DPDP Compliance Checklist
The actionable checklist every Indian business needs before the November 2026 deadline
Your DPDP Compliance Checklist, In Plain Language
Wondering what DPDP compliance actually requires you to do? This DPDP compliance checklist breaks the DPDP Act 2023 and Rules 2025 into concrete action items any business owner can follow. Work through it honestly, and you'll know exactly how much distance sits between you and the 13 November 2026 consent deadline.
Remember: penalties of up to ₹250 crore per violation are already live, and they apply to every business, with no small-business exemption.
The 8-Point DPDP Compliance Checklist
- 1. Consent: take clear consent before collecting personal data. No pre-ticked boxes, and withdrawal must be as easy as giving consent. Keep consent records (who, when, how, which notice version).
- 2. Privacy notice: a plain-language, standalone notice (not buried in T&Cs) with an itemized data list, purposes, user rights, grievance contact, and the Board complaint procedure, in English plus any of the 22 scheduled Indian languages.
- 3. Data deletion: delete data when the purpose is served or consent is withdrawn. Keep logs at least 1 year; large platforms face a 3-year retention/erasure rule and 48-hour pre-erasure notice.
- 4. User rights: working processes for access, correction, erasure, nomination, and consent withdrawal, with grievances resolved within 90 days.
- 5. Breach reporting: notify affected users without delay and file a detailed report with the Data Protection Board within 72 hours. Every breach is reportable, even accidental ones.
- 6. Encryption & access controls: encryption at rest and in transit, masking, role-based access with least privilege, MFA, tamper-resistant logging, backups, and a breach playbook.
- 7. Vendor contracts: signed data protection agreements with every vendor that touches your data. You stay legally responsible for what they do with it.
- 8. Training & awareness: train your team on consent handling, breach response, and data hygiene, and keep auditing and monitoring as rules evolve.
Not sure how many boxes you actually tick? That's exactly what our free audit tells you.
Get My Free Gap ReportThe Smart Order to Work Through the Checklist
Don't fix things randomly. This sequence saves months of rework.
Step 1: Map Your Data
Inventory what personal data you collect, where it lives, how it flows, which vendors touch it, and how long you keep it. Every other fix depends on this map.
Step 2: Assess the Gaps
Compare your current setup against the Act and Rules, then build a risk-ranked remediation roadmap so the biggest exposures get fixed first.
Step 3: Build & Train
Implement consent mechanisms, notices, security safeguards, rights and breach workflows, and vendor contracts, then train the team and keep monitoring.
Eight Checklist Items. One Hard Deadline.
Consent rules become mandatory on 13 November 2026 and full enforcement begins on 13 May 2027. Working through this checklist takes 2-6 months, so start now.
Book Your Free DPDP AuditWant the Complete DPDP Picture?
The checklist is the "what". Our main guide covers the "why": the Act, Rules, penalties, deadlines, and myths.
Learn Everything About DPDP ComplianceDPDP Compliance Checklist: Frequently Asked Questions
Eight essentials: valid consent with records, a compliant privacy notice, data deletion, user rights handling, 72-hour breach reporting, encryption and access controls, vendor contracts, and team training.
With a data inventory and gap assessment. Know what you collect, where it lives, and how it flows, then fix gaps in risk order. Our free audit gives you exactly that starting map.
Typically 2-6 months depending on your data volume, systems, and vendors. With consent rules mandatory from 13 November 2026, starting now is the difference between a plan and a panic.
Yes. Every vendor or processor that touches your data needs a contract, and you remain legally responsible for what they do with it. "Our vendor handles the data" is not a defence.
Turn This Checklist Into a Completed One
Our free audit scores you against every item above and hands you a prioritized fix roadmap.
Book Your Free DPDP AuditNo cost. No obligation. Get your compliance gap report.
Adri IT Software Solutions Pvt Ltd, an IT company based in Vadodara, helping businesses across Gujarat & India become DPDP-compliant before the deadline. Prefer to talk first? Let's Talk.
Disclaimer: This page is for general information only and is not legal advice. The content is based on the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 as published by the Government of India, explained here in simplified language. For the official text, please refer to the Ministry of Electronics and Information Technology (MeitY). Laws and deadlines may change. For a personalised assessment of your business, book a free DPDP audit with our team.