Call +1 943 270 2421
Data protection

DPDP Act compliance checklist for Indian businesses

Last reviewed

Checklist
Short answer

To comply with the Digital Personal Data Protection Act, 2023, a business must map the personal data it holds, give a clear notice and obtain valid consent (or rely on a listed legitimate use), secure the data, report breaches, honour data-principal rights, erase data it no longer needs, and bind its processors by contract. Most obligations under the DPDP Rules, 2025 apply from around May 2027.

The law this relies on

Digital Personal Data Protection Act, 2023

Sections 4–8

Grounds for processing, notice, consent, legitimate uses and the general obligations of Data Fiduciaries.

Digital Personal Data Protection Act, 2023

Sections 9–10

Children’s data and additional obligations of Significant Data Fiduciaries.

Digital Personal Data Protection Act, 2023

Sections 11–14

Rights of Data Principals: access, correction and erasure, grievance redress and nomination.

Digital Personal Data Protection Rules, 2025

Notified November 2025 (phased)

Operational detail on notice, consent managers, security safeguards, breach intimation, retention and rights.

Explained

Who does the DPDP Act apply to?

The Act applies to digital personal data processed in India, and to processing outside India where it is connected with offering goods or services to people in India. The business that decides why and how data is processed is the “Data Fiduciary”; vendors that process on its behalf are “Data Processors”. Personal data collected on paper and later digitised is also covered. Purely personal or domestic use, and data that a person has made publicly available themselves, fall outside the Act.

When do the obligations start?

The Digital Personal Data Protection Rules, 2025 were notified in November 2025 with a phased start. Provisions setting up the Data Protection Board took effect on notification, consent-manager registration follows about a year later, and the core duties of Data Fiduciaries — notice, security safeguards, breach intimation, retention and rights handling — apply roughly 18 months after notification, around May 2027. Treat the interim period as a build window rather than a grace period.

What are the core obligations of a Data Fiduciary?

Section 8 of the Act places the main duties on the Data Fiduciary: process data only for a lawful purpose, keep it reasonably accurate where it is used to make decisions, protect it with reasonable security safeguards, notify the Data Protection Board and each affected person of a breach, erase data once the purpose is served (unless the law requires retention), publish business contact details for data questions, and run an effective grievance mechanism. The fiduciary remains responsible even when a processor handles the data.

What extra applies to children’s data and Significant Data Fiduciaries?

For anyone under 18, Section 9 requires verifiable consent of a parent or lawful guardian and bars tracking, behavioural monitoring and targeted advertising directed at children, subject to exemptions in the Rules. Businesses the government notifies as Significant Data Fiduciaries under Section 10 must also appoint a Data Protection Officer based in India, engage an independent data auditor and carry out periodic Data Protection Impact Assessments and audits.

Checklist

  • { "item": "Build a personal-data inventory", "detail": "Record each category of personal data, its source, purpose, systems, processors, retention period and any transfer outside India." }
  • { "item": "Fix a lawful basis for every purpose", "detail": "Use consent under Section 6, or one of the legitimate uses listed in Section 7 (for example employment purposes or compliance with a legal obligation)." }
  • { "item": "Rewrite notices and consent flows", "detail": "Give a standalone, itemised notice in clear language, offer it in English or an Eighth Schedule language, and make withdrawal as easy as giving consent." }
  • { "item": "Implement security safeguards", "detail": "Encryption or masking, access controls, logging and monitoring, backups, and contractual safeguards with processors, as described in the Rules." }
  • { "item": "Prepare a breach-response runbook", "detail": "Inform affected individuals without delay and send the Data Protection Board an initial intimation followed by a detailed report within the period set in the Rules (72 hours, unless extended)." }
  • { "item": "Set retention and erasure schedules", "detail": "Delete data once the purpose is served or consent is withdrawn, unless another law requires you to keep it; follow any class-specific timelines in the Rules." }
  • { "item": "Operationalise data-principal rights", "detail": "Publish how people can seek access, correction, erasure, grievance redress and nomination, and track each request to closure within the timeline in the Rules." }
  • { "item": "Paper your vendor contracts", "detail": "Add data-processing terms that restrict processors to your instructions, require safeguards, breach notice and deletion on exit." }
  • { "item": "Check children’s data and SDF status", "detail": "Add age-gating and verifiable parental consent where needed, and assess whether you could be notified as a Significant Data Fiduciary." }
  • { "item": "Assign ownership and train staff", "detail": "Name an accountable owner (or DPO), keep evidence of compliance and train teams that touch customer or employee data." }

Frequently asked questions

Is DPDP Act compliance mandatory now?

The Act is law and the Board provisions are in force, but most Data Fiduciary obligations under the DPDP Rules, 2025 take effect about 18 months after their November 2025 notification, around May 2027. Businesses are expected to be ready by then.

Does the DPDP Act apply to employee data?

Yes. Employee data is personal data. Section 7 allows processing for employment-related purposes without separate consent, but notice, security, retention and breach duties still apply.

Do small businesses need to comply with the DPDP Act?

There is no general size-based exemption for Data Fiduciaries. The government can exempt certain classes, including start-ups, from some provisions by notification, so check the current exemptions for your category.

Do we need a Data Protection Officer?

Only Significant Data Fiduciaries must appoint a DPO based in India. Other fiduciaries must still publish the contact details of a person who can answer questions about their data processing.

This guide is general information about Indian law, not legal advice for a specific dispute, document or jurisdiction. Laws and rules change by notification; for a decision with legal or financial consequences, consult a qualified advocate.

Put this into practice

CaseDocker keeps contracts, signatures, stamp papers, notices and compliance deadlines in one place, with reminders before anything lapses.

Explore Compliance ManagementAll legal guides