DPDP Compliance Checklist: 43 Controls for Indian Businesses (2026)

The Digital Personal Data Protection Act, 2023 imposes specific, enumerated obligations on every entity that processes personal data of individuals in India. Compliance is a matter of implementation.

This checklist maps the five primary compliance areas to their statutory references. Most items map to a statutory duty, cited in the section heading; the rest are controls that produce the evidence those duties need. Assign an owner to each line and track it to closure.

If an item requires deeper understanding, linked references are provided for each section.

1. Consent Management (Section 6)

Section 4 allows processing on consent under Section 6 or on one of the legitimate uses in Section 7. Where consent is the ground, it must be free, specific, informed, unconditional, and unambiguous. Pre-ticked boxes, bundled consent, and implied consent do not meet the statutory threshold.

• Consent is collected through a clear, affirmative action by the Data Principal
• Each processing purpose has its own separate consent request
• The notice and the consent request can be read in English or any language listed in the Eighth Schedule of the Constitution, at the Data Principal’s option (Sections 5(3) and 6(3))
• The notice gives an itemised description of the personal data, each specified purpose with the goods, services or uses it enables, and links to withdraw consent, exercise rights and complain to the Board (Rule 3)
• No personal data is processed without valid consent or a Section 7 legitimate use
• Consent records are stored with timestamps, version references, and the exact notice shown at the time of collection
• Consent withdrawal mechanism is as accessible as the consent collection mechanism
• A withdrawal stops processing, by the fiduciary and its processors, within a reasonable time (Section 6(6)), and data is then erased unless a law requires it kept (Section 8(7))
• Consent infrastructure is tested for edge cases: partial withdrawal, re-consent after withdrawal, consent for new purposes on existing data

For the full treatment of consent architecture under the Act, see Consent Management Under the DPDP Act.

2. Data Principal Rights (Sections 11-14)

The Act grants Data Principals four categories of rights. Each is a statutory entitlement your systems must be built to fulfil.

• Data Principals can request a summary of all personal data being processed and the processing activities associated with it (Section 11)
• A defined process exists for identity verification before honouring any rights request
• Correction and erasure requests can be received, logged, and executed (Section 12)
• Data Principals can nominate another individual to exercise their rights in case of death or incapacity (Section 14)
• The business contact of a person able to answer questions about processing is published (Section 8(9)), and a grievance mechanism runs behind it (Section 8(10))
• Grievances are resolved within a published period of not more than ninety days (Rule 14(3))
• Responses to rights requests are logged with audit trails for regulatory inspection
• The grievance redressal process has an escalation path and does not dead-end at a generic support inbox

For implementation guidance on each right, see Data Principal Rights Under the DPDP Act.

3. Data Fiduciary Obligations (Sections 8-10)

Sections 8 through 10 define the baseline obligations of a Data Fiduciary. These apply regardless of organisation size, industry, or processing volume. Significant Data Fiduciaries carry additional obligations designated by the Central Government.

• Personal data is processed only for the purpose for which consent was obtained, or for a legitimate use specified in the Act
• Data retention is limited to the period necessary for the stated purpose; data is erased when the purpose is fulfilled
• A Data Protection Officer (DPO) is appointed if the organisation is designated as a Significant Data Fiduciary
• Periodic Data Protection Impact Assessments (DPIA) are conducted if designated as a Significant Data Fiduciary
• An independent data auditor is appointed, and the DPIA and audit run once every twelve months, if designated as a Significant Data Fiduciary (Section 10(2)(b), Rule 13)
• The Rule 6 minimum safeguards are in place: encryption or masking, access control, access logging and monitoring, backups, processor contract terms, and one-year retention of security logs
• All Data Processors engaged by the Fiduciary operate under a written contract with defined processing instructions, security requirements, and breach notification obligations
• Personal data, traffic data and processing logs are kept for at least one year from the date of processing (Rule 8(3), from 13 May 2027)
• Purpose limitation is enforced programmatically: data collected for purpose A cannot drift into use for purpose B without fresh consent
• Data deletion workflows are automated and auditable, not dependent on manual intervention

For the complete obligation framework, see Data Fiduciary Obligations Under the DPDP Act.

4. Breach Notification (Section 8(6))

The Act requires every Data Fiduciary to notify the Data Protection Board and each affected Data Principal in the event of a personal data breach. The notification obligation is triggered by any breach, not only breaches above a certain severity threshold.

• A breach detection system is in place with defined triggers and monitoring coverage
• An incident response plan exists, is documented, and has been rehearsed at least once in the last 12 months
• The notification workflow to the Data Protection Board is defined, with responsible personnel identified by name and role
• The notification workflow to affected Data Principals is defined, including communication channels and templates
• The Board receives an intimation without delay and a detailed report within 72 hours of the fiduciary becoming aware of the breach (Rule 7)
• Breach records include: nature of breach, data affected, Data Principals impacted, remedial actions taken, and timeline of response
• Post-breach review is conducted to identify root cause and prevent recurrence
• Third-party Data Processors are contractually required to notify the Fiduciary of any breach without delay

For detailed breach notification architecture, see Breach Notification Requirements Under the DPDP Act.

5. Children’s Data Protection (Section 9)

Section 9 imposes heightened obligations for processing personal data of children (individuals below 18 years). The Act prohibits certain categories of processing entirely and requires verifiable parental consent for all other processing.

• Age verification mechanisms are implemented before collecting data from any individual who may be a minor
• Verifiable consent of a parent or lawful guardian is obtained before processing a child’s personal data
• No tracking, behavioural monitoring, or targeted advertising is conducted on children’s data
• No processing is undertaken that is likely to cause detrimental effect on the well-being of a child
• Data processing activities involving children are reviewed separately during impact assessments
• If the organisation is exempt from parental consent requirements by government notification (e.g., for verified safe processing), the exemption order is documented and the conditions are strictly followed
• Children’s data is stored with additional access restrictions and shorter retention periods than adult data
• All third-party processors who may receive children’s data are contractually bound to the same protections

For the full children’s data protection framework, see Children’s Data Protection Under the DPDP Act.

Sequencing the Remediation

The checklist above is an audit instrument. Closing the gaps it surfaces requires an order. Two dates set that order: Rule 4 applies from 13 November 2026, when registration becomes mandatory for anyone operating as a Consent Manager, and the Act’s obligations on Data Fiduciaries take effect with the penalty provisions on 13 May 2027. For the complete schedule, see the DPDP compliance timeline.

The sequence below front-loads the work that takes longest to stand up and the obligations tied to the nearer date.

Window	Focus	Area
Month 1	Locate every system, database, and third-party tool that holds personal data, then build the data inventory. Remediation is impossible without it.	Data inventory
Month 2	Repair consent flows under Section 6, and scope how consent and withdrawal signals from a registered Consent Manager will reach you after 13 November 2026.	Consent management
Month 3	Publish compliant notices and build the access, correction, erasure, and grievance mechanisms.	Notice and rights
Month 4	Harden security safeguards and document a tested breach response.	Security and breach
Month 5	Execute processor agreements, enforce retention schedules, and close children’s data obligations.	Processors and lifecycle

Month 1 has the most dependencies. For the method, see building a personal data inventory. This pace is aggressive but achievable for a mid-market organisation. Regulated entities in banking, insurance, and healthcare carry additional sector mandates and should run these tracks in parallel rather than in sequence.

Common Pitfalls That Delay Compliance

Five patterns account for most stalled programmes.

Treating compliance as a legal project. The DPDP Act is an operational change spanning engineering, product, legal, and operations. Handed to counsel alone, it stops at documentation and never reaches the systems that process data.

Ignoring legacy data. Section 5(2) requires a notice to Data Principals whose data was collected before the Act, stating what is held and why. A programme scoped only to new collection points leaves that data exposed.

Bundled consent. “By using this site you accept the Privacy Policy and Terms” does not meet Section 6(1). Each purpose needs its own unbundled, affirmative consent.

Manual deletion. Erasure under Section 8(7) must reach every copy, including processor systems and backups. Manual workflows miss copies and produce no evidence at inspection. Automate the path.

Assuming erasure always wins. Banks and NBFCs cannot honour every erasure request, and insurers face the same limit under their own AML rules. Under Chapter VII (Record Management) of the RBI Know Your Customer Directions, 2025, KYC identification records are kept for at least five years after the business relationship ends, and Sections 8(7) and 12(3) preserve retention that another law requires. Without a record of the statutory basis and expiry for each retained record, the organisation is exposed to either the DPDP Act or its sector regulator. The RBI-DPDP retention conflict guide sets out the full framework; the consent side is in the RBI consent rules for BFSI.

Using This Checklist

Run the checklist on events, with a quarterly pass as the floor.

When a regulator changes an instrument. Indian sector rules move faster than the Act. The RBI issued entity-wise Know Your Customer Directions on 28 November 2025 and amended six of the nine on 18 September 2026. Each change can move a retention period or a paragraph number your records cite. Re-check Sections 1 and 3 against the new text.

After any system change. New features, collection points and integrations bring new consent and processing items. Re-check Sections 1 and 3.

After any incident. Re-run Section 4 in full, timing each step against the Rule 7 clock.

Every twelve months, if designated a Significant Data Fiduciary. Rule 13 requires a DPIA and an audit in each twelve-month period from notification, with significant observations reported to the Board. Align the full checklist review to that cycle. Every other fiduciary should still keep a dated record of each pass.

Assess Your Current Position

If you want to know where your organisation stands today, run a structured gap assessment before attempting remediation. Prioritising without a baseline leads to wasted effort on low-risk items while critical exposures remain open.

Run a free DPDP Gap Assessment →

Sources: DPDP Act 2023, Sections 4 to 10; DPDP Rules 2025, Rules 3, 6, 7, 8(3), 13 and 14; RBI (Non-Banking Financial Companies – Know Your Customer) Directions, 2025, Chapter VII (Record Management).