DPDP Compliance Checklist

Check whether you process digital personal data of people in India, or offer goods or services to them.

Your role decides which duties fall on you and which sit in contracts with vendors.

List categories, where they are stored, who can access them and how they were collected.

Trace each flow from collection to deletion, including vendors, tools and transfers outside India.

Each request for consent needs a notice that lists the data, the purpose and how to exercise rights.

Consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action.

Offer a clear, visible way to withdraw, and stop processing when consent is withdrawn.

Where you do not rely on consent, record which legitimate use applies and why.

You may need to show what a person was told and what they agreed to, and when.

Decide who receives requests for access, correction and erasure, how identity is checked, and how fast you reply.

Show the title and contact details of the person who answers questions about personal data.

Have a clear route, a record of complaints and a commitment on reply times.

Let people name someone to act for them on death or incapacity.

Work out how you will check that the adult is who they say they are.

Check analytics, ad tools and recommendation features for child users.

Encryption, access control, logging, backups and monitoring suited to the data you hold.

Agree who investigates, who decides, and how you contain and record a breach.

Draft templates and a timeline for intimation after a breach.

You stay responsible for processing done on your behalf, so contracts must bind processors to your duties.

Set a period for each data category and check that old data is really removed.

Include backups, vendors and processors, and tell them to delete too.

Keep policies, decisions, training and audit records in one place.

These include a Data Protection Officer, an independent audit and impact assessments.

Cover consent, requests, security habits and who to tell when something goes wrong.