# DPDPA Readiness Checklist 2026 *Published by Compliance Enablers LLP | complianceenablers.com* *Last Updated: October 2026* --- ## Introduction India's Digital Personal Data Protection Act, 2023 (DPDPA) governs the processing of digital personal data of individuals (Data Principals) in India. Its obligations apply to organisations (Data Fiduciaries) that process such data; confirm your status and the requirements that apply to you against the official text and with your advisers. This checklist is general information, not legal advice. It maps commonly addressed DPDPA themes to actions you can take and evidence you can retain. It does not reproduce the Act, and it does not state penalty amounts, notification deadlines or designation criteria — confirm those in the official text and the rules made under it. Use the three columns conceptually: the **Theme** (the area the Act addresses), the **Action** (what you can do), and the **Evidence to retain** (what you keep to show your work). --- ## 1. Lawful Processing & Consent DPDPA permits processing on the basis of consent or certain legitimate uses (DPDPA sections 4–7). Consent must be free, specific, informed, unconditional and unambiguous, with a clear affirmative action (DPDPA section 6(1)), and withdrawal must be as easy as giving consent (DPDPA section 6). | Theme | Action | Evidence to retain | | --- | --- | --- | | Obtain valid consent before processing | Implement an opt-in consent mechanism with clear affirmative action; avoid pre-ticked boxes and bundled consent | Consent form and notice version | | Maintain proof of consent | Record who consented, when, the purpose and the notice shown at the time | Consent log | | Honour withdrawal of consent | Provide an easy withdrawal path and stop processing that relied on the withdrawn consent | Withdrawal record and downstream action | | Rely on legitimate uses correctly | Document where you process under a permitted legitimate use rather than consent, and record the justification | Justification record | | Identify lawful basis per activity | Map each processing activity to its basis and review when purposes change | Processing register | - [ ] **1.1 Stand up a consent capture flow** with affirmative, unbundled opt-in. - [ ] **1.2 Log every consent event** with purpose, timestamp and the notice version shown. - [ ] **1.3 Build a withdrawal path** and connect it to downstream processing. - [ ] **1.4 Document legitimate-use processing** where consent is not the basis. --- ## 2. Notice to Data Principals A consent request must be accompanied by a notice in clear and plain language describing the personal data, the purpose, how to exercise rights and how to complain (DPDPA section 5). The notice must be available in English or any language specified in the Eighth Schedule (DPDPA section 5(3)). | Theme | Action | Evidence to retain | | --- | --- | --- | | Provide a clear privacy notice | Publish a plain-language notice covering data, purpose, rights and grievance routes | Published notice | | Offer the notice in accessible languages | Make the notice available in the languages appropriate to your audience | Language versions | | Version and timestamp notices | Keep a history of notice versions so you can show what each Data Principal was told | Notice version history | - [ ] **2.1 Draft a DPDPA-aligned notice** covering data, purpose, rights and the complaint route. - [ ] **2.2 Provide language options** appropriate to your user base. - [ ] **2.3 Version every notice** and link it to the consent it supported. --- ## 3. Data Principal Rights & Grievance Redressal Data Principals have rights to access, correction, completion, updating and erasure (DPDPA sections 11–12), grievance redressal (DPDPA section 13) and nomination (DPDPA section 14). | Theme | Action | Evidence to retain | | --- | --- | --- | | Handle access requests | Provide a summary of the data processed and the processing activities and recipients | Request and response record | | Handle correction and erasure | Correct, complete, update or erase personal data on a validated request | Request and response record | | Operate a grievance mechanism | Publish a grievance channel and respond within your stated, reasonable period | Grievance log | | Support nomination | Allow a Data Principal to nominate another individual to exercise their rights where the law provides for it | Nomination record | | Verify requester identity | Verify identity proportionately before fulfilling a request | Verification record | - [ ] **3.1 Publish a rights-request intake** for access, correction and erasure. - [ ] **3.2 Operate a grievance channel** with tracked response times. - [ ] **3.3 Support nomination** of an alternate rights-holder where applicable. - [ ] **3.4 Verify identity** before fulfilling any request. --- ## 4. Personal Data Breach Response DPDPA section 8(6) requires a personal data breach to be notified to the Data Protection Board and to each affected Data Principal in the form and manner prescribed. Build your programme to detect, assess and notify promptly, and confirm the current form and timing in the Act and the rules. | Theme | Action | Evidence to retain | | --- | --- | --- | | Detect and triage breaches | Run an incident pipeline that classifies severity and flags personal-data impact | Incident record | | Notify the Board | Prepare and send a breach notification to the Data Protection Board in the prescribed manner | Notification copy and timestamp | | Notify affected individuals | Notify each affected Data Principal with the nature, consequences and mitigation | Notification copy | | Maintain a breach register | Keep an auditable record of every breach, the timeline and actions taken | Breach register | - [ ] **4.1 Stand up an incident pipeline** that flags personal-data impact at intake. - [ ] **4.2 Pre-draft Board and Data Principal notification templates.** - [ ] **4.3 Track every breach to a register** with a full timeline. - [ ] **4.4 Rehearse the notification path** against the deadline that applies to you. --- ## 5. Significant Data Fiduciary (SDF) Duties The Government may designate certain organisations as Significant Data Fiduciaries (DPDPA section 10). A designated SDF must appoint a Data Protection Officer based in India, conduct periodic Data Protection Impact Assessments and undergo independent audits (DPDPA section 10). Confirm designation criteria in the Act and the rules. | Theme | Action | Evidence to retain | | --- | --- | --- | | Appoint a DPO in India | Where required, designate a DPO based in India and publish their contact | Appointment record | | Conduct DPIAs | Run Data Protection Impact Assessments on higher-risk processing | DPIA record | | Commission independent audits | Where required, engage an independent data auditor and track findings to closure | Audit report and closure record | | Demonstrate accountability | Maintain evidence of governance, reviews and decisions for the regulator | Accountability register | - [ ] **5.1 Confirm whether you may be designated an SDF** against the criteria that apply. - [ ] **5.2 Appoint an India-based DPO** where required. - [ ] **5.3 Run DPIAs** on high-risk processing and track remediation. - [ ] **5.4 Plan independent audits** where required and manage findings to closure. --- ## 6. Data Protection Officer & Governance A designated SDF must appoint a Data Protection Officer based in India (DPDPA section 10). Whether or not you are designated, a named owner, a clear reporting line and a place where reviews, decisions and evidence live make the programme operable. | Theme | Action | Evidence to retain | | --- | --- | --- | | Name a contact for queries | Publish a contactable person for processing questions | Published contact | | Establish a reporting line | Where required, ensure the DPO reports to the board or governing body | Reporting line record | | Govern with evidence | Keep a register of reviews, approvals and accountability artefacts | Accountability register | - [ ] **6.1 Name and publish a processing-queries contact.** - [ ] **6.2 Define the DPO reporting line** to the board where required. - [ ] **6.3 Keep an accountability register** of reviews and decisions. --- ## 7. Security Safeguards & Children's Data DPDPA section 8(5) requires reasonable security safeguards to prevent a personal data breach. DPDPA section 9 requires verifiable parental consent before processing a child's personal data and prohibits behavioural advertising directed at children. Confirm the current conditions and exceptions in the Act. | Theme | Action | Evidence to retain | | --- | --- | --- | | Implement reasonable safeguards | Apply technical and organisational controls and evidence them | Control records and evidence | | Obtain verifiable parental consent | Verify parental/guardian consent before processing a child's data where required | Consent record | | Restrict child-directed processing | Apply the restrictions that apply to children's data | Configuration and policy record | - [ ] **7.1 Map "reasonable security safeguards"** to your control framework and evidence them. - [ ] **7.2 Implement verifiable parental consent** for children's data where required. - [ ] **7.3 Apply the required restrictions** to children's data. --- ## How the Platform Supports DPDPA Compliance Enablers is a multi-tenant GRC platform. DPDPA is one of 30 standards run as guided programmes — scoping, assessment, scoring, evidence and readiness — with every dashboard module included in every plan. The platform includes a DSAR (privacy request) portal among its eight portals, and controls, evidence and findings map across standards through thousands of curated crosswalk mappings. AI runs on Anthropic Claude for generation and OpenAI for embeddings; no customer data is used to train models, and every AI action is metered and visible to the customer. Licensed standards open only after you confirm in-app that you hold your own licensed copy; we never sell or redistribute standard text. --- *This resource is general information, not legal advice. Confirm the current DPDPA text and rules with your advisers.*