DPDP Compliance Checklist for Indian Businesses

Most DPDP checklists are lists of documents.

That is how companies end up with a folder full of documents and no idea where their personal data actually lives.

DPDP compliance is an operating problem.

You need to know what personal data you process, why you process it, where it flows, which processors receive it, how it is protected, how rights requests work, and what happens when data no longer needs to be retained.

This checklist is built around that reality.

For the engineering layer, see our DPDP compliance guide for engineering teams.

First: understand the implementation timeline

The Digital Personal Data Protection Rules, 2025 were notified on November 13, 2025.

The Rules are staggered. Rule 4, which covers the Consent Manager registration framework, comes into force one year after notification, on November 13, 2026. Rules 3, 5 to 16, 22 and 23 come into force eighteen months after notification, on May 13, 2027. DPDP Rules 2025

The important point is not the date alone.

It is that your compliance program should be built before the relevant obligations become operational.

The checklist

1. Scope the personal data you process

Inventory:

Customer data
Trial users
Employees and applicants
Identity data
Contact information
Financial data
Device and technical data
Analytics and behavioural data
Uploaded documents
Support conversations

Then separate:

Data you process as a Data Fiduciary

from:

Data you process on behalf of customers as a Data Processor.

This distinction matters for SaaS companies.

2. Build an operational data map

For every important processing activity or data location, capture:

Field	Example
Data element	Email
Location	`production.users.email`
Purpose	Account communication
Data Principal	Customer
Applicable basis	Consent / legitimate use
Processor	Email provider
Storage	India / outside India
Retention	Purpose-based
Deletion	Internal workflow + processor API
Owner	Platform team

A spreadsheet is fine as a starting point.

The important thing is that it stays current.

See DPDP Data Mapping.

3. Review your privacy notice

Section 5 requires notice before or with a request for consent.

The final Rules require the notice to be understandable independently, written in clear and plain language, and to provide the means for withdrawal, rights exercise and complaints. DPDP Rules 2025

Checklist:

Personal data description is accurate
Purposes match product behaviour
Rights mechanism is published
Grievance route is published
Withdrawal mechanism is published
Notice versions are archived
Required language access is supported

The test is whether the notice matches production.

4. Audit consent flows

Consent under Section 6 must be free, specific, informed, unconditional and unambiguous with a clear affirmative action.

Review:

Signup
Marketing
Analytics
Personalisation
Third-party integrations
New features that introduce new processing

For every consent event, you should be able to reconstruct what happened.

At minimum, your technical design should distinguish:

Data Principal
Purpose
Action
Time
Notice/version
Collection context

See DPDP Consent Management.

5. Test withdrawal

Section 6(4) requires withdrawal to be as easy as giving consent.

Test both:

The user experience

and:

The system behaviour.

A withdrawal should not stop at:

users.marketing_consent = false

You need to know which systems downstream must stop processing for that purpose.

6. Inventory processors and recipients

List:

Cloud providers
Analytics
Email
CRM
Support
Payments
Monitoring
AI services
Marketing tools
Automation platforms

Then classify the role each actually plays.

See How to Map Data Flows to Third-Party Processors Under DPDP.

7. Check processor contracts

Where a Data Processor is engaged for relevant activities, Section 8(2) requires a valid contract.

Check:

8. Build the Data Principal rights workflow

The Act creates rights around access to information, correction/completion/updating, erasure, grievance redressal and nomination. DPDP Act 2023

Your workflow should let you:

Receive requests
Verify the requester
Classify the request
Identify affected systems
Execute the action
Track status
Record evidence

The form is not the hard part.

The orchestration is.

9. Make erasure operational

Section 12 provides a right to erasure subject to the specified purpose and applicable legal requirements. Section 8(7) also addresses erasure, subject to legal retention.

Map deletion across:

Primary databases
Warehouses
S3/object storage
Logs
Backups
Analytics
CRMs
Support
Processors

For the engineering problem, see DPDP Data Deletion.

10. Define retention

Do not write:

"Retained as long as necessary."

Define:

Purpose
Retention trigger
Retention rule
Applicable law
Deletion mechanism
Exception process
Owner

The final Rules also prescribe specific retention requirements for certain classes and purposes and a minimum one-year retention period for specified processing data and logs used for the security purposes covered by Rule 8. DPDP Rules 2025

11. Verify security safeguards

Rule 6 includes, at minimum, measures such as encryption or equivalent protection, access controls, logs and monitoring, backup/continuity measures, processor contract safeguards and appropriate technical and organisational measures. DPDP Rules 2025

Check:

The important question is whether you can produce evidence.

12. Prepare for personal data breaches

Rule 7 requires notification to affected Data Principals without delay. The Board must also be notified without delay, followed by detailed and updated information within 72 hours unless the Board permits a longer period. DPDP Rules 2025

Build:

Breach detection
Impact assessment
Data-scope discovery
Board notification workflow
Data Principal notification workflow
Evidence preservation

Separately, certain cyber incidents fall under CERT-In's reporting framework, including a six-hour reporting requirement. (See also CERT-In incident reporting directions where applicable.)

Treat these as parallel workflows.

13. Establish grievance redressal

Publish the appropriate contact.

Track:

Complaint
Date received
Owner
Actions
Resolution
Escalation
Closure

The final Rules require the grievance mechanism to operate within a reasonable period not exceeding 90 days. DPDP Rules 2025

14. Check children's-data processing

If you process children's personal data, review:

Age determination
Verifiable parental consent
Tracking
Behavioural monitoring
Targeted advertising
Detrimental effects
Applicable Rule 12 exemptions

The Rules create limited exemptions for specified classes of Data Fiduciaries and purposes. DPDP Rules 2025

Do not assume the exemption applies to your business without checking the conditions.

15. Review transfers

Section 16 allows the Central Government to restrict transfers to specified countries or territories.

Your inventory should tell you:

Where vendors are based
Where data is stored
Where it is processed
Which sectoral rules apply

16. Build an evidence layer

Keep evidence for:

Consent
Withdrawal
Notice versions
Rights requests
Erasure
Vendor reviews
DPA status
Security controls
Breach response
Remediation

The standard should be:

Can we prove what happened for one specific user, system or incident without reconstructing the story from memory?

17. Monitor drift

Compliance changes when production changes.

Watch for:

New PII fields
New databases
New storage buckets
New processors
New tracking SDKs
New processing purposes
Changed retention
Changed consent flows

A static checklist is a baseline.

It is not continuous compliance.

The 30-day starting plan

Week 1: Inventory systems, discover personal data, list processors and purposes.

Week 2: Fix notice/consent gaps, establish rights and grievance workflows, define retention.

Week 3: Review processor contracts, map deletion, verify security safeguards, build breach workflow.

Week 4: Test rights fulfilment, consent withdrawal, processor deletion and breach response. Collect evidence.

This will not magically make a company compliant in 30 days.

It will tell you where the actual work is.

The self-audit

Ask:

Can we list every important system containing personal data?
Can we explain why the data is processed?
Can we identify our processors?
Can a Data Principal exercise their rights without a manual investigation?
Can we delete the data we are required to delete?
Can we prove what consent a user gave?
Can we prove what happened during an incident?

If several answers are "we'd have to check," the checklist is not finished.

Where Privra fits

Privra turns the checklist into an operational compliance program.

Our AI agents discover personal data, map processing and processors, monitor drift, surface gaps and generate evidence so the compliance program stays connected to the environment that actually exists.

Talk to Privra about your DPDP readiness.

This article is general information, not legal advice. Legal requirements and Privra's recommended implementation practices are intentionally distinguished.