Free Tool

DPDP Compliance Checklist

25 obligations across five compliance areas of the DPDP Act, 2023. Check off each item as your organisation addresses it. Progress saves automatically in your browser.

0 of 25 obligations addressedCritical

Consent ManagementSection 6

0/5

Publish a clear, plain-language consent notice before collecting personal data.Section 6

Obtain separate consent for each distinct processing purpose.Section 6

Provide a withdrawal mechanism as accessible as the consent collection method.Section 6(4)

Maintain timestamped records of all consent grant and withdrawal events.Section 6

Re-obtain consent when the processing purpose materially changes.Section 6

Data Principal RightsSections 11–14

0/5

Document a formal process for data access requests with defined response timelines.Section 11

Enable data principals to request correction and completion of inaccurate data.Section 12

Build capability to erase personal data upon legitimate request.Section 12

Designate a Grievance Redressal Officer with published contact details.Section 13

Establish a process for data principal nominees to exercise rights.Section 14

Data Fiduciary ObligationsSections 8–10

0/5

Maintain a register of all personal data processing activities, purposes, and retention periods.Section 8

Collect only the minimum personal data necessary for the stated purpose.Section 8

Define and enforce data retention limits. Erase data when the purpose lapses.Section 8(7)

Execute data processing agreements with all third-party processors.Section 8

Appoint a Data Protection Officer with documented authority (required for Significant Data Fiduciaries).Section 10

Breach NotificationSection 9(6)

0/5

Create a documented breach response plan with assigned roles and escalation paths.Section 9(6)

Deploy technical monitoring capable of detecting a personal data breach.Section 9(6)

Establish a workflow to notify the Data Protection Board within 72 hours of detection.Section 9(6)

Define templates and a process to notify affected data principals after a breach.Section 9(6)

Conduct breach response drills at least annually and document outcomes.Section 9(6)

Children's DataSection 9

0/5

Implement age verification or parental declaration before processing children's data.Section 9

Obtain verifiable parental consent before processing data of individuals under 18.Section 9

Prohibit behavioural tracking, monitoring, and targeted advertising directed at children.Section 9(3)

Restrict processing of children's data to the minimum necessary for the stated purpose.Section 9

Establish a process for guardians to review and withdraw consent for children's data.Section 9

Reset all progress

Your compliance position has gaps. Take the free assessment for a personalised action plan with prioritised recommendations.

Take the Free Assessment