DPDP compliance checklist for Indian businesses
Every duty in the DPDP Act, 2023 and DPDP Rules, 2025 that lands on a business, grouped by area, with the section or rule behind it and the date it applies.
Last updated 22 October 2026
What is on a DPDP compliance checklist?
A DPDP compliance checklist covers eight areas: a personal-data inventory, notices, consent, children’s data, security safeguards, breach intimation, retention and erasure, and Data Principal rights and grievances. Almost every item applies from 13 May 2027, when the Act’s duties and the matching Rules come into force, so the groundwork should start well before then.
What does a business need to do to comply with DPDP?
Each item below comes from the DPDP Act, 2023 or the DPDP Rules, 2025. The dates come from two Gazette notifications of 13 November 2025: G.S.R. 843(E), which brings the Act’s sections into force (Act commencement notification), and Rule 1 of the Rules (PIB release). Every duty on a business, from notice and consent to safeguards, breach intimation, erasure, children’s data and rights, applies from 13 May 2027, as do the penalties. Only Consent Manager registration starts earlier, on 13 November 2026.
| Area | Checklist item | Source | Applies from |
|---|---|---|---|
| Inventory | List the personal data you hold, its purpose, location, recipients and retention period | Sections 5, 8(7), 11 | Groundwork for all items |
| Inventory | Record a lawful ground for each purpose: consent, or a section 7 legitimate use | Sections 4 and 7 | 13 May 2027 |
| Notice | Write a standalone notice with an itemised list of data, the specified purpose and the goods or services it enables | Section 5(1), Rule 3(a), 3(b) | 13 May 2027 |
| Notice | Include the link and means to withdraw consent, exercise rights and complain to the Board | Rule 3(c) | 13 May 2027 |
| Notice | Offer the notice in English or an Eighth Schedule language | Section 5(3) | 13 May 2027 |
| Notice | Send a notice to people whose data you hold under consent given before commencement | Section 5(2) | 13 May 2027 |
| Consent | Collect consent by a clear affirmative action, limited to the data needed | Section 6(1) | 13 May 2027 |
| Consent | Make withdrawal as easy as giving consent, and stop processing (and your processors) within a reasonable time | Sections 6(4), 6(6) | 13 May 2027 |
| Consent | Keep proof of notice and consent | Section 6(10) | 13 May 2027 |
| Consent | If you use a Consent Manager, check it is registered with the Board | Section 6(9), Rule 4 | 13 Nov 2026 |
| Children | Get verifiable parental consent, checking the parent is an identifiable adult | Section 9(1), Rule 10 | 13 May 2027 |
| Children | Stop tracking, behavioural monitoring and targeted ads aimed at children, unless a Fourth Schedule exemption applies | Section 9(3), Rule 12 | 13 May 2027 |
| Children | Verify a lawful guardian’s appointment before relying on their consent for a person with disability | Section 9(1), Rule 11 | 13 May 2027 |
| Security | Apply encryption, masking or tokenisation, access control, logging and monitoring, and backups | Section 8(5), Rule 6(1)(a)–(d) | 13 May 2027 |
| Security | Keep security logs and related personal data for one year | Rule 6(1)(e) | 13 May 2027 |
| Processors | Sign a valid contract with every Data Processor, with security safeguard clauses | Section 8(2), Rule 6(1)(f) | 13 May 2027 |
| Breach | Inform each affected Data Principal without delay | Section 8(6), Rule 7(1) | 13 May 2027 |
| Breach | Inform the Board without delay, then send a detailed report within seventy-two hours | Section 8(6), Rule 7(2) | 13 May 2027 |
| Retention | Erase data when consent is withdrawn or the purpose is served, unless a law requires retention; make processors erase too | Section 8(7), Rule 8(1) | 13 May 2027 |
| Retention | Send the 48-hour pre-erasure intimation | Rule 8(2) | 13 May 2027 |
| Retention | Keep personal data, traffic data and processing logs for at least one year from processing | Rule 8(3) | 13 May 2027 |
| Rights | Publish how to make a rights request and the identifier needed | Rule 14(1) | 13 May 2027 |
| Rights | Handle access, correction, completion, updating and erasure requests | Sections 11, 12 | 13 May 2027 |
| Rights | Publish a grievance response period of no more than ninety days and meet it | Sections 8(10), 13, Rule 14(3) | 13 May 2027 |
| Rights | Accept nominations of one or more individuals | Section 14, Rule 14(4) | 13 May 2027 |
| Contact | Publish the contact details of a DPO or a person who answers questions, and include them in every rights response | Section 8(9), Rule 9 | 13 May 2027 |
| Transfers | Check transfers abroad against any Government restriction or order | Section 16, Rule 15 | 13 May 2027 |
Extra items for some businesses
| Who | Extra item | Source | Applies from |
|---|---|---|---|
| Significant Data Fiduciaries | Appoint a Data Protection Officer based in India and an independent data auditor | Section 10(2) | 13 May 2027 |
| Significant Data Fiduciaries | Run a Data Protection Impact Assessment and audit every twelve months and report significant observations to the Board | Section 10(2)(c), Rule 13(1)–(2) | 13 May 2027 |
| Significant Data Fiduciaries | Check that algorithmic software does not risk Data Principals’ rights; keep specified data in India | Rule 13(3)–(4) | 13 May 2027 |
| E-commerce and social media (two crore or more users), online gaming (fifty lakh or more users) | Erase data after three years of inactivity, per the Third Schedule | Rule 8(1) | 13 May 2027 |
What should a business do in its first 90 days of DPDP compliance?
Days 1 to 30: find the data
- Name an owner for DPDP compliance and the person who will answer Data Principals’ questions.
- Build the personal-data inventory across forms, apps, spreadsheets, CRMs and vendors.
- Flag children’s data and any data of persons with disability who have lawful guardians.
- List every Data Processor and collect their current contracts.
Days 31 to 60: fix notices, consent and contracts
- Record a lawful ground, consent or a section 7 use, for each purpose.
- Rewrite notices to the Rule 3 standard and plan translations.
- Redesign consent flows so withdrawal is as easy as giving consent.
- Add security, erasure and log-retention clauses to processor contracts.
Days 61 to 90: security, breach, retention and rights
- Close gaps against the Rule 6 minimum safeguards and set one-year log retention.
- Write a breach runbook with the Rule 7 contents and the seventy-two-hour report, and rehearse it.
- Set retention periods and erasure jobs, including the 48-hour intimation.
- Publish how to make rights requests and a grievance response period of no more than ninety days.
Not sure where to start? The free DPDP compliance checker asks a few questions about your business and shows which items on this list apply to you.
How will the Perimattic DPDP Compliance Suite help work through the checklist?
- Personal-data inventory for the groundwork.
- Notice builder for the Rule 3 items, in English and Eighth Schedule languages.
- Consent capture and records, with withdrawal as easy as consent.
- Rights requests with response-time tracking.
- Breach response workflow for Rule 7.
- Retention and erasure schedules, including the 48-hour intimation.
- Verifiable parental consent workflow for Rule 10.
- Processor register and contract tracking.
Status: The Perimattic DPDP Compliance Suite is in development; none of this is available to use yet.
General guidance, not legal advice. Checked against the DPDP Act, 2023 and DPDP Rules, 2025 on 22 October 2026.
Use the checklist with these
DPDP compliance checklist, answered
What is the first step in DPDP compliance?
Build a personal-data inventory: list what personal data you collect, from whom, for what purpose, where it is stored, who it is shared with and how long you keep it. Every later step, from the Rule 3 notice to Rule 8 erasure and section 11 access requests, depends on knowing what you hold.
Do I need a Data Protection Officer under the DPDP Act?
Only a Significant Data Fiduciary must appoint a Data Protection Officer, who must be based in India (section 10(2)(a)). Every other Data Fiduciary must still publish the business contact details of a person who can answer Data Principals’ questions about processing (section 8(9) and Rule 9).
Do Data Processors have to comply with the DPDP Act?
The Act puts the duties on the Data Fiduciary, which stays responsible for processing done on its behalf (section 8(1)) and may engage a processor only under a valid contract (section 8(2)). In practice the contract has to pass the duties down: security safeguards (Rule 6(1)(f)), erasure (section 8(7)(b)) and one-year log retention (Rule 8(3)).
Want DPDP compliance built around how your business handles data?
Sign up to tell us what personal data you handle, follow the build and be first to try the DPDP Compliance Suite when it opens.
Sign up