When do the DPDPA obligations apply?

DPDPA section 1(2) provides that different provisions come into force on the dates the Central Government appoints by notification. Check the commencement notifications and the DPDP Rules for the dates that apply to your organisation.

What are the penalties under the DPDPA?

The DPDPA Schedule sets the monetary penalties by category. For example, it provides a penalty of up to ₹250 crore for failure to take reasonable security safeguards. Confirm the current Schedule text for the amounts and categories that apply.

Has the Data Protection Board taken enforcement action?

Section 18 of the Act provides for the establishment of the Data Protection Board of India. Check the Board's current published material for enforcement updates; this article does not assert a case history.

In which languages must a DPDPA notice be available?

DPDPA section 5(3) requires the notice to be available in English or any language specified in the Eighth Schedule of the Constitution. One implementation consideration: this may call for a translation workflow and version control for every notice you publish.

What is a Significant Data Fiduciary under the DPDPA?

A Significant Data Fiduciary is a Data Fiduciary designated under DPDPA section 10. The designation carries additional duties under that section: a Data Protection Officer based in India, periodic Data Protection Impact Assessments and independent audits.

DPDPA Readiness Checklist: Obligations and Controls

Why this checklist exists

The Digital Personal Data Protection Act, 2023 sets obligations for Data Fiduciaries (DPDPA sections 5–10). This checklist organises them the way an implementation team works through them, with the section of the Act cited for each obligation. It is a preparation aid, not a legal opinion.

How to use this list

Work top to bottom. The foundations come first, then the operational controls. Where this article states an obligation, the citation is to the DPDPA section; check the Act's current text and your commencement notifications for what applies to you.

1. Governance and scoping

Appoint an accountable owner. Even if you are not designated a Significant Data Fiduciary, someone must own the DPDPA programme with board-level visibility.
Build a personal data inventory. Map every system, vendor and process that touches digital personal data in India. A Record of Processing Activities (ROPA) is the practical artefact.
Determine your SDF exposure. Significant Data Fiduciary designation brings an India-based Data Protection Officer, periodic Data Protection Impact Assessments and independent audits (DPDPA section 10).
Document the basis for every processing activity. The DPDPA permits processing on the basis of consent or certain legitimate uses (DPDPA sections 4–7); it does not provide a general legitimate-interest basis equivalent to GDPR Article 6(1)(f).

2. Consent

Review every consent flow. Consent must be free, specific, informed, unconditional and unambiguous, given through clear affirmative action (DPDPA section 6(1)).
Make withdrawal as easy as giving consent. This is an express requirement in DPDPA section 6(4).
Maintain consent records. Record who consented to what, when, against which notice, and whether consent was withdrawn.
Prepare for Consent Managers. A Consent Manager is a person registered with the Board who acts as a single point of contact for a Data Principal to give, manage, review and withdraw consent through an interoperable platform (DPDPA section 2(g)). Your systems need to receive and honour signals from registered Consent Managers.

3. Notices

Rewrite privacy notices to DPDPA standards. The notice must describe the personal data, the purpose, how rights can be exercised and how complaints reach the Data Protection Board (DPDPA section 5).
Make the notice available in the required languages. DPDPA section 5(3) requires it to be available in English or any language specified in the Eighth Schedule of the Constitution. Treat this as a content operation with version control.
Version and date-stamp every notice. When the Board asks which notice a consent was given against, you need the answer quickly.

4. Children's data

Implement verifiable parental consent. Processing a child's personal data requires verifiable consent from a parent or lawful guardian (DPDPA section 9).
Switch off behavioural advertising to children. Tracking and targeted advertising directed at children is prohibited (DPDPA section 9).

5. Security safeguards

Implement reasonable security safeguards. DPDPA section 8(5) requires reasonable security safeguards. The DPDPA Schedule sets the penalty category for failure to take them — up to ₹250 crore; confirm the current Schedule text.
Extend safeguards to processors. A Data Processor acts on your behalf under a valid contract (DPDPA section 8(2)); cover the processing in the contract and verify it in practice.
Map safeguards to an existing framework. If you already run ISO/IEC 27001 or SOC 2, map the DPDPA security expectation onto your existing control set with recurring verification.

6. Breach protocol

Build a breach response runbook for the Board. DPDPA section 8(6) requires a personal data breach to be notified to the Data Protection Board and to affected Data Principals in the prescribed manner.
Keep CERT-In separate. Direction (ii) of the CERT-In Directions dated 28 April 2022, issued under section 70B(6) of the Information Technology Act, 2000, requires the covered entities to report the listed cyber incidents to CERT-In within six hours of noticing them. One personal-data breach can trigger both the DPDPA and CERT-In workstreams.
Rehearse it.

7. Data Principal rights infrastructure

Stand up request intake. Data Principals have rights to access, correction, completion, updating, erasure and grievance redressal (DPDPA sections 11–14). Provide a channel to receive requests, verify identity, route to data owners and confirm the applicable response requirements with your advisers.
Track every request. Record intake, identity checks, routing and response.
Plan grievance escalation. Grievance redressal is a statutory right (DPDPA section 13); your internal process is the first step before a complaint reaches the Board.

8. Legacy data

Inventory pre-Act data. Personal data collected before the DPDPA applies still needs a defensible position.
Decide the basis for each legacy dataset. For each legacy dataset, identify the applicable basis and notice obligation — where consent was given before the Act commenced, section 5(2) requires a notice and permits continued processing until consent is withdrawn — and document the decision with your advisers.

9. Training

Train everyone who touches personal data — engineering, support, marketing and HR. Cover the consent flow, the notice and how to route a rights request.

10. Audit, evidence and SDF duties

Schedule periodic DPIAs if you are designated an SDF (DPDPA section 10), and for high-risk processing as a matter of good practice.
Prepare for independent audits. SDFs face independent audit duties under DPDPA section 10; collect evidence continuously.
Keep records inspection-ready. Consent records, notice versions, request logs, training completions and breach runbooks should be retrievable quickly.

Common failure modes

Consent treated as a legal review instead of a product change. Hypothetical scenario: Legal might sign off new consent language, while nobody changes the sign-up flow, SDK configuration or withdrawal path. Review how consent works in the product.

The checklist run in the wrong order. Hypothetical scenario: A team might start with visible items (notices, a privacy page refresh) before data mapping. Later items then get done twice because nobody knew what data existed where.

Planning for one event instead of an operating programme. If notices change, requests arrive, vendors change or incidents happen, a one-off project will not keep up. Build the operating cadence, not a one-off project.

Tooling

DPDPA is one of the 30 standards Compliance Enablers runs as a guided programme, and the DPDPA framework record page on the new pattern is rolling out this month. The privacy, incident, document, audit and training modules are included in every plan. The obligations above are set by the Act, not the platform.

Start with the framework guide

Work through the DPDPA framework guide for the platform's DPDPA programme overview, or book a demo and we will walk your team through mapping your current state against it.

This is general information, not legal advice.