DPDP Act compliance checklist: the documents to review before May 2027

A privacy policy alone does not make a business compliant with the Digital Personal Data Protection Act, 2023, and neither does a cookie banner. The Act looks at what a business does with personal data, and whether its documents describe that accurately. So the work starts with the documents a business already has, and the gaps between them. (For what the Act requires overall, see DPDP Act Compliance.)

Who the checklist applies to

The Act applies to digital personal data processed in India, including data collected on paper and digitised later. It also applies to processing outside India if it is connected with offering goods or services to people in India (section 3).

A business that decides why and how personal data is processed is a Data Fiduciary. A vendor that processes data on its behalf is a Data Processor. The person the data is about is the Data Principal. Many businesses are both: a Data Fiduciary for their own customers and staff, and a Data Processor for their clients' data.

Start with a data map

Every item below depends on knowing what personal data the business holds. List each place it is collected (website forms, app sign-ups, payment pages, customer support, recruitment, HR systems), the purpose, where it is stored, who can access it and which vendors receive it. Without this map, a privacy policy describes what someone assumes rather than what happens. A website and app legal audit is often the quickest way to build it.

The checklist

1. Notices where data is collected

Every request for consent must come with, or follow, a notice (section 5). Under Rule 3, the notice must be understandable on its own and give an itemised description of the personal data, the specific purpose, and how to withdraw consent, exercise rights and complain to the Data Protection Board. People must be able to read it in English or in any language listed in the Eighth Schedule to the Constitution.

Check each form, sign-up screen and app permission prompt, not only the website footer. For data already held on consent given before the Act applies, a notice has to be sent as soon as reasonably practicable (section 5(2)). More on drafting these: Consent Notices & Data Collection Documentation.

2. The privacy policy

Until 13 May 2027, the 2011 rules under the Information Technology Act still require a published privacy policy. After that, the policy remains the place that explains the business's data practices in full, but it no longer does the job alone. Check that it matches the data map, names a contact for privacy questions, explains how to complain to the Board, and avoids terms borrowed from the GDPR, such as "controller" and "legitimate interests", which the DPDP Act does not use. See also: Does your website or app need a privacy policy? and Privacy & Cookie Policy Drafting.

3. Consent records and withdrawal

Consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the data needed for the stated purpose (section 6). The business must be able to prove that it obtained consent, and withdrawing must be as easy as giving it. Check that each consent is recorded with the date, the notice shown and its version, and that pre-ticked boxes and consent bundled into general terms are gone.

Not everything needs consent. Section 7 lists legitimate uses, including data a person gives voluntarily for a specified purpose, compliance with a law or court order, medical emergencies and purposes of employment.

4. Contracts with vendors who process data

A Data Fiduciary may engage a Data Processor only under a valid contract (section 8(2)), and it stays responsible for what the processor does (section 8(1)). For each vendor that handles personal data, such as cloud hosting, payroll, customer support and marketing tools, check that the contract covers:

• the purpose, and the instructions the vendor must follow
• the security safeguards the Rules require
• whether the vendor may use sub-processors, and on what terms
• how quickly the vendor must report a breach to the business
• how long the data may be kept, and its return or deletion when the contract ends

More on these contracts: Data Processing Agreements.

5. Customer contracts and terms of service

Where the business processes personal data for its own clients, its master service agreements and terms of service should say so, and set out the same points from the other side. Enterprise customers increasingly ask for these terms before they sign.

6. Retention and deletion

Personal data must be erased once consent is withdrawn or its purpose is no longer being served, unless another law requires it to be kept, and the business must have its processors erase it too (section 8(7)). A retention schedule records how long each category of data is kept and why.

7. Security safeguards

Section 8(5) requires reasonable security safeguards to prevent a personal data breach. The Rules set out the minimum, including encryption or masking, access controls, logs to detect unauthorised access, backups, and security terms in processor contracts. Failing to take these safeguards carries the highest penalty in the Act.

8. A breach response plan

A business must inform the Data Protection Board and each affected person of a personal data breach (section 8(6)). Under Rule 7, affected people are told without delay, and the Board receives a first intimation without delay and detailed information within 72 hours. Separately, the CERT-In directions of April 2022 already require certain cyber incidents to be reported within six hours. A written plan names who decides, who is told and what is sent. See Data Breach & Incident Response.

9. Requests and grievances

People have the right to information about their data, to have it corrected or erased, to a grievance process and to nominate someone to act for them (sections 11 to 14). The business must publish how to make a request and respond within the period it sets; the Rules cap that at 90 days for grievances. Decide who handles requests and how they are logged.

10. Employee and HR documents

Employee data is personal data. Processing for the purposes of employment is a legitimate use under section 7, so consent is often not needed, but the security, retention and breach duties still apply. Check offer letters, employment agreements, HR policies and contracts with background-check vendors.

11. Children's data, if any

For anyone under 18, a business needs verifiable consent from a parent or lawful guardian, and may not track, behaviourally monitor or target advertising at children (section 9). Schools, education platforms and consumer apps should check this item first.

What applies before May 2027

Until 13 May 2027, section 43A of the Information Technology Act, 2000 and the 2011 rules on sensitive personal data continue to apply, together with the CERT-In directions and any rules for the sector. Businesses preparing now are working under two regimes at once, which is another reason to start from the documents.

Businesses outside India, and the GDPR

A business abroad with customers or users in India is covered if its processing is connected with offering them goods or services. Many also handle data under the EU's General Data Protection Regulation. The two laws overlap but differ: the DPDP Act relies mainly on consent and a short list of legitimate uses, has no general "legitimate interests" ground, and covers digital data only. One set of documents rarely suits both without adjustment.

Penalties

The Schedule to the Act sets maximum penalties by type of breach: up to ₹250 crore for failing to take reasonable security safeguards, up to ₹200 crore for failing to notify a breach and for breaching the duties on children's data, and up to ₹50 crore for breaches with no specific penalty. The Data Protection Board decides the amount, taking into account factors such as the nature and duration of the breach and any steps taken to limit its effect.

For teams that will apply these documents day to day, see DPDP Compliance Training.