DPDP compliance is a programme, not a checkbox — but it helps to see the whole path at once. Here's a practical checklist to take your organisation from unsure to demonstrably compliant.
1. Assign ownership
Name someone accountable for DPDP compliance. If you're a Significant Data Fiduciary, you must appoint a resident Data Protection Officer; every fiduciary should publish a contact for grievances.
2. Discover and map your data
Find personal data across databases, apps, spreadsheets, cloud and vendors. Build a Record of Processing Activities (RoPA) — what you hold, where, why, and where it flows, including cross-border.
3. Check your lawful basis
For each purpose, confirm you have valid consent or a specific legitimate use. Drop data you can't justify.
4. Rebuild notices and consent
Make notices clear, itemised and multilingual, shown before collection. Replace bundled "accept all" with purpose-wise consent and one-click withdrawal.
5. Protect sensitive data
Encrypt and mask sensitive identifiers — Aadhaar, PAN, financial, health, biometric — and log access. Plain-text sensitive columns are the single most common risk.
6. Stand up rights and grievance
Create a working channel for access, correction, erasure and nomination, and a grievance mechanism that answers within the Act's timelines.
7. Contract your vendors
Put data-processing agreements in place with every processor, and flow your security and breach obligations down to them.
8. Prepare for a breach
Have a breach-response plan that can identify affected people and notify the Board and individuals on time, with an evidence trail.
9. Train your people
Staff and board should know what data they may collect and why. Keep completion records.
10. Audit and keep evidence
Review regularly — SDFs need an independent external audit — and keep audit-ready evidence you can produce on the day it's asked for.
Work through these in order and you'll have a defensible baseline. If you'd like the list turned into a costed, time-boxed plan for your organisation, the free assessment returns exactly that within three working days.
This article is general information about the DPDP Act and is not legal advice. For guidance specific to your organisation, take the free assessment or speak to our team.