DPDP Compliance Checklist for Indian Businesses: What to Do Before November 2026, Before May 2027 and After

Who does the DPDP compliance checklist apply to?

The Act applies to processing of digital personal data within India, and to processing outside India connected with offering goods or services to people in India (s.3). There is no revenue, turnover or employee threshold. A ten-person Bengaluru SaaS company and a Hyderabad hospital group carry the same core duties, so the same DPDP Act compliance checklist applies to both.

The duties fall on the data fiduciary, which is whoever decides the purpose and means of processing (s.2(i)). A data processor processes on a fiduciary’s behalf (s.2(k)) and has no direct duties under the Act. Its exposure comes through its contracts. If you are unsure which role you play for a given data set, see our guide on data fiduciary vs data processor roles before working through this list.

Two partial carve-outs are worth knowing. Under s.17(3), the Central Government may notify certain fiduciaries, including recognised startups, to whom s.5, s.8(3), s.8(7), s.10 and s.11 will not apply. As of October 2026 no such notification is known, and even if one is issued it would not lift the security, breach or vendor-contract duties. Under s.17(1)(d), an Indian company processing only non-residents’ data under a contract with a foreign party is exempt from most of Chapter II, but s.8(1) and s.8(5) still apply.

Phase 1: what to do now and before 13 November 2026

On 13 November 2026, s.6(9) and s.27(1)(d) come into force, together with Rule 4. These let consent managers register with the Data Protection Board. A consent manager must be a company incorporated in India with a net worth of at least ₹2 crore (First Schedule, Part A). Most businesses do not need to become one. Section 6(7) lets a Data Principal give, manage, review or withdraw consent through a consent manager, so how far a fiduciary must support one is not yet settled. The real value of this phase is that it is the last comfortable point to start the work that must be finished by May 2027.

• Build a data inventory: what personal data you hold, whose it is (customers, staff, children), why you hold it, where it sits and which vendors receive it. This underpins every later item. Recommended practice.
• Map each data set to a lawful basis: consent under s.6 or a legitimate use under s.7 (for example, employment purposes or a voluntarily provided purchase).
• List every vendor that touches personal data, with renewal dates. Contracts signed now will run past 13 May 2027.
• Decide how you will handle consent given or withdrawn through a registered consent manager (s.6(7)); how far a fiduciary must integrate with one is not yet settled.
• Name an internal owner for DPDP work and a budget. Recommended practice.

Phase 2: what must be working by 13 May 2027

Under paragraph (c) of G.S.R. 843(E), ss.3 to 5, s.6(1) to (8) and (10), ss.7 to 17, s.27 (except (1)(d)), ss.28 to 34, 36, 37 and 44(2) commence eighteen months after 13 November 2025. That is 13 May 2027 as of October 2026. Rules 3, 5 to 16, 22 and 23 start on the same day. This is the main DPDP compliance requirements date, and the items below are the core data fiduciary obligations.

• Notice (s.5, Rule 3): a standalone notice in clear and plain language with an itemised description of the data, the specified purpose, and a link to withdraw consent, exercise rights and complain to the Board.
• Existing users (s.5(2)): where consent was given before commencement, send a notice as soon as reasonably practicable.
• Consent (s.6): free, specific, informed, unconditional and unambiguous, limited to data necessary for the purpose, and as easy to withdraw as to give (s.6(4)).
• Withdrawal (s.6(6)): stop processing within a reasonable time and cause your processors to stop.
• Accuracy (s.8(3)): keep data complete, accurate and consistent where it drives a decision about the person or is shared with another fiduciary.
• Security (s.8(5), Rule 6): encryption, masking or tokenisation; access control; logs and monitoring; backups; one-year retention of logs; a security provision in processor contracts; technical and organisational measures.
• Breach process (s.8(6), Rule 7): tell each affected person without delay, tell the Board without delay, and send the Board a detailed report within 72 hours of becoming aware.
• Erasure (s.8(7), Rule 8): erase when consent is withdrawn or the purpose is no longer served, and cause processors to erase, unless law requires retention.
• Contact person (s.8(9), Rule 9): publish the business contact of a DPO, if applicable (a DPO is mandatory only for a Significant Data Fiduciary under s.10(2)(a)), or of a person who can answer questions about processing.
• Grievance (s.8(10), s.13, Rule 14(3)): publish a response period of not more than ninety days and build the process to meet it.
• Rights (ss.11 to 14, Rule 14): publish how people can request access, correction, completion, updating, erasure and nomination.
• Children (s.9, Rule 10): verifiable parental consent, no detrimental processing, and no tracking, behavioural monitoring or targeted advertising directed at children.
• Vendors (s.8(1), s.8(2), Rule 6(1)(f)): a valid contract with each processor, including a security provision.

How long must you keep logs, and when must you erase?

Two rules pull in opposite directions, and both need to be in your retention policy. Rule 6(1)(e) and Rule 8(3) require you to keep personal data, associated traffic data and processing logs for at least one year from the date of processing, including processing by a processor. Illustration Case 2 to Rule 8 makes the point directly: a company using a cloud provider must ensure the provider also keeps the data and logs for a year.

Section 8(7) then requires erasure once consent is withdrawn or the purpose is no longer served, unless another law requires retention. For large e-commerce platforms and social media intermediaries with at least 2 crore registered users in India, and online gaming intermediaries with at least 50 lakh, Rule 8(1) and the Third Schedule set a three-year inactivity period, with at least 48 hours’ notice before erasure under Rule 8(2). The practical answer is a retention schedule per data set that respects the one-year floor, any sectoral law (banking KYC is the common example) and the erasure trigger.

The breach process, step by step

Rule 7 sets two tracks once you become aware of a personal data breach. To each affected person, without delay and in plain language: what happened, the likely consequences, what you are doing, what they can do, and a contact. To the Board: a description without delay, then within 72 hours a detailed report covering facts, causes, mitigation, findings on who caused it, remedial steps and a report on the intimations sent to individuals.

The 72 hours runs from your awareness, not your vendor’s. The Act and Rules set no deadline for a processor to tell you, so any vendor notice period, whether 24 or 48 hours, is a contractual term and recommended practice. Our guide on breach notification covers drafting that clause and running the first 72 hours.

Vendor contracts: the 24-point checklist

Section 8(1) makes you responsible for processing done on your behalf, irrespective of any agreement to the contrary. Section 8(2) lets you engage a processor only under a valid contract. The Act does not prescribe a written data processing agreement, but a written DPA is the practical way to show the contract is doing its job. The table summarises the 24 checks we apply. Six are required by the Act or Rules; eighteen are recommended practice. You can download the PDF checklist on this page for use in vendor reviews, and see our guides on section 8, on data processing agreement clauses, and our free data processing addendum template.

Extra duties for Significant Data Fiduciaries and cross-border transfers

The Central Government may notify a fiduciary or class as a Significant Data Fiduciary (SDF) under s.10, based on factors such as the volume and sensitivity of data and risk to individuals. An SDF must appoint a DPO based in India, appoint an independent data auditor, and carry out periodic Data Protection Impact Assessments and audits. Rule 13 makes the DPIA and audit annual, requires a report of significant observations to the Board, requires due diligence on algorithmic software, and allows the government to require specified personal data and its traffic data to stay in India. Check whether any notification names you or your sector.

For cross-border transfers, s.16 works as a negative list: transfer is allowed except to countries the government restricts by notification. Rule 15 adds that you must meet any requirements the government specifies about making data available to a foreign State. Stricter sectoral rules, such as RBI payment data localisation, still apply under s.16(2). A Pune payroll vendor using a cloud region in Singapore is not breaking the Act, but its contract should say where data lives.

Phase 3: the ongoing checklist after May 2027

• Review the data inventory at least yearly and whenever a new product or vendor is added. Recommended practice.
• Test the breach process with a tabletop exercise that includes a key vendor. Recommended practice.
• Track grievance response times against the period you published under Rule 14(3).
• Re-check vendor contracts at each renewal against the 24-point list.
• Run erasure jobs on schedule and keep evidence that processors erased data (s.8(7)(b)).
• Watch for notifications on SDFs (s.10), transfer restrictions (s.16), startup exemptions (s.17(3)) and any change to commencement dates.
• Remember the penalties: up to ₹250 crore for failing to take reasonable security safeguards and up to ₹200 crore for failing to notify a breach, maximums imposed by the Board after an inquiry, only where it finds the breach significant (s.33(1)), and, as of October 2026, only from 13 May 2027. Our guide on DPDP penalties covers how amounts are set, and our enforcement timeline guide tracks the dates.

Why check your vendor contracts with ClauseAudit before 13 May 2027?

Your vendor contracts are the hardest part of this list to do quickly. Under s.8(1) you answer for what your processors do, whatever the contract says. A security failure can attract a penalty of up to ₹250 crore. Many vendor agreements signed before the Rules were published in November 2025 are likely to say nothing about DPDP.

You have three honest options. An advocate’s review is thorough and the right choice for material deals, but it is slower and costs more per contract. A free checklist, including the one on this page, is fast, but you still have to read every clause yourself and judge each gap. ClauseAudit’s DPDP Compliance Check sits between them. It reads the whole agreement, schedules included, in minutes, for ₹999 per contract. Each finding is tied to the section or rule, or marked recommended practice. You get the clause quoted, a suggested fix, a redline and a negotiation email. You can review as the customer or as the vendor, and the document is not stored after the review.

It is an AI-assisted review and can miss things. For large or sensitive deals, children’s data at scale, or regulated sectors such as banking, insurance and health, have an advocate review the contract.