By 13 May 2027, when Rules 3 and 5 to 16 take effect, you need: a data map with a role per flow, itemised notices (Rule 3), provable consent or a named legitimate use (sections 6 and 7), Rule 6 security safeguards, a 72-hour breach process (Rule 7), retention and erasure (Rule 8), rights and grievance handling (Rule 14) and valid contracts with every processor (section 8(2)).
Key takeaways
- Core DPDP obligations apply from 13 May 2027. A proposal to shorten the window was discussed but has not been notified.
- There is no general small-business exemption. The section 17(3) power to exempt startups has not been used.
- Every obligation needs an owner and evidence: section 6(10) puts the burden of proving notice and consent on you.
- Rule 6(e) and Rule 8(3) require one year of logs and personal data retention, so logging changes need to start early.
- Run a gap assessment first, then build in the order of exposure: security, breach, consent, rights, retention.
A DPDP compliance checklist is only useful if each line tells someone what to build and what proof to keep. The Act and the DPDP Rules, 2025 set the obligations; your teams turn them into notices, consent records, security controls, contracts and runbooks. This checklist is written that way: every obligation is tied to its section or Rule, the thing you need in production, the team that should own it and the evidence that shows it works.
Today, 13 November 2026, there are about 26 weeks (181 days) left before the core obligations start. That is workable for most organisations, but only if work starts now and the order is right. Use this page to scope the work, then use the DPDP implementation roadmap to sequence it.
Data Protection Board established; Rules 1, 2 and 17 to 21 in force. Members are yet to be appointed.
Rule 4 applies: the framework for registering consent managers with the Board is in force.
Notice, consent, security safeguards, breach intimation, retention, rights, grievances, children and cross-border rules.
What must my business do to comply by 13 May 2027?
Every organisation that decides why and how personal data is processed is a Data Fiduciary under section 2(i), and carries the full set of general obligations in section 8. The Act applies to digital personal data processed in India, including data collected offline and digitised later, and to processing outside India connected with offering goods or services to people in India (section 3). There is no turnover or headcount threshold.
The master checklist below covers the obligations that apply to every fiduciary. Owners are suggestions; adjust them to how your organisation is set up. The Significant Data Fiduciary add-ons come later on this page.
| Obligation | Source | What to build | Owner | Evidence |
|---|---|---|---|---|
| Know your data and your role | s.2(i), s.2(k), s.8(1) | Data inventory across systems, with a fiduciary or processor role for each data flow | Engineering, Legal | Record of processing |
| Lawful ground for each purpose | s.4, s.6, s.7 | Purpose register: consent, or the specific legitimate use under section 7 that applies | Legal, Product | Purpose register with sign-off |
| Itemised notice | s.5, Rule 3 | Standalone notice listing each data item and specific purpose, with links to withdraw, exercise rights and complain to the Board; English or any Eighth Schedule language | Product, Legal | Versioned notice archive |
| Notice to existing users | s.5(2) | Notice campaign for people whose consent was taken before commencement, as soon as reasonably practicable | Product | Delivery logs |
| Valid consent, provable | s.6(1), s.6(10) | Per-purpose consent by clear affirmative action, not bundled; a consent ledger | Engineering | Consent events with notice version and timestamp |
| Withdrawal as easy as consent | s.6(4) to 6(6) | One-step withdrawal; processing stops within a reasonable time, including at processors | Engineering, Product | Withdrawal test results |
| Accuracy where data drives decisions | s.8(3) | Completeness and consistency checks where data is used for a decision or disclosed | Engineering | Data quality checks |
| Security safeguards | s.8(5), Rule 6 | Encryption, masking or tokens; access control; logging and monitoring; backups; contract safeguards | Security | Safeguards matrix, test results |
| One-year logs and data | Rule 6(e), Rule 8(3) | Retain logs, traffic data and personal data for at least one year from processing, yours and your processors' | Engineering, Security | Log retention configuration |
| Breach intimation | s.8(6), Rule 7 | Runbook to notify every affected person and the Board without delay, with the detailed report within 72 hours | Security, Legal | Drill reports, templates |
| Retention and erasure | s.8(7), s.8(8), Rule 8 | Retention schedule and an erasure job that reaches processors; 48-hour notice if a Third Schedule class | Engineering | Erasure logs |
| Processor contracts | s.8(2), Rule 6(f) | Contract with every processor, including safeguards, breach notice and erasure terms | Procurement, Legal | Signed contracts, vendor register |
| Published contact | s.8(9), Rule 9 | DPO or contact person's business contact on the website or app, and in every rights response | Legal, Product | Live page, response templates |
| Rights requests | s.11 to s.14, Rule 14 | Published means to request access, correction, erasure and nomination, with identity checks | Product, Support | Rights register |
| Grievance redressal | s.8(10), s.13, Rule 14 | Grievance desk with a published response period of no more than 90 days | Support | Grievance register, SLA reports |
| Children and persons with disability | s.9, Rules 10 to 12 | Age gating, verifiable parental or guardian consent, no tracking or targeted ads at children | Product, Legal | Verification records |
| Cross-border transfers | s.16, Rule 15 | Transfer register by country; check sectoral rules such as RBI payment data storage | Legal | Transfer register |
| Organisational measures | s.8(4) | Policies, training, privacy review for new features and vendors | Leadership, HR | Policies, training records |
Two rows catch most teams out. The first is section 6(10): if consent is ever questioned in a proceeding, you must prove both the notice and the consent, so a checkbox without a stored record is not enough. The second is Rule 8(3), new in the final Rules, which requires every fiduciary to keep personal data, associated traffic data and processing logs for at least one year. That interacts with erasure, so the retention design has to handle both.
DPDP checklist by team
A single list hides who has to act. These checklists split the same obligations by team, so each lead can see their share and report progress in one review.
Leadership and legal
- Name one accountable owner. One senior person signs off the programme and reports to the board on progress.
- Decide the lawful ground for each purpose. Consent or a section 7 legitimate use. There is no general "legitimate interests" ground, so every purpose needs one of the two.
- Approve notice text and retention periods. Work with your counsel on wording; engineering needs the final periods to build erasure.
- Publish a contact. Name the DPO or person who answers questions about processing (section 8(9), Rule 9).
- Assess SDF exposure. Check how your data volume and sensitivity sit against the section 10(1) factors and plan a contingency.
- Review sector rules. Sector rules, such as RBI payment data storage, continue alongside DPDP.
Product
- Put an itemised notice at every collection point. Sign-up, checkout, forms, apps and offline forms that get digitised. See the privacy notice guide.
- Unbundle consent. One choice per purpose, limited to the data needed, separate from terms of service.
- Make withdrawal one step. If consent took one tap, withdrawal should too (section 6(4)).
- Add rights entry points. Access, correction, erasure and nomination from the account screen and the website.
- Handle children properly. Age gate, verifiable parental consent under Rule 10, and no tracking, behavioural monitoring or targeted ads directed at children (section 9(3)).
- Offer languages. Notices and consent requests in English or any Eighth Schedule language your users need.
Engineering and security
- Discover and tag personal data across databases, object stores, logs, search indexes, analytics and backups.
- Build a consent ledger and purpose gate. Data flows to a purpose only when the ledger shows a valid ground.
- Implement Rule 6 safeguards. Encryption, masking or tokens, access control, monitoring and backups. Details in the security safeguards guide.
- Keep one year of logs. Tamper-resistant storage for access and processing logs, including from processors.
- Automate erasure. One orchestrator that deletes or anonymises across systems and instructs processors.
- Prepare breach detection and reporting. Capture what Rule 7 asks for, and keep CERT-In's separate 6-hour reporting direction in the same runbook.
HR
- Map employee purposes to section 7(i). Employment purposes are a legitimate use. Where a purpose falls outside it, such as an optional programme, use consent.
- Cover candidates and leavers. Set retention for applicant data and exit records.
- Treat HR vendors as processors. Payroll, background checks and benefits providers need contracts.
- Train everyone who touches personal data, with role-specific modules for support and engineering.
Procurement and vendor management
- Keep a vendor register with the role, data categories, locations and sub-processors for each vendor.
- Paper every processor. Section 8(2) allows processors only under a valid contract; Rule 6(f) requires safeguards in it.
- Set breach notice times that fit your 72 hours, plus erasure on instruction, log retention and audit rights.
- Add a privacy review to vendor onboarding so new tools do not reopen gaps you have closed.
Customer support
- Run a grievance desk with a published response period of no more than 90 days (Rule 14).
- Verify identity before acting on access, correction, erasure or nomination requests.
- Use templates that include the published contact, as Rule 9 requires in every response to a rights communication.
- Be ready to tell affected people about a breach in plain language, with the safety steps they can take.
What applies now and what starts in May 2027?
The Act and Rules come into force in three phases. Most business obligations sit in the last one, which is why the checklist above is framed around 13 May 2027.
| Phase | From | What is in force | What it means for you |
|---|---|---|---|
| 1 | 13 Nov 2025 | Definitions, Board provisions (s.18 to 26), s.44(3) RTI amendment; Rules 1, 2, 17 to 21 | Board is established but no Chairperson or Members are appointed yet. No new duties for most businesses. |
| 2 | 13 Nov 2026 (today) | s.6(9), s.27(1)(d); Rule 4 | Consent manager registration opens in law. No application portal reported yet. |
| 3 | 13 May 2027 | s.3 to 17 (except s.6(9)) and most of the rest; Rules 3, 5 to 16, 22, 23 | Notice, consent, safeguards, breach, retention, rights, children, SDF duties and penalties all apply. |
Until 13 May 2027, section 43A of the IT Act still applies; it is omitted from that date. Three items remain open: no Significant Data Fiduciary has been notified, no country has been restricted under section 16, and the Supreme Court challenge to parts of the Act is pending without a stay. None of these changes the date. The enforcement date guide tracks them.
Significant Data Fiduciary add-ons
If the government notifies you, or a class you belong to, as a Significant Data Fiduciary under section 10(1), five obligations sit on top of everything above. None has been notified yet, but large consumer platforms and holders of sensitive data at scale should plan for it.
Represents the SDF, answers to the board of directors, is the point of contact for grievances
Evaluates the SDF's compliance with the Act
Significant observations reported to the Board
Check that algorithmic software does not put data principals' rights at risk
Personal data the government specifies, on a committee's advice, stays in India
The DPDP (Removal of Difficulties) Order, 2026 changed "periodic audit" in section 10(2)(c)(ii) to "periodic data audit". The Significant Data Fiduciary guide covers the criteria and how to prepare.
How do you run a DPDP gap assessment?
A gap assessment turns this checklist into your list. It typically takes three to four weeks for a mid-sized product and gives every later decision a starting point.
Products, entities, user groups
Stores, fields, flows, vendors
Role, purpose, ground per flow
Exposure and effort
Owner, fix, date
Rate gaps by exposure, not by effort
The penalty Schedule is a useful guide to priority. Reasonable security safeguards carry the highest ceiling (up to ₹250 crore), followed by breach intimation and children's obligations (up to ₹200 crore each), SDF obligations (₹150 crore) and any other provision (₹50 crore). The Board sets the actual amount after considering factors in section 33(2), including the gravity and duration of the breach and how quickly you mitigated it. See DPDP Act penalties for the full table.
What a good gap report contains
- A record of processing: stores, fields, purposes, roles and lawful grounds.
- A gap register: one line per gap, tied to a section or Rule, with exposure rating and owner.
- Decisions needed from leadership, such as consent versus legitimate use for a purpose, or retention periods.
- Quick wins that cut exposure in days, such as switching off verbose logging of personal data or removing stale exports.
- A sequenced plan that fits the weeks left.
Use the checklist as an audit checklist later
The evidence column above doubles as a DPDP audit checklist. After May 2027, test each row quarterly: pull a sample of consent records, run a withdrawal, restore a backup, time a rights request. Keep the results with your evidence pack.
Common gaps we see in first assessments
A few patterns come up again and again, regardless of sector:
- Personal data in logs and search indexes. Debug logs and analytics events often hold phone numbers, emails or identity numbers nobody listed in an inventory.
- Consent bundled into terms. A single "I agree" for terms, marketing and sharing is unlikely to meet the "specific" and "unconditional" tests in section 6(1).
- No route for withdrawal. Users can opt in with one tap but must email support to opt out.
- Processors without contracts, especially small tools added by individual teams.
- Erasure that stops at the main database, leaving copies in warehouses, backups and vendor systems.
- Breach plans that ignore people. Section 8(6) requires notice to every affected Data Principal, with no materiality threshold, not just to the regulator.
What to do next
- Run the gap assessment now. Start with the data inventory; everything else depends on it.
- Fix the highest-exposure gaps first. Security safeguards and breach notification carry the highest ceilings and take the longest to prove.
- Start log retention changes early. Keeping a year of logs, yours and your processors', needs storage, cost and access decisions that take time to agree.
- Sequence the rest with the 26-week implementation roadmap.
- Collect evidence as you go, not in the last month.
If you want a team that has built these controls before to run the assessment and the build with you, see our assessment and implementation services.
Frequently asked questions
What is the DPDP compliance deadline?
13 May 2027. On that date sections 3 to 17 (other than section 6(9), already in force) and most of the remaining Act, plus Rules 3, 5 to 16, 22 and 23, come into force. A proposal to shorten the 18-month window to 12 months was discussed with industry in early 2026, but no amendment has been notified, so 13 May 2027 stands.
Is DPDP compliance mandatory for startups and small businesses?
Yes. The Act has no general small-business exemption. Section 17(3) lets the government exempt notified fiduciaries, including startups, from some provisions, but it has not used that power. Until it does, plan as if every obligation applies to you.
What does a DPDP gap assessment cover?
It compares how you handle personal data today against each obligation in the Act and Rules: notice, consent, legitimate uses, security safeguards, breach intimation, retention, rights, grievances, processors, children and cross-border transfers. The output is a list of gaps rated by exposure, with an owner and a fix for each.
Do we need to appoint a Data Protection Officer?
Only a Significant Data Fiduciary must appoint a DPO, under section 10(2)(a). Every other fiduciary must publish the business contact of a DPO or of a person who can answer questions about its processing, under section 8(9) and Rule 9. Many companies name a privacy lead for this.
Does the DPDP checklist apply to companies outside India?
It can. Under section 3, the Act covers processing outside India if it is connected with offering goods or services to Data Principals in India. A foreign SaaS or e-commerce business selling to Indian users should run the same checklist for its Indian user base.
What evidence should we keep for a DPDP audit?
Keep a record of processing, every notice version, consent and withdrawal events with timestamps, your security safeguards matrix and test results, breach drill reports, signed processor contracts, a retention schedule with erasure logs, and a rights and grievance register. Section 6(10) makes you prove notice and consent if challenged.
Turn this guide into a working programme
A 30-minute scoping call maps your gaps against the Rules and the order to close them. You get a fixed-fee proposal within three working days.
Related guides
This guide explains the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 as notified on 13 November 2025. It is general information, not legal advice. Check the official text, and your counsel, before relying on it.