DPDP Compliance Checklist

Document all categories of personal data your organization collects, including employee and customer data.

Map how personal data moves within and outside your organization, including third-party transfers.

Identify all physical and digital locations where personal data is stored, including cloud services.

Establish and document retention periods for each category of personal data collected.

Assess and document any transfers of personal data outside India and applicable safeguards.

Deploy a clear, affirmative consent mechanism for all data collection points.

Ensure consent notices are written in plain, understandable language (not legalese).

Provide consent notices in all 22 scheduled Indian languages as required by DPDP.

Allow users to provide separate consent for each purpose of data processing.

Implement an easy-to-use mechanism for data subjects to withdraw consent.

Maintain timestamped records of when and how consent was obtained from each data subject.

Enable data subjects to request and receive a summary of their personal data being processed.

Allow data subjects to request correction or completion of inaccurate personal data.

Provide a mechanism for data subjects to request deletion of their personal data.

Establish a process for data subjects to raise and resolve grievances regarding data processing.

Define and adhere to response timelines for data subject requests as per DPDP Act.

Implement strong encryption for personal data both at rest and during transmission.

Define and enforce role-based access controls for systems containing personal data.

Conduct periodic vulnerability assessments and penetration testing of data systems.

Implement techniques to de-identify personal data where full identification is not required.

Provide regular data protection and security awareness training to all employees.

Evaluate and monitor the security practices of all third-party data processors.

Define a formal process for conducting DPIAs for high-risk data processing activities.

Identify all processing activities that pose a high risk to data subjects' rights.

Document risk mitigation measures for each identified high-risk processing activity.

Schedule periodic reviews of DPIAs to account for changes in processing or risk profile.

Implement monitoring and alerting systems to detect personal data breaches promptly.

Establish a process to notify the Data Protection Board within the prescribed timeframe.

Define how and when affected data subjects will be notified in the event of a breach.

Designate and train a team responsible for managing data breach incidents.

Publish a comprehensive, DPDP-compliant privacy policy on your website.

Execute DPAs with all third-party processors handling personal data on your behalf.

Maintain up-to-date records of all personal data processing activities.

Appoint a DPO if required based on the volume and sensitivity of data processed.

Maintain records of all compliance training provided to employees.