India’s Digital Personal Data Protection Act, 2023 (DPDPA) applies to any organisation processing the digital personal data of individuals in India. Use this checklist to move from “aware” to audit-ready.
1. Map what you hold
You can’t protect what you can’t see. Inventory your data sources, discover personal data across databases, SaaS and warehouses, and classify it. This is the foundation of every other obligation.
2. Establish a lawful basis
Under the DPDPA, processing rests on consent or on certain legitimate uses. For consent, you must provide a clear, itemised notice (what, why, and how to withdraw) in English or a listed Indian language.
3. Give a compliant notice
- Itemised description of the personal data and purposes
- How to exercise rights and withdraw consent
- How to complain to the Data Protection Board
4. Operationalise data-principal rights
Stand up workflows for access, correction, erasure, grievance redressal and nomination — with clear turnaround times and an audit trail. See data-principal rights.
5. Govern consent withdrawal
Withdrawal must be as easy as giving consent, and you must stop processing (and have processors stop) once it’s withdrawn.
6. Secure the data & manage processors
Implement reasonable security safeguards, and bind every processor with a contract. You remain accountable for your processors.
7. Prepare breach response
Be ready to notify the Data Protection Board and affected data principals of a personal-data breach. Pre-build the playbook and the notification templates — see breach response.
8. Handle children’s data carefully
Verifiable parental consent is required, and tracking, behavioural monitoring and targeted advertising to children are prohibited. See children’s data.
9. Know if you’re a Significant Data Fiduciary
SDFs (by volume/sensitivity/risk) have extra duties: appoint a DPO in India, conduct DPIAs and independent data audits.
Run the free DPDPA assessment to score your readiness across 12 domains and get a tailored document pack in two minutes.