India’s Digital Personal Data Protection Act, 2023 (DPDPA) is no longer a future concern. The Digital Personal Data Protection Rules, 2025 were notified on 13 November 2025 with a phased rollout, and the core obligations on notice, consent, security safeguards, breach reporting, children’s data, and data erasure take effect 18 months after notification, in May 2027. For most organizations, that leaves only a few months to finish work that typically takes far longer than expected.
This DPDPA compliance checklist breaks the law down into concrete actions. It’s written for compliance officers, CISOs, legal teams, and founders who need a practical roadmap rather than a legal commentary. It isn’t legal advice, so confirm specific obligations against the official text published by the Ministry of Electronics and Information Technology (MeitY) and with qualified counsel.
DPDPA at a Glance
| Element | What It Means |
|---|---|
| Scope | Digital personal data processed in India, and processing outside India connected to offering goods or services to people in India |
| Data Fiduciary | The organization that decides why and how personal data is processed |
| Data Processor | An entity processing data on behalf of a Data Fiduciary |
| Data Principal | The individual the data relates to (for children, includes the parent or lawful guardian) |
| Significant Data Fiduciary (SDF) | A fiduciary notified by the government based on factors such as volume and sensitivity of data and risk to rights; subject to extra obligations |
| Regulator | Data Protection Board of India |
| Maximum penalty | Up to ₹250 crore per instance for failing to take reasonable security safeguards |
Implementation Timeline
The Rules introduced compliance in phases:
- Immediately on notification (November 2025): provisions establishing the Data Protection Board and related administrative rules.
- After 12 months: provisions relating to the registration and obligations of Consent Managers.
- After 18 months (May 2027): the substantive obligations on Data Fiduciaries, including notices, consent, security safeguards, breach intimation, data retention and erasure, children’s data, and Significant Data Fiduciary duties.
If you’re starting now, our article on why now is the best time to become DPDPA compliant explains why waiting until the deadline is risky.
The DPDPA Compliance Checklist
Phase 1: Governance and Accountability
- Appoint an executive owner for DPDPA compliance with budget and authority.
- Form a cross-functional working group spanning legal, IT, security, product, HR, marketing, and customer support.
- Publish contact details of a person who can answer Data Principals’ questions about processing (or a Data Protection Officer if you are an SDF).
- Assess whether your organization may be notified as a Significant Data Fiduciary.
- Approve a data protection policy and assign responsibilities in writing.
Phase 2: Data Discovery and Mapping
- Inventory every system, application, SaaS tool, and spreadsheet that holds personal data.
- Document what personal data you collect, from whom, for what purpose, and on what legal basis.
- Map how data flows between systems, teams, vendors, and countries. A structured data flow analysis speeds this up.
- Identify children’s data and data relating to persons with disabilities who have lawful guardians.
- Identify legacy data collected before the Act took effect; our guide on managing legacy data under India’s data protection law covers this.
- Create a record of processing activities that you’ll keep current.
Phase 3: Lawful Basis, Notice, and Consent
- For each processing purpose, determine whether it relies on consent or on a “certain legitimate use” permitted by the Act.
- Draft clear, standalone privacy notices in plain language that itemize the personal data and purposes, explain how to withdraw consent and exercise rights, and explain how to complain to the Board.
- Make notices available in English and, where relevant, in languages listed in the Eighth Schedule of the Constitution.
- Implement consent that is free, specific, informed, unconditional, and unambiguous, given through a clear affirmative action.
- Remove pre-ticked boxes, bundled consent, and consent buried in terms of service.
- Make withdrawing consent as easy as giving it, and stop processing promptly after withdrawal.
- Keep auditable records of consent and withdrawals.
- Evaluate whether to integrate with registered Consent Managers.
Phase 4: Data Principal Rights
- Build processes to handle requests for access to information, correction, completion, updating, and erasure.
- Support the right to nominate another individual to exercise rights in case of death or incapacity.
- Set up a grievance redressal mechanism with defined response timelines.
- Verify the identity of requesters before acting.
- Track requests and response times as compliance evidence.
Phase 5: Children’s Data
- Identify services likely to be used by individuals under 18.
- Implement verifiable parental consent before processing children’s personal data, using mechanisms consistent with the Rules.
- Stop any tracking, behavioral monitoring, or targeted advertising directed at children, subject to exemptions notified under the Rules.
- Check whether your organization falls within any class exempted from specific children’s data obligations, such as certain healthcare or educational purposes.
Phase 6: Reasonable Security Safeguards
The Rules describe minimum safeguards, and failure here carries the highest penalty. At a minimum:
- Encrypt, obfuscate, mask, or tokenize personal data where appropriate.
- Enforce access control based on least privilege, with strong authentication.
- Maintain logs that provide visibility into access to personal data and retain them for at least the period specified in the Rules.
- Implement monitoring to detect unauthorized access.
- Back up data and plan for continuity so processing can resume after an incident.
- Bind Data Processors by contract to implement equivalent safeguards.
- Test controls through vulnerability assessment and penetration testing.
Phase 7: Breach Detection and Notification
- Define what counts as a personal data breach in your incident response plan.
- Prepare to notify the Data Protection Board without delay on becoming aware of a breach, followed by a detailed report within 72 hours (unless the Board allows more time).
- Prepare templates to inform affected Data Principals without delay in plain language, covering the nature of the breach, likely consequences, mitigation steps, and contact details.
- Align DPDPA breach reporting with existing CERT-In incident reporting obligations, which have their own timelines.
- Run tabletop exercises to test the 72-hour process end to end.
Phase 8: Retention and Erasure
- Define retention periods for every category of personal data based on purpose and legal requirements.
- Erase personal data once the purpose is served or consent is withdrawn, unless retention is required by law.
- If you fall within classes covered by the Rules’ time-based erasure provisions (such as large e-commerce, online gaming, or social media platforms), implement erasure after the specified period of inactivity and notify users at least 48 hours before erasure.
- Ensure processors also delete data when instructed.
Phase 9: Vendors, Processors, and Cross-Border Transfers
- Inventory processors and sub-processors handling personal data.
- Update contracts to cover security safeguards, breach notification, purpose limitation, and deletion.
- Assess vendor security through a structured third-party risk management process.
- Track cross-border transfers and monitor any restrictions the government notifies for specific countries.
Phase 10: Significant Data Fiduciary Obligations (If Applicable)
- Appoint a Data Protection Officer based in India who reports to the board or equivalent governing body.
- Appoint an independent data auditor.
- Conduct Data Protection Impact Assessments and audits periodically as required by the Rules.
- Verify that algorithmic software used to process personal data doesn’t pose risks to Data Principals’ rights.
- Comply with any data localization requirements notified for specific categories of data.
Phase 11: Training and Ongoing Compliance
- Train employees, especially customer-facing, marketing, HR, and engineering teams.
- Embed privacy by design into product development and procurement.
- Review notices, consent flows, and records at least annually.
- Monitor updates from MeitY and the Data Protection Board.
DPDPA Penalties
The Schedule to the Act sets maximum penalties per instance of breach, determined by the Board after inquiry.
| Breach | Maximum Penalty |
|---|---|
| Failure to take reasonable security safeguards to prevent a personal data breach | ₹250 crore |
| Failure to notify the Board or affected Data Principals of a breach | ₹200 crore |
| Failure to meet obligations relating to children | ₹200 crore |
| Failure to meet additional obligations of Significant Data Fiduciaries | ₹150 crore |
| Breach of any other provision of the Act or Rules | ₹50 crore |
Common DPDPA Compliance Mistakes
- Treating it as a privacy policy rewrite. The Act requires operational changes to consent, security, rights handling, and retention.
- Copying GDPR documentation. There’s useful overlap, but DPDPA differs on legal bases, children’s age thresholds, penalties, and breach reporting.
- Ignoring unstructured data. Email inboxes, shared drives, and spreadsheets often hold the most uncontrolled personal data.
- Keeping data “just in case.” Indefinite retention increases breach impact and conflicts with erasure obligations.
- Leaving vendors out. You remain responsible for processing carried out on your behalf.
Startups can find a simpler roadmap in our DPDPA compliance guide for Indian startups. Organizations that want hands-on help can explore Securis360’s DPDP compliance services or the DPDPTool readiness platform.
Frequently Asked Questions
When does DPDPA compliance become mandatory?
The DPDP Rules were notified on 13 November 2025. Most substantive obligations for Data Fiduciaries apply 18 months later, from May 2027. Consent Manager provisions apply after 12 months, and Board-related provisions applied immediately.
Does DPDPA apply to companies outside India?
Yes, if they process digital personal data in connection with offering goods or services to individuals in India.
Is a Data Protection Officer mandatory under DPDPA?
Only Significant Data Fiduciaries must appoint a DPO based in India. Other Data Fiduciaries must publish the contact details of a person who can answer questions about their processing.
How quickly must a data breach be reported under DPDPA?
An initial intimation must go to the Data Protection Board without delay, followed by a detailed report within 72 hours of becoming aware of the breach, unless the Board permits a longer period. Affected individuals must also be informed without delay.
Is DPDPA compliance the same as GDPR compliance?
No. Both share principles such as purpose limitation and security, but DPDPA has different lawful grounds, treats everyone under 18 as a child, uses its own penalty structure, and has India-specific procedures. GDPR compliance is a helpful foundation, not a substitute.
Key Takeaways
- Core DPDPA obligations apply from May 2027, and preparation typically takes many months.
- Start with data discovery and mapping; every other step depends on it.
- Consent, security safeguards, breach notification, and retention require operational change, not just new documents.
- Vendors, children’s data, and legacy data are the most commonly overlooked areas.