DPDP Act 2023 Compliance Checklist
for Indian Businesses

We have a documented inventory of all personal data we collect (customer, employee, vendor) with source, purpose, and retention period.

We have mapped where personal data flows — from collection point, through systems, to third parties, to storage.

We have classified personal data by sensitivity (e.g. financial, health, Aadhaar-linked, children's data) with appropriate controls for each class.

We have a list of every vendor, processor, or SaaS tool that receives personal data on our behalf, with their role (Data Processor vs. Sub-Processor) identified.

We obtain explicit, purpose-specific consent before processing personal data, using plain-language notice in English plus regional languages where relevant.

We have a mechanism for users to withdraw consent as easily as they gave it — and systems that actually stop processing when they do.

We maintain an auditable log of when and how each consent was obtained (and later withdrawn).

For data about minors, we have a verifiable parental-consent workflow — and we do not do targeted advertising or behavioural monitoring on children.

We have a documented, tested process for Data Principals to request access, correction, completion, updating, and erasure of their data — with a published contact point.

We have a formal grievance-redressal mechanism with named owners and stated response SLAs (recommend: 7 days).

We can nominate another Data Principal in case of death or incapacity, as required for specific data categories.

We enforce Multi-Factor Authentication on every system that touches personal data — no exceptions for admin accounts.

We encrypt personal data in transit (TLS 1.2+) and at rest (database-level or field-level for sensitive attributes).

We apply the principle of least privilege — access to personal data is reviewed at least quarterly and revoked on role change or exit.

We have logging and monitoring that would detect unauthorised access to personal data within hours, not weeks.

We have appointed a Data Protection Officer (mandatory for Significant Data Fiduciaries; strongly recommended for others), with a published contact channel.

Our Board or leadership team reviews data-protection posture at least twice a year — with minuted decisions.

Every employee who handles personal data has had documented DPDP-awareness training within the last 12 months.

We have a written Incident Response plan that specifically covers personal-data breaches, with named responders, escalation paths, and communication templates.

We have tested the breach-notification workflow in a tabletop exercise in the last 12 months — and timed ourselves against the 72-hour notification window.