DPDP Act Compliance Checklist: What Indian Businesses Need to Do Now

The digitalization of our personal data has forced organizations to view personal data in a very different way. Privacy compliance is no longer simply about having a privacy notice on the website or obtaining a customer's consent via a form. Companies need to determine the types of personal data they collect, the purpose of the data collection, the storage location of the data, the persons having access, and data flows after the initial collection during the data lifecycle.

Through the DPDP Act, 2023, Data Fiduciaries are given statutory duties concerning lawful data processing, data notice, consent, data principal rights, data security, breaches, and other similar obligations. The DPDP Rules, 2025 set forth such implementation details.

Indian businesses' main issue now is not, "Have we heard of the DPDP Act?"

Instead:

"Are we fully capable of showing the existence of personal data and how we handle its management?"

This list shows some of the steps for compliance with the DPDP Act which organizations could use for checking their preparedness.

1. Identify What Personal Data Your Business Holds

You can’t manage what you can’t see.

First, you need to understand what personal data your organization collects and processes across your environment.

This might include:

• Customer names & contact details
• Email address & phone number
• Government Identification Information
• Personnel records
• Financial data
• Customer purchase data
• Location data
• Account login details
• Data gathered from websites or apps
• Personal data in documents, databases, cloud storage and SaaS Platforms

More than a list of applications should be the goal.

Organisations must know what data resides in those systems.

The IT team may be aware of the database, but that doesn’t mean the business necessarily knows which tables contain personal information. The same applies to documents, spreadsheets, cloud storage, backups and other repositories. 

2. Build an Inventory of Personal Data

Create a data inventory once personal data is identified.

For each major data set, record:

• What personal data is processed?
• Whose data?
• Where is it kept?
• Which department is responsible for it?
• Why is it being handled?
• Who can use it ?
• Is it shared with some other organization?
• How long is it held for?
• What happens when it’s no longer needed?

This inventory is an important foundation for DPDP compliance.

Without visibility into the data environment, many other compliance activities are difficult to validate. 

3. Review Your Privacy Notices

The DPDP framework emphasizes the necessity of Data Principals being able to understand the processing of their personal data without any ambiguity or confusion.

The new regulations scheduled for 2025 clarify that the information should not be part of any unrelated matter but instead, presented separately and be written in a clear and simple language for the average person to read and understand. It should also feature an itemized breakdown of the personal data that is going to be processed followed by an explanation of the reason(s) behind the processing activity.

Hence, a company should go through the following:

• Website privacy policies
• Application form notices
• New client registration forms
• Privacy statements for employees
• Consent forms
• Data collection portals

Try not to use descriptions that are too obscure or abstract for people not to get confused over which details are being gathered.

4. Review Your Consent Mechanisms

Where processing is based on consent, businesses should be able to show that consent was properly obtained.

The DPDP Act mandates consent to be specific, informed and capable of being withdrawn. And it puts the evidentiary burden on the Data Fiduciary when reliance is on consent.

Check if your organization can answer:

• When did you have permission?
• The individual was shown what information?
• What was the point of their agreement?
• Can consent be revoked?
• What happens if I withdraw?
• Is consent recorded?

Consent isn’t a one-time checkbox. Organisations need processes to manage the consent lifecycle from end to end. 

5. Map Where Personal Data Is Stored

This step is probably the most critical item on your checklist.

Usually, personal data doesn't stay in a single location.

It travels through different avenues: 

Applications → Databases → Cloud storage → Employees → Vendors → Backups

Identify the main locations where personal data resides and undergoes processing.

Don't just consider production databases. Private data may also be present in spreadsheets, shared folders, emails, development environments, archives, and cloud storage.

Data mapping is the foundation for compliance teams to grasp the real data landscape of the company.

6. Classify Personal and Sensitive Data

And knowing where data lives is only half the battle.

Organisations also need to know what kind of data they are dealing with.

Classifying data will help you to find :

• Private data
• Financial information
• Identity information
• Employee data
• Information Customers
• Confidential commercial information
• Other kinds of sensitive data

Classification helps to decide how best to focus compliance efforts and apply controls to different types of information.

This is especially critical in organisations where data is distributed across thousands or millions of files and records. 

7. Review Data Retention and Deletion

The endless holding of a user's data will lead to unnecessary compliance and legal problems as well as increase operation risk, which might lead the company to lose money, or even worse, be punished legally for not handling users' data properly.

Companies are advised to have retention policies which are in line with the purposes of the data processing and the legal and / or commercial conditions applicable to the type of the activities they are doing.

Questions to be considered:

• What is the reason that this data is kept?
• Is the purpose for collecting the data the same, is the data still collecting it and what is the data used for?
• What is the period that we need to keep the data for?
• What is the location of the data copies?
• Are the old records that we have accessible?
• Can data which is unnecessary be identified and removed?

Retention policies are also the secondary copies of such data as archive, backups, and export files.

8. Understand Third-Party Data Sharing

Your company's data regularly leaves the direct vicinity of the organization.

Among the vendors:

• Cloud
• Payroll
• CRM systems
• Marketing solutions
• Client support software
• Data analysis
• IT services
• Data controllers

For data processing, it's important to know: which personal data, why, and how much the data contract and operations have been safeguarded against breaches.

Your company should also have the means by which processors are accessing your organization's data.

9. Prepare for Data Principal Requests

The DPDP Act, among other things, grants Data Principals certain rights regarding their personal data (the main ones being access to details, correction, erasure, grievance redressal, and nomination) these are the rights exercised under the provisions applicable to them.

Thus, organizations are expected to put in place mechanisms for handling these kinds of requests.

Such a mechanism should outline the following items:

1. The different ways in which a request can come to hand,
2. The various procedures used in identifying that the requester is the one and only requester,
3. The methods for determining where data can be stored,
4. The process of the request being examined;
5. The method that is adopted to perform corrections or deletions;
6. The way the response is being recorded

Accurate data discovery and classification will make such compliance efforts quite a breeze.

10. Strengthen Personal Data Security Practices

In addition to the DPDP requirements, organizations also have to put in place effective protective measures for personal data.

The DPDD provisions also cover the implementation of technical or organizational means, which are meant to include, apart from the security measures already outlined, measures concerning for instance, access control, logging, surveillance, and other types of measures.

Organizations have to look into:

• Controlled access
• The authentication mechanisms
• Privileged access
• Cypher of data
• Activities to be recorded and the way they are being watched
• Practice of making copies
• Management of the security weaknesses
• Steps taken when the incident happens

The end goal is not merely possessing security tools, but also verifying that personal data is being properly handled throughout its life cycle.

11. Create a Personal Data Breach Response Process

A compliance program also needs to include provisions for when confidential information gets leaked.

Companies must be equipped with a written procedure that includes:

• Methods for identifying breaches
• Clear lines of communication as to who will handle the situation
• Procedures for determining exactly what information is affected
• Sets of factors to help determine the true extent of the incident
• Steps for notifying the affected parties
• Methods of preserving and storing evidence
• Tailor the measures to ensure the effectiveness of such a response

In this case, having a clearly formulated and documented procedure allows everyone to know their responsibilities and roles so that in the worst-case scenario everything can go smoothly and no one is surprised or feels lost in the situation. Therefore, the company should have such a plan ready for a variety of breaches.

12. Assign Ownership for DPDP Compliance

DPDP compliance should not sit entirely with the legal or IT team.

It involves multiple functions, including:

• Legal
• Compliance
• IT
• Security
• HR
• Procurement
• Product
• Marketing
• Data teams

Define who owns each responsibility.

For example:

Clear ownership makes compliance much easier to manage.

13. Turn the Checklist Into Continuous Monitoring

A single compliance assessment cannot cover everything. It only tells you the state of affairs at the time.

The fact is, data environments change on a regular basis. New apps are launched, employees make new files, databases increase in size, vendors are altered, data migrates between systems etc.

This suggests that an organisation could comply with the regulations one day, and be non-compliant after a few months, just because its data landscape altered.

Having constant visibility can assist companies in uncovering:

• The identification of newly found personal data
• The detection of hidden data repositories
• The rectification of wrongly classified information
• The elimination of redundant data
• The determination of data residing at unexpected places
• The tracing of any data exposure changes

In view of these developments, data discovery & classification are essential elements of an ongoing DPDP compliance strategy.

DPDP Act Compliance Checklist

Before considering your organization DPDP-ready, ask:

☐ Have we identified the personal data we collect?
☐ Do we know where that data is stored?
☐ Have we mapped personal data across our environment?
☐ Is personal data properly classified?
☐ Are our privacy notices clear and up to date?
☐ Can we demonstrate and manage consent where required?
☐ Do we have defined retention and deletion practices?
☐ Have we reviewed third-party data sharing?
☐ Can we respond to Data Principal requests?
☐ Are appropriate security safeguards in place?
☐ Do we have a documented breach response process?
☐ Are responsibilities for DPDP compliance clearly assigned?
☐ Can we continuously monitor changes in our personal data environment?

Compliance Starts With Knowing Your Data

DPDP compliance goes way beyond merely filing a paper or document.

While policies, consent mechanisms, contracts, and processes are key, they basically all rely on a single essential skill: understanding what sort of personal data your organization holds and where it is stored.

When an organization is not able to locate its personal data across various storage mediums, such as databases, cloud environments, files, and other repositories, it is highly unlikely that this organization will be able to answer basic compliance related questions satisfactorily.

This is the main reason why data discovery and classification must be considered the core of any DPDP readiness program.

An organization can begin by mapping its data landscape, recognizing personally identifiable information, adequately categorizing it, and then monitoring on a regular basis how the data is stored and used.

The earlier businesses adopt the DPDP Act as a set of guidelines from which they develop day-to-day business practices, it will be easier for them to prove they follow the DPDP Act requirements when their data environment expands.