into twelve areas of action. Each item names the section or rule behind it, so legal, security and IT teams can trace every task to the text. A five-phase roadmap shows what to finish by when.

Each item names the section of the Act [1] or the rule [2] it comes from.

1. Governance and ownership

• Name an executive owner for DPDP compliance, with board-level visibility.
• Designate a person who can answer questions about your data processing. Publish their business contact details on your website or app and include them in every reply to a rights request (section 8(9), Rule 9).
• Assess whether you are likely to be notified as a Significant Data Fiduciary. The factors include the volume and sensitivity of data you process and the risk to individuals’ rights (section 10).
• Approve a budget and a dated plan that ends before 13 May 2027.

2. Data inventory and legal grounds

• Complete your personal data inventory across systems, applications and vendors.
• Assign a legal ground to every purpose: consent (section 6) or one of the legitimate uses in section 7.
• Flag data about children and about persons with disabilities who have a lawful guardian (section 9).
• Flag every transfer of personal data outside India (section 16).

3. Privacy notice

• Give a notice with or before every consent request (section 5).
• Make the notice stand on its own. It must be understandable without reading your terms of service or any other document (Rule 3).
• Include an itemised description of the personal data, the specific purposes, and the goods, services or uses the processing enables (Rule 3).
• Include the link through which the individual can withdraw consent, exercise rights and complain to the Board (Rule 3).
• Offer the notice in English or any of the 22 languages in the Eighth Schedule to the Constitution, at the individual’s option (section 5(3)).
• For consent collected before the Act commenced, send a compliant notice as soon as reasonably practicable (section 5(2)).

4. Consent

• Check every consent flow against the six tests in section 6(1): free, specific, informed, unconditional, unambiguous, and given by a clear affirmative action.
• Make withdrawal as easy as giving consent, and make your processors stop processing after withdrawal (sections 6(4) and 6(6)).
• Keep records that prove notice was given and consent was obtained. The burden of proof is on you (section 6(10)).

ServQual covers this area in two dedicated guides: DPDP Consent Management and Purpose Limitation and the companion to this article, DPDP Consent Management: What Enterprises Need.

5. Rights of individuals and grievance redressal

• Publish how individuals can make a rights request, and which identifier they must provide (Rule 14).
• Publish the response period of your grievance redressal system. It must not exceed 90 days (section 13, Rule 14).
• Allow individuals to nominate someone to exercise their rights in case of death or incapacity (section 14).

An individual must use your grievance mechanism before approaching the Board (section 13(3)). [1] For the request-handling process itself, see ServQual’s guide to the DPDP DPAR workflow.

6. Security safeguards

Rule 6 sets a minimum list. [2] Check each one against your current controls.

• Protect personal data through encryption, obfuscation, masking or virtual tokens.
• Control access to the computer resources used for processing.
• Keep logs, and monitor and review them, so that unauthorised access can be detected, investigated and fixed.
• Maintain backups so processing can continue if data is lost or compromised.
• Retain those logs and the personal data for one year, unless another law requires otherwise.
• Write security obligations into every Data Processor contract.
• Put technical and organisational measures in place to make sure the safeguards are followed.

This is the area with the highest penalty: up to ₹250 crore. [1]

7. Personal data breach response

• Notify every affected individual without delay, in plain language. Cover the nature, extent and timing of the breach, the likely consequences, the steps you are taking, the safety measures they can take, and a contact person (Rule 7(1)).
• Send the Board an initial description of the breach without delay (Rule 7(2)).
• Send the Board a detailed report within 72 hours of becoming aware of the breach. It covers the facts and causes, mitigation, findings on who caused it, steps to prevent recurrence, and a report on the notices sent to individuals. The Board may allow more time on a written request (Rule 7(2)).
• Treat every personal data breach as notifiable. The Rules set no materiality threshold.
• Align the plan with the CERT-In directions, which require specified cyber incidents to be reported within six hours. [7]
• Test the plan with a simulated breach at least once before May 2027.

8. Retention and erasure

• Erase personal data when consent is withdrawn or the purpose is no longer served, unless a law requires you to keep it. Make your processors erase it too (section 8(7)).
• Keep personal data, traffic data and processing logs for at least one year from the date of processing, then erase them unless another law requires longer retention (Rule 8(3)).
• If you are a large platform listed in the Third Schedule, erase the data of users who have been inactive for three years, and warn them at least 48 hours before erasure (Rule 8).
• Write a retention schedule that reconciles DPDP with tax, company law and sector rules from regulators such as RBI, SEBI and IRDAI.

The Third Schedule applies to e-commerce entities and social media intermediaries with at least 2 crore registered users in India, and online gaming intermediaries with at least 50 lakh. [2]

9. Data Processors and vendors

• Engage a Data Processor only under a valid contract (section 8(2)).
• Remember that you remain responsible for compliance even when a processor does the work (section 8(1)).
• Add clauses on security safeguards, prompt breach reporting to you, stopping processing on withdrawal of consent, erasure, one-year log retention, audit rights and sub-processors.
• Rank vendors by the volume and nature of personal data they handle, and renegotiate the highest-risk contracts first.

10. Children and persons with disabilities

• Identify whether any of your users are under 18. The Act treats everyone under 18 as a child.
• Obtain verifiable consent from a parent before processing a child’s data (section 9(1), Rule 10).
• Verify that the person giving consent is an identifiable adult. You may rely on identity and age details you already hold, details the parent provides, or a virtual token from an authorised entity such as a Digital Locker service provider (Rule 10).
• For a person with a disability who has a lawful guardian, obtain the guardian’s verifiable consent and verify the guardianship (section 9(1), Rule 11).
• Do not track children, monitor their behaviour or direct targeted advertising at them (section 9(3)).
• Check whether a Fourth Schedule exemption applies. Limited exemptions exist for healthcare providers, educational institutions, crèches and certain safety purposes (Rule 12).

11. Cross-border transfers

• Map which countries your personal data goes to, including through cloud and support vendors.
• Monitor Central Government notifications. Transfers are permitted unless the Government restricts transfers to a notified country (section 16).
• Follow any requirements the Government specifies about making data available to a foreign State or its agencies (Rule 15).
• Apply stricter sector rules where they exist, such as RBI’s payment data storage requirements. The Act preserves them (section 16(2)).

12. Significant Data Fiduciary obligations

These apply only if the Central Government notifies you, or a class you belong to, as a Significant Data Fiduciary. [1]

• Appoint a Data Protection Officer who is based in India and responsible to your board of directors (section 10).
• Appoint an independent data auditor (section 10).
• Carry out a Data Protection Impact Assessment and an audit once every 12 months, and have the significant observations reported to the Board (Rule 13).
• Verify that the technical measures you use, including algorithmic software, are not likely to pose a risk to individuals’ rights (Rule 13(3)).
• Keep within India any personal data the Central Government specifies for localisation (Rule 13(4)).