DPDP Act Compliance Checklist for Indian Companies (2026–2027)

The Digital Personal Data Protection Act, 2023 is now law, and most of its obligations apply from 13 May 2027. The DPDP Rules were notified in November 2025, so companies now have a fixed deadline and clear requirements.

The good news: DPDP compliance is not a mystery. It is a set of practical steps — appoint the right people, know your data, tell people what you do with it, protect it, and be able to prove all of it. This checklist explains each step in plain language, along with the evidence you should keep.

Who does the DPDP Act apply to?

The Act applies to any organisation that processes digital personal data of people in India. That includes data about your:

Employees and job candidates

Customers and prospects

Website and app users

Vendors' contact people

It also applies to organisations outside India that offer goods or services to people in India. Your size doesn't matter: a 20-person startup and a 20,000-person enterprise have the same core obligations. Some large organisations may also be notified as Significant Data Fiduciaries, with extra duties.

The key dates

13 November 2025: the DPDP Rules were notified, and the Data Protection Board provisions took effect.

13 November 2026: the Consent Manager provisions apply.

13 May 2027: most obligations apply, including notices, security safeguards, breach reporting and Data Principal rights.

Most organisations need six to nine months to complete a DPDP programme properly. Starting now leaves time to do it well instead of in a rush.

The 12-step DPDP compliance checklist

1. Appoint a privacy owner and a grievance officer

Someone must own the programme and have the authority to act. You also need a grievance officer whose business contact details are published, so people can raise concerns about their data.

☐ Privacy owner named, with authority to make decisions

☐ Grievance officer named, with email and phone published

☐ Escalation route to senior management agreed

Evidence to keep: an appointment letter or management note.

2. Map your personal data

You can't protect what you don't know you have. Interview every department and record what personal data it collects, why, on what legal basis, how long it's kept, and who it's shared with.

☐ HR, Sales, Finance, IT, Support and Marketing all covered

☐ Purpose and legal basis recorded for each activity

☐ Systems, vendors and processing outside India recorded

☐ Children's data and sensitive data flagged

Evidence to keep: a record of processing activities (your data map).

3. Publish a clear privacy notice

Your privacy notice must be itemised and standalone: it lists each item of personal data and the specific purpose for it, in clear language. It must also explain how people can withdraw consent, exercise their rights and complain to the Data Protection Board.

☐ Each item of personal data and its purpose listed

☐ How to withdraw consent and exercise rights explained

☐ How to complain to the Data Protection Board explained

☐ Notice versioned and dated

Evidence to keep: the published notice, with its version history.

4. Get valid consent, and make withdrawal easy

Where you rely on consent, it must be free, specific, informed, unconditional and unambiguous, given through a clear affirmative action. Withdrawing consent must be as easy as giving it.

☐ No pre-ticked boxes

☐ Separate consent for separate purposes

☐ Withdrawal available in the same place, just as easily

☐ Consent records kept

Evidence to keep: screenshots of consent screens, consent records and withdrawal logs.

5. Put reasonable security safeguards in place

This is the obligation with the highest penalty. The Rules expect appropriate technical and organisational measures, including:

☐ Encryption, masking or tokenisation where appropriate

☐ Access control, with multi-factor authentication for administrators

☐ Monitoring, with logs kept for at least one year

☐ Backups, with a tested restore

Evidence to keep: your security standard, access reviews and log-retention evidence.

6. Prepare for personal data breaches

When a breach happens, the clock starts immediately. You need to know who does what in the first hours.

☐ Incident response plan approved

☐ Cyber incidents reported to CERT-In within 6 hours

☐ The Data Protection Board and affected people informed without delay

☐ A detailed report sent to the Board within 72 hours

☐ A breach drill run at least once a year

Evidence to keep: your incident plan, breach log and drill records.

7. Sign agreements with your vendors

Every vendor that processes personal data for you — payroll, CRM, cloud hosting, email, support tools — is a Data Processor. You must have a contract that binds them to protect it.

☐ List of every vendor that touches personal data

☐ A Data Processing Agreement signed with each

☐ Breach notification time agreed in writing

☐ Vendors processing data outside India identified

Evidence to keep: your vendor register and signed agreements.

8. Set retention periods and delete what you no longer need

Keep personal data only as long as you need it for its purpose, then delete it securely.

☐ Retention period set for each processing activity

☐ Secure deletion method defined

☐ Deletion carried out and recorded

Evidence to keep: your retention schedule and deletion records.

9. Handle Data Principal requests

People have the right to access, correct and erase their personal data, to nominate someone to act for them, and to have grievances resolved. Grievances must be resolved within 90 days.

☐ A published way to make a request

☐ Identity checked before acting

☐ Every request logged with dates

☐ Responses within the required time

Evidence to keep: a request register with response dates.

10. Train your employees

Most data breaches start with a human mistake: a phishing email, a misdirected spreadsheet, a weak password. Training — with records that prove it happened — is one of the strongest safeguards you have.

☐ DPDP awareness training for every employee

☐ Role-based training for HR, Sales, Support and IT

☐ Data protection policies acknowledged by every employee

☐ An annual refresher

Evidence to keep: training completion records and certificates.

11. Take extra care with children's data

Processing a child's personal data requires verifiable consent from a parent or guardian. Tracking, behavioural monitoring and targeted advertising directed at children are not permitted.

☐ Children's data identified in your data map

☐ A verifiable parental consent process in place

Evidence to keep: your parental consent procedure and records.

12. Keep the evidence

Compliance is something you must be able to prove. When an auditor, a client or the Data Protection Board asks, you should be able to show approved policies, training records, a breach log, signed vendor agreements and a history of who changed what, and when.

☐ Policies approved, versioned and dated

☐ An activity log of changes

☐ Readiness reviewed every quarter

Your first 72 hours after a breach

Hour 0–1: contain the incident, preserve evidence and start an incident log.

Within 6 hours: if it's a reportable cyber incident, report it to CERT-In.

Without delay: inform the Data Protection Board and the affected people, in clear language.

Within 72 hours: send the Board a detailed report covering what happened, its extent, what you've done and how you'll prevent it happening again.

The companies that handle breaches well aren't the ones with the biggest budgets. They're the ones that rehearsed.

What are the penalties?

The DPDP Act sets out penalties of up to:

₹250 crore for failing to take reasonable security safeguards to prevent a breach

₹200 crore for failing to notify the Board or affected people of a breach

₹200 crore for failing to meet the obligations for children's data

₹150 crore for a Significant Data Fiduciary failing its additional obligations

₹50 crore for breaching any other provision

The Data Protection Board considers the nature, gravity and duration of a breach when deciding a penalty.

Is there a DPDP certification?

No. There is no official DPDP certification from the Government of India or the Data Protection Board. Be cautious of anyone offering one.

What protects you is evidence: approved policies, a data map, a privacy notice, signed vendor agreements, trained employees and a tested breach process.

How CyberSek helps

CyberSek's DPDP workspace turns this checklist into a guided programme your team can actually finish:

26 readiness controls mapped to the Act and Rules, with a live readiness score

Policy templates, a privacy notice and a vendor register

Breach timers for the 6-hour and 72-hour deadlines

Data-request tracking within the 90-day limit

Security awareness and DPDP training for every employee, with certificates

A detailed readiness report you can share with your board or auditor

Download the free checklist below to get started — or start a free trial and see the DPDP workspace for yourself.

This article is general information to help you prepare, not legal advice. Confirm how the law applies to your organisation with qualified legal counsel.