DPDPA Compliance: The Complete Guide and Checklist

What is the DPDPA?

The Digital Personal Data Protection Act, 2023 (DPDPA or DPDP Act) is India's first comprehensive law governing how digital personal data is processed. It received Presidential assent on 11 August 2023. The Digital Personal Data Protection Rules, 2025, notified on 13 November 2025, set out how the Act works in practice.

The law rests on a simple idea: individuals have a right to protect their personal data, and organisations have a legitimate need to process it. The DPDPA balances the two by requiring organisations to be clear about why they collect data, to collect only what they need, to keep it safe, to delete it when the purpose is over, and to answer to individuals and to a regulator when things go wrong.

Seven principles behind the law

Key terms you need to know

Who does the DPDPA apply to?

The DPDPA applies to any organisation that processes digital personal data in India, and to organisations outside India that process data in connection with offering goods or services to people in India. Size, sector and turnover do not create an exemption.

Two grounds for processing

A Data Fiduciary can process personal data only on one of two grounds:

• Consent given by the Data Principal for a specified purpose, or
• Certain legitimate uses listed in Section 7, such as data the person voluntarily provided for a specific purpose without objecting, legal obligations, medical emergencies, disaster response, and specific employment purposes.

Legitimate uses are narrow. Marketing, profiling, analytics and sharing with partners for their own purposes will usually need consent.

Key dates and timeline

The DPDP Rules, 2025 bring the Act into force in three phases over 18 months. Most substantive obligations apply from 13 May 2027, which leaves limited time for organisations with many systems and vendors.

Key obligations under the DPDPA

Most obligations fall on the Data Fiduciary. They are spread across the Act and the Rules, but group neatly into the areas below. Each area is covered in detail later in this guide.

Duties of Data Principals

The DPDPA also places duties on individuals. They must not impersonate another person, suppress material information when providing data for official documents, or file false or frivolous grievances. A breach of these duties can attract a penalty of up to ₹10,000.

Penalties for non-compliance

The Data Protection Board can impose financial penalties per instance of breach, after an inquiry. When deciding the amount, the Board considers the nature, gravity and duration of the breach, the type of data affected, repetition, any gain or loss caused, and the steps taken to mitigate it.

Beyond penalties, the real costs are operational. A complaint triggers an inquiry that asks for evidence. Organisations that cannot show where data lives, what consent was taken, who it was shared with and how a request was handled will struggle to defend themselves, whatever their intent.

Data discovery: you cannot protect what you cannot find

Data discovery is the process of scanning your systems to find where personal data is stored, what types exist and how much of it there is. The DPDPA does not use the term, but almost every obligation depends on it.

You cannot write an accurate notice, apply retention, answer an access request, erase data or scope a breach without knowing where personal data sits. In practice, personal data spreads far beyond the core application: shared drives, email attachments, spreadsheets on laptops, log files, backups, test environments and SaaS tools all hold copies.

What good data discovery looks like

• Structured and unstructured coverage: databases as well as documents, spreadsheets, PDFs, images and email stores.
• India-specific identifiers: Aadhaar, PAN, voter ID, passport, driving licence, UPI IDs, IFSC and bank account numbers, not only generic patterns.
• Agent and agentless scanning: agentless connectors for servers and cloud, plus agents for endpoints where most shadow data lives.
• Confidence scores and custom classes: so teams can prioritise real findings and add business-specific data types.
• Scheduled rescans with drift detection: new tables and new file shares appear every week.
• Findings linked to owners and purposes: discovery is only useful once it feeds the processing record.

Privacy assessments

Assessments tell you where you stand and what to fix first. Three types matter under the DPDPA: the gap assessment, the Data Protection Impact Assessment (DPIA) and the vendor risk assessment.

How to run an effective gap assessment

1. Appoint a privacy owner with authority across functions.
2. Hold a kickoff with department heads so each function knows why the assessment matters.
3. Send function-specific questionnaires to IT, HR, Marketing, Sales, Customer Support, Finance, Legal and Procurement. A generic form misses what each team actually does with data.
4. Validate answers with evidence and short interviews, not just self-declaration.
5. Produce a gap register mapped to the obligations in the Act and Rules, with risk ratings.
6. Agree a roadmap with owners and target dates against the May 2027 deadline, and get senior management approval.

Consent management

Consent is the primary ground for processing under the DPDPA. It is also the obligation most likely to touch every customer-facing system you run, from websites and apps to branches, call centres and dealer networks.

What valid consent looks like

Under Section 6, consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the personal data necessary for the specified purpose. In practice:

• No pre-ticked boxes and no consent bundled into terms and conditions.
• Separate consent for each purpose beyond the core service, such as marketing or sharing with partners.
• Withdrawal must be as easy as giving consent, and must stop processing within a reasonable time, including at processors.
• The burden of proving that notice was given and consent was obtained sits with the Data Fiduciary.

The hard part: making consent work downstream

Capturing consent on a website is the easy part. The real work is ensuring every downstream system, from CRM and marketing automation to analytics and partner integrations, checks consent before processing and stops when it is withdrawn. Without this, a withdrawal on the website does nothing to the campaign that runs tomorrow.

Cookie consent

Cookies and similar trackers that collect personal data need consent too. Non-essential cookies such as analytics and marketing should be blocked until the visitor agrees, preferences should be granular by category, and every choice should be logged.

Consent Managers

From 13 November 2026, Consent Managers can register with the Board. They give Data Principals a single interoperable platform to give, manage and withdraw consent across Data Fiduciaries, and must keep consent records for at least seven years. Data Fiduciaries should be ready to accept consent through a Consent Manager where Data Principals choose to use one.

Notices

A notice tells the Data Principal what you are collecting, why, and what they can do about it. Under Section 5 and Rule 3, it must accompany or precede every request for consent.

Existing customers and employees

Where consent was given before the DPDPA commenced, the Data Fiduciary must give a notice to those Data Principals as soon as reasonably practicable. For organisations with millions of legacy records, this is a campaign in its own right, sent through SMS, email or WhatsApp, with responses captured and logged.

Processing activities and the Record of Processing Activities (RoPA)

The DPDPA does not use the term RoPA. It does, however, give Data Principals the right under Section 11 to obtain a summary of the personal data processed, the processing activities undertaken, and the identities of every Data Fiduciary and Data Processor with whom their data was shared. You can only answer that question if you keep a record.

A RoPA is the register that links each processing activity to the systems involved, the data categories, the purpose, the legal ground, the recipients, the retention period and the safeguards applied. It is the backbone that connects discovery, consent, rights and retention.

What a good RoPA entry captures

Data Principal requests

The DPDPA gives every Data Principal a set of rights. Data Fiduciaries must publish how to exercise them, identify the requester, and respond within the period they publish, which cannot exceed 90 days under the Rules.

Grievances

Section 13 requires every Data Fiduciary to provide a readily available means of grievance redressal. A Data Principal must exhaust this route before approaching the Data Protection Board, so your grievance process is the first line of defence against regulatory complaints.

• Publish contact details of your Data Protection Officer or a designated person who can answer questions about processing, prominently on your website and app, and in every response.
• Publish your response period and respond within it. The Rules cap it at 90 days. Aim much shorter.
• Track every grievance from receipt to closure with timestamps, owners and resolution notes.
• Analyse root causes. Repeated grievances about the same journey point to a broken notice, a consent flow or a vendor.
• Escalate unresolved or sensitive grievances to the DPO and legal team before deadlines are missed.

Security safeguards

Failure to take reasonable security safeguards carries the highest penalty under the DPDPA: up to ₹250 crore. Rule 6 sets out the minimum measures every Data Fiduciary must implement, including for data processed by its processors.

Certifications such as ISO 27001 are not mandatory under the DPDPA, but they provide a strong, recognised framework for demonstrating reasonable security.

Breach management

A personal data breach is any unauthorised processing, accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data that compromises its confidentiality, integrity or availability. Under Rule 7, the clock starts when you become aware of it.

Building breach readiness

1. Write a breach response plan with roles, decision rights, contact lists and templates for the Board and for Data Principals.
2. Connect it to your security operations so incidents involving personal data are flagged immediately, not after an IT investigation closes.
3. Use your data map to work out quickly which people and which data categories are affected.
4. Require processors to notify you promptly in their contracts, because their breach is your breach.
5. Align with CERT-In reporting, which runs in parallel for cyber incidents.
6. Run tabletop exercises at least once a year and fix what they reveal.

Children's data

Under the DPDPA, a child is anyone under 18. That is a higher age than many global laws, so many services that assumed they had no child users will need to look again.

Children's data obligations carry penalties of up to ₹200 crore. Platforms with large youth audiences, such as social media, gaming, edtech and streaming services, should treat age assurance and parental consent as a product design problem, not just a legal one.

Data retention

The DPDPA does not set a single retention period. Section 8(7) requires you to erase personal data once the Data Principal withdraws consent or the specified purpose is no longer being served, whichever is earlier, unless a law requires you to keep it.

What the Rules add

• One-year minimum: all Data Fiduciaries must retain personal data, associated traffic data and processing logs for at least one year from processing, for purposes listed in the Seventh Schedule, such as investigations.
• Three-year inactivity rule: large e-commerce entities and social media intermediaries (two crore or more registered users in India) and online gaming intermediaries (fifty lakh or more) must treat the purpose as served once a user has not engaged for three years, and erase the data.
• 48-hour warning: those entities must tell the user at least 48 hours before erasure that the data will be deleted unless they log in or otherwise engage.

Building a retention programme

1. Build a retention schedule per data category and purpose, citing the legal basis for each period, such as tax, RBI, SEBI or IRDAI requirements.
2. Identify legal holds that pause erasure.
3. Automate erasure triggers in each source system, including backups and archives where practical.
4. Instruct processors to erase in parallel, and obtain confirmation.
5. Log every erasure as evidence.

Vendor management

Under Section 8, the Data Fiduciary remains responsible for compliance even when a Data Processor does the processing. Your payroll provider, cloud host, call centre, marketing agency and SMS gateway are all part of your DPDPA perimeter.

What every processor contract should cover

• Processing only on documented instructions and only for the agreed purpose
• Rule 6 security safeguards, including encryption, access control and log retention
• Prompt breach notification to you, with the detail you need for your own 72-hour report
• Support for Data Principal requests, including correction and erasure
• Erasure or return of data at the end of the engagement or when consent is withdrawn
• Sub-processor approval and flow-down of the same obligations
• Audit rights and evidence on request

Cross-border data transfers

The DPDPA takes a permissive approach. Personal data can be transferred outside India unless the Government restricts transfers to a particular country by notification.

• Transfers must still meet any requirements the Government sets under the Rules, including conditions on making data available to foreign states.
• Sector rules that are stricter still apply. RBI payment data localisation, for example, continues alongside the DPDPA.
• Significant Data Fiduciaries may be required to keep specified categories of personal data within India, based on the recommendations of a Government committee.
• Record every cross-border flow in your RoPA, including the destination country, the recipient and the safeguards.

Significant Data Fiduciaries

The Government can notify any Data Fiduciary, or class of Data Fiduciaries, as a Significant Data Fiduciary based on the volume and sensitivity of data processed, the risk to Data Principals, and wider impacts on sovereignty, security and public order. Large banks, insurers, telecoms, platforms and healthcare providers should prepare on the assumption that they will qualify.

Audit evidence

Compliance that cannot be proven does not count. Section 6(10) puts the burden of proving that notice was given and consent was obtained squarely on the Data Fiduciary. The same logic applies when the Board inquires into a complaint or a breach.

Your evidence pack should include

DPDPA compliance checklist

Use this checklist to track your progress. Tick items as you complete them. Your progress is saved in this browser only.

How Atlas Privacy Manager helps

Atlas Privacy Manager covers the entire DPDPA journey in one platform, from the first gap assessment to everyday consent, rights and breach operations. Each module maps directly to the obligations in this guide.

Deployed your way

Atlas Privacy Manager is built by FRS Labs, an ISO 27001 and ISO 9001 certified company that has served more than 250 enterprises across banking, insurance, telecom and government since 2010. Licensing is a simple annual subscription, sized to your needs.

Frequently asked questions

This guide is for general information about the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 as of November 2026. It is not legal advice. Please consult qualified legal counsel for advice on your specific circumstances.