DPDPA Compliance Checklist: 20 Things to Complete Before Enforcement Begins

As the DPDP Rules and enforcement framework continue to develop, organisations are increasingly shifting focus from understanding the requirements to preparing for practical compliance and enforcement. This is a useful point for any organisation, regardless of how far its DPDPA programme has progressed, to work through a structured DPDPA compliance checklist covering the full set of requirements.

The twenty requirements are not necessarily separate compliance activities. A structured approach can help organisations build the foundation first, followed by consent, data rights, security and documentation. This can also reduce duplication and unnecessary rework.

The following checklist organises the key activities into a practical implementation sequence.

Start With the Foundation: Everything Else Depends on This

Before touching a single consent banner, organisations need to know exactly what they are dealing with.

1. Determine the organisation's role. Organisations should assess whether they operate as a Data Fiduciary, a Data Processor, or both. Under the DPDPA, a Data Fiduciary is any person who alone or in conjunction with others determines the purpose and means of processing personal data (Section 2(i)). A Data Processor is any person who processes personal data on behalf of a Data Fiduciary (Section 2(k)). This distinction is important because the responsibilities associated with each role can differ. Organisations that operate as both Data Fiduciaries and Data Processors should assess their activities separately.

To understand this in depth, read the full blog: Data Fiduciary vs Data Processor vs Data Principal: Who Is Who Under DPDPA?

2. Map the data. Every system, every database, every third-party tool that touches personal data needs to be identified and located. Data mapping can require significant effort, particularly for organisations operating across multiple systems and third-party services. However, understanding where personal data is collected, stored, transferred and processed is an important part of establishing effective data governance.

3. Identify the applicable legal basis for processing. Organisations should assess whether they are relying on consent under Section 6 or one of the legitimate use grounds under Section 7. Different activities will require different bases, and each processing activity should have a clear documented basis. The DPDP Rules, 2025 require that the legal basis for each processing activity be clearly established.

4. Assess whether the organisation is a Significant Data Fiduciary. Under Section 10 of the DPDPA, the Central Government may designate any Data Fiduciary as a Significant Data Fiduciary based on factors including the volume and sensitivity of personal data processed, risk to the rights of Data Principals, potential impact on the sovereignty and integrity of India, risk to electoral democracy, security of the State, and public order. SDF designation carries additional obligations, including appointment of a Data Protection Officer, independent data audits, and Data Protection Impact Assessments. Organisations that may meet the SDF criteria should assess their position and prepare for the additional governance requirements associated with designation.

Build the Consent Infrastructure

Once the foundation is solid, this is where most of the visible work happens.

5. Design consent around specific purposes. Consent mechanisms should communicate the purpose for which personal data is being processed and provide Data Principals with a meaningful choice where consent is the applicable basis. Under the DPDP Rules, 2025, consent must be free, specific, informed, unconditional, and unambiguous, given through a clear affirmative action. Pre-ticked boxes and bundled consent forms are not valid consent under the framework.

6. Create clear and accessible notices. Notices should communicate the required information in a manner that Data Principals can reasonably understand. Under Rule 3 of the DPDP Rules, 2025, notices must be presented independently of other information, in clear and plain language, and include an itemised description of the personal data and the specified purpose.

7. Deploy a Consent Management Platform. At scale, manual consent tracking can become difficult to maintain and audit. A Consent Management Platform can provide structured mechanisms for recording, managing and reviewing consent. For organisations managing consent at scale, a Consent Management Platform can become an important part of the compliance infrastructure.

8. Ensure withdrawal is as accessible as consent. Consent withdrawal should be designed to remain as accessible as the original consent process. If consent is obtained through a single-step interaction, withdrawal cannot be shrouded in layered navigation or procedural friction. Organisations should avoid creating unnecessary friction when Data Principals choose to withdraw consent.

9. Issue notices to existing customers. Organisations should assess how the DPDPA notice requirements apply to personal data already held in their systems and determine the appropriate approach for existing Data Principals. Notices must be provided in clear and plain language and should include mechanisms for withdrawal of consent and grievance redressal.

Build Rights and Governance Alongside the Consent Work

These can run in parallel with the section above rather than waiting for it to finish.

10. Establish the required grievance redressal mechanism. Under the DPDPA, every Data Fiduciary must publish the contact details of a Grievance Officer or a person able to answer questions raised by Data Principals. This should be a real person, with published contact information, who can be reached by Data Principals.

11. Build the Data Principal rights request process. Organisations should document workflows and timelines for access requests, correction requests, deletion requests, and nomination requests. This includes establishing a structured Data Principal rights management process instead of case-by-case handling.

12. Set retention policies. Retention periods should be defined with clear limits based on applicable legal, regulatory and business requirements, avoiding indefinite retention by default. Under Section 8(7) of the DPDPA, Data Fiduciaries must establish a data retention schedule and conduct periodic reviews.

13. Ensure deletion capabilities. Organisations should understand how deletion requests are handled across primary systems, backups, analytics environments and third-party processors, including any applicable retention or technical limitations. Section 8(7) requires Data Fiduciaries to erase personal data once consent is withdrawn or the specified purpose is served.

14. Build nominee registration. Data Principals need a way to nominate someone to exercise their rights on their behalf, particularly relevant in cases of incapacity or death. The right to nominate is a distinctive feature of the DPDPA and does not have a direct equivalent in the GDPR in the same form.

Lock Down the Technical Security Side

15. Implement reasonable security safeguards. Organisations should implement appropriate technical and organisational safeguards, including access controls, encryption where appropriate, security testing and monitoring. Under Section 8(5) of the DPDPA, Data Fiduciaries must implement reasonable security safeguards to prevent personal data breaches. Rule 6 of the DPDP Rules, 2025 provides operational clarity on what these safeguards entail, including encryption of personal data, data masking, access controls, and continuous monitoring and logging.

16. Build breach response capabilities. Organisations should establish detection systems and a notification process that has been tested through simulated breach scenarios, with documentation kept as evidence of that testing. Under Section 8(6) of the DPDPA, Data Fiduciaries must notify the Data Protection Board and affected Data Principals in the event of a personal data breach. Rule 7 of the DPDP Rules, 2025 sets out detailed breach reporting requirements.

17. Review cookies and tracking technologies. Organisations should review cookies and similar tracking technologies used across their websites and applications and assess the applicable consent and disclosure requirements. Cookies and tracking technologies that collect personal data are subject to the same consent standard as any other personal data collection.

Tie It Together With Documentation

18. Build or update the Record of Processing Activities. Every processing activity, its legal basis, and its retention period should be appropriately documented, forming the basis of a reliable DPDPA audit trail if a regulator requests it.

19. Review vendor contracts. Existing vendor and processor agreements should be reviewed to determine whether updates are required to reflect applicable DPDPA obligations. Third-party processors need appropriate data protection clauses in their agreements.

20. Train employees. Technology and documentation alone are not sufficient. Employees who handle personal data should understand their responsibilities and the organisation's data protection procedures.

How to Approach the DPDPA Compliance Checklist

Twenty requirements can appear significant when viewed as a single list. However, they do not all need to be addressed simultaneously. Working through them in a structured sequence, foundation first, then consent, then rights and governance, then security, then documentation, can make the process more manageable.

The implementation timeline will depend on the organisation's size, data environment, existing controls, technology infrastructure and level of regulatory readiness. A structured implementation approach can help organisations identify gaps, prioritise high-risk activities and establish the governance capabilities required to support ongoing DPDPA compliance.

Turning This Checklist Into a DPDPA Compliance Programme

For organisations looking to strengthen the consent and data-rights side of their DPDPA programme, a DPDPA compliance platform can help centralise consent records, withdrawal requests, notices and related compliance evidence. OneConsent provides a consent-first approach that supports organisations in managing these processes across digital and operational touchpoints.

Learn more about how OneConsent supports DPDPA compliance.

To see how these twenty requirements map to your existing systems, book a demo.