This DPDP compliance checklist is for small and medium businesses getting ready for India’s Digital Personal Data Protection (DPDP) Act, 2023 and the DPDP Rules, 2025. Work through it with whoever handles your customer data, IT and contracts. Items marked ★ carry the largest penalties or take the longest to put in place.
Where things stand (October 2026): the DPDP Rules were notified on 13 November 2025. Most duties for businesses, including notices, security safeguards, breach reporting, retention and data-subject rights, apply from mid-May 2027 (18 months after notification). Registration of consent managers starts around 13 November 2026. In January 2026 MeitY proposed shortening the timeline to 12 months; no amendment had been notified by October 2026, but plan as if the date could come sooner.
No exemption for small businesses yet: the Act lets the government exempt classes of businesses, including startups (section 17(3)), but no such notification is in force. MSME or Udyam registration does not exempt you.
Not sure where you stand? Take our free DPDP readiness check (21 questions) first, then use this list to close the gaps. This checklist is general guidance, not legal advice.
1. Know your personal data ★
- List every place you collect personal data: website forms, checkout, WhatsApp, e-mail, CRM, HR files, CCTV, call recordings, spreadsheets
- For each one, note what data, whose (customers, staff, children), why you collect it, where it is stored, who can access it and how long you keep it
- List every vendor that handles the data for you (hosting, e-mail, CRM, payroll, payment gateway, marketing tools). Under the Act they are your Data Processors
- Mark data stored or processed outside India (most cloud services)
- Delete data you don’t need. Data you don’t hold can’t leak
2. A lawful reason for every use
- Use consent, or one of the “legitimate uses” in section 7 of the Act (for example data a person gave you voluntarily for a specific purpose, employment, legal obligations or medical emergencies)
- Consent must be free, specific, informed, unconditional and unambiguous, given by a clear action such as ticking an empty box (section 6). No pre-ticked boxes, no “by using this site you agree”
- Ask only for the data the stated purpose needs
- Withdrawing consent must be as easy as giving it, and you must stop processing (and ask your processors to stop) after a withdrawal
- Keep a record of when and how each person consented
3. A clear privacy notice ★
Under section 5 and Rule 3, the notice you give when you collect data must:
- stand on its own and use clear, plain language
- list the personal data you collect, item by item, and the specific purpose for each
- describe the goods, services or uses the processing makes possible
- give a link or way to withdraw consent, exercise rights and complain to the Data Protection Board
- be available in English or any of the 22 languages in the Eighth Schedule of the Constitution if the person asks
Our free security policy generator creates a starting set of internal policies to go with your notice.
4. Reasonable security safeguards ★
Section 8(5) and Rule 6 set the minimum. Failing to take reasonable safeguards that leads to a breach carries a penalty of up to ₹250 crore. In practice:
- Encrypt or mask personal data: HTTPS everywhere, encrypted laptops and backups, masked card and Aadhaar numbers (Rule 6(1)(a))
- Control access: named accounts, least privilege, two-factor authentication on e-mail, cloud and admin panels, prompt removal of leavers (Rule 6(1)(b))
- Log and monitor access to personal data so you can detect, investigate and fix unauthorised access (Rule 6(1)(c))
- Keep running after an incident: tested backups and a recovery plan (Rule 6(1)(d))
- Keep logs for at least one year (Rule 6(1)(e)). CERT-In’s 2022 directions separately require ICT logs for 180 days, kept in India, so one year covers both
- Put security duties into every processor contract (Rule 6(1)(f))
- Check that it all actually happens: training, reviews and spot checks (Rule 6(1)(g))
For the technical side of your website, see our WordPress security checklist and run the free website safety check.
5. Contracts with vendors (Data Processors)
- Have a written contract with every processor before it handles personal data (section 8(2))
- The contract should cover the security safeguards, breach notice to you, deletion when the work ends, and sub-processors
- You stay responsible for what your processors do with the data, so check the big ones (hosting, CRM, payroll) once a year
6. Breach response plan ★
A personal data breach means any unauthorised processing, disclosure, loss of access or loss of data. Under section 8(6) and Rule 7 you must:
- Tell each affected person without delay, through their account or the contact details you hold: what happened and when, the likely consequences for them, what you are doing about it, what they can do to protect themselves, and who to contact
- Tell the Data Protection Board without delay with a description of the breach (nature, extent, timing, location and likely impact)
- Send the Board a detailed report within 72 hours (or longer if the Board allows it on request): updated facts, the cause, what you have done to limit the damage, who caused it if known, how you will stop it happening again, and a report on the notices you sent to people
- Report cyber incidents to CERT-In within 6 hours of noticing them (CERT-In directions of 28 April 2022). This runs alongside the DPDP notices
- Name who decides, who writes the notices and who talks to customers, and keep the contact details somewhere you can reach offline
- Practise once a year with a short tabletop exercise
Failing to notify a breach can cost up to ₹200 crore.
7. Retention and deletion
- Set a retention period for each type of data and delete it once the purpose is served or consent is withdrawn (section 8(7))
- Make your processors delete it too
- Keep the logs of that processing for at least one year (Rule 8)
- Large platforms named in the Third Schedule (e-commerce with 2 crore+ users, online gaming with 50 lakh+ users, social media with 2 crore+ users) also have a 3-year inactivity limit and must warn users 48 hours before deletion. Most SMBs are below these thresholds
8. Rights requests and grievances ★
- Publish the contact details of a person who can answer questions about personal data (your Data Protection Officer if you have one) on your website or app (Rule 9)
- Explain on your website how people can ask to access, correct, update or erase their data, and how to nominate someone to act for them
- Answer grievances within a reasonable time, at most 90 days (Rule 14). Aim for much faster
- Check the identity of the person asking before you share or change anything
- Keep a simple log of every request and how and when you answered it
9. Children and persons with disability
- If anyone under 18 may use your service, get verifiable consent from a parent before processing their data (section 9, Rule 10): check that the parent is an identifiable adult using details you already hold or a trusted provider such as DigiLocker
- No tracking, behavioural monitoring or targeted advertising aimed at children
- Some organisations and purposes are exempt for limited uses (Fourth Schedule), for example schools, clinics, crèches and child transport. Check whether one applies to you
- For a person with a disability who has a lawful guardian, verify the guardianship before relying on the guardian’s consent (Rule 11)
10. Data leaving India
- Transfers abroad are allowed unless the government restricts a country (section 16). No restriction list had been notified by October 2026
- Keep your list of where each vendor stores data up to date, so you can react quickly if restrictions appear
11. People, policies and ownership
- Name one person who owns DPDP compliance, even in a five-person business
- Write short policies for data protection, access control, retention and incident response, and get staff to read them. Our policy generator gives you a first draft
- Train staff once a year on phishing, handling customer data and how to report a mistake
- Review this DPDP compliance checklist every six months and after any big change (new app, new vendor, new market)
- Significant Data Fiduciaries (businesses the government notifies because of the volume or sensitivity of their data) also need a Data Protection Officer based in India, an independent auditor and yearly impact assessments. Small businesses are normally not notified
DPDP compliance checklist timeline
| When | What applies |
|---|---|
| 13 Nov 2025 | DPDP Rules notified; the Data Protection Board provisions start |
| ~13 Nov 2026 | Consent managers can register with the Board (Rule 4) |
| ~13 May 2027 | Notices, consent, security safeguards, breach reporting, retention, rights, children’s data and the rest of the business duties (Rules 3, 5–16) |
Maximum penalties
| Failure | Up to |
|---|---|
| Reasonable security safeguards (section 8(5)) | ₹250 crore |
| Breach notification (section 8(6)) | ₹200 crore |
| Children’s data (section 9) | ₹200 crore |
| Significant Data Fiduciary duties (section 10) | ₹150 crore |
| Any other breach of the Act or Rules | ₹50 crore |
Want help with your DPDP compliance checklist? We help small businesses map their data, close security gaps and write the notices and policies the Act expects. Get in touch, or start with the free DPDP readiness check. More checklists are on our free resources page.
Sources
- Digital Personal Data Protection Act, 2023: section 8 (duties of Data Fiduciaries) and the Schedule (penalties), unofficial consolidated text
- Digital Personal Data Protection Rules, 2025 (MeitY, G.S.R. 846(E))
- PIB: Government notifies the DPDP Rules, 2025
- CERT-In Directions of 28 April 2022
- Chambers: MeitY proposal to shorten the DPDP timeline (February 2026)
Last updated: 27 October 2026. This checklist is general information, not legal advice. For decisions about your business, speak to a lawyer.