A DPDP compliance checklist for businesses

Most obligations under the DPDP Rules, 2025 are expected to apply about 18 months after the Rules were notified in November 2025. That sounds like a long time until you list everything that needs to change. This checklist breaks the work into steps your product, engineering and legal teams can own.

This is general guidance, not legal advice. Work with counsel on the specifics for your sector.

1. Map your data

• List every system that holds personal data: databases, logs, analytics, CRMs, spreadsheets, backups.
• For each, record what data it holds, why, and who can access it.
• Identify every vendor (Data Processor) that touches personal data, and check your contracts with them.
• Flag children’s data and data that crosses borders.

2. Decide your legal basis, purpose by purpose

• For each purpose, decide whether you rely on consent or a legitimate use under the Act.
• Remove purposes you cannot justify. If you do not need the data, do not collect it.
• Make sure no service is conditional on consent for something unrelated.

3. Fix your notices and consent flows

• Write itemised notices: what data, for what purpose, how to withdraw, how to complain to the Board.
• Offer notices in English and the languages your customers use.
• Replace pre-ticked boxes and bundled “I agree” buttons with purpose-by-purpose choices.
• Make withdrawal as easy as consent, in the same channel.
• Keep verifiable records of every notice served and every decision.

4. Honour withdrawals everywhere

• When consent is withdrawn, make sure every system and vendor stops processing.
• Define retention periods and erase data when the purpose is served, unless a law requires you to keep it.

5. Build rights handling

• Publish a contact for data questions and a grievance channel.
• Set up workflows for access, correction, erasure and nomination requests.
• Track response times against the limits in the Rules.

6. Prepare for breaches

• Put reasonable security safeguards in place: encryption, access control, logging and monitoring.
• Write a breach response plan that covers notifying the Board and affected people without delay, and a detailed report within 72 hours.
• Keep logs for at least a year, as the Rules require.

7. Check for extra duties

• Process children’s data? Plan for verifiable parental consent, and stop any tracking or targeted advertising aimed at children.
• Likely to be a Significant Data Fiduciary? Plan for a Data Protection Officer, an independent auditor and periodic impact assessments.

Where a Consent Manager helps

Steps 3 and 4 are where most of the engineering effort goes, and where a Consent Manager saves the most time. With myconsentapp you describe purposes once, redirect customers to an itemised notice, verify consent before you process, and receive withdrawals by signed webhook. You can start in a free sandbox today.

Go deeper for your sector

This checklist is the short version. The Data Fiduciary playbook covers every duty in detail, with a 90-day plan and owners. The industry guides apply it to e-commerce, banks and NBFCs, healthcare, schools and edtech, employers, small businesses and more. Each one has a checklist you can tick off and download.