Checklist

DPDPA Compliance Checklist

A structured checklist covering key compliance requirements under the Digital Personal Data Protection Act, 2023.

Progress: 0 of 34 items checked

This checklist is for self-assessment purposes only. Progress is not saved between sessions.

Data Mapping & Inventory

Identify all personal data processing activities

Catalog every system, application, and process that collects, stores, or processes digital personal data.

Classify data by sensitivity and purpose

Categorize personal data based on its nature, the purpose of processing, and whether it involves children's data.

Document data flows across systems

Map how personal data moves between internal systems, third parties, and across borders.

Identify legal basis for each processing activity

Determine whether processing relies on consent, legitimate use, or another lawful basis under the Act.

Consent Management

Implement consent collection mechanisms

Ensure consent is collected through clear affirmative action with specific, informed, and unambiguous language per the consent framework.

Provide consent withdrawal mechanism

Enable Data Principals to withdraw consent as easily as it was given, with clear instructions.

Maintain consent records

Keep auditable records of when, how, and for what purpose consent was obtained from each Data Principal.

Review and update consent notices

Ensure consent notices accurately reflect current processing activities and are provided in required languages.

Data Protection Officer

Assess DPO appointment requirement

Determine if your organization qualifies as a Significant Data Fiduciary requiring a Data Protection Officer.

Appoint a DPO based in India

If required, appoint an individual based in India to serve as the Data Protection Officer.

Publish DPO contact details

Make the DPO's contact information publicly available for Data Principals and the Data Protection Board.

Security Measures

Implement reasonable security safeguards

Deploy appropriate technical and organizational measures to protect personal data from breaches per Rule 6.

Conduct periodic security assessments

Regularly evaluate the effectiveness of security measures and address identified vulnerabilities.

Encrypt personal data at rest and in transit

Apply encryption standards appropriate to the sensitivity of the personal data being processed.

Implement access controls

Restrict access to personal data to authorized personnel only, using role-based access controls.

Breach Notification

Establish breach detection mechanisms

Implement monitoring and alerting systems to detect personal data breaches promptly.

Create breach response procedures

Document step-by-step procedures for responding to a personal data breach, including roles and responsibilities.

Notify the Data Protection Board

Ensure procedures are in place to notify the Data Protection Board of a personal data breach in the prescribed form and manner per Rule 7.

Notify affected Data Principals

Establish procedures to inform affected Data Principals about a breach in the prescribed form and manner.

Cross-border Transfers

Identify cross-border data transfers

Document all instances where personal data is transferred outside India.

Verify transfer destinations are permitted

Ensure data is only transferred to countries or territories not restricted by the Central Government.

Implement contractual safeguards

Where required, establish contractual arrangements with overseas recipients to ensure data protection.

Children's Data

Implement age verification mechanisms

Deploy verifiable mechanisms to determine whether a Data Principal is a child (under 18 years).

Obtain verifiable parental consent

Before processing a child's data, obtain verifiable consent from the child's parent or lawful guardian.

Prohibit harmful processing

Ensure no processing of children's data causes detrimental effects on their well-being, including behavioral monitoring and targeted advertising.

Grievance Redressal

Appoint a Grievance Officer

Designate an individual or team responsible for addressing Data Principals' complaints and requests.

Publish grievance redressal process

Make the process for raising grievances easily accessible to all Data Principals.

Respond within prescribed timelines

Ensure grievances are acknowledged and resolved within the timelines prescribed under the Act.

Data Retention & Erasure

Define retention periods

Establish and document retention periods for each category of personal data based on the purpose of processing.

Implement erasure procedures

Create automated or manual procedures to erase personal data once the purpose is fulfilled or consent is withdrawn.

Erase data of inactive users

Where a Data Principal has not approached the Data Fiduciary for a prescribed period, erase their personal data.

Vendor & Processor Management

Assess Data Processor compliance

Evaluate whether third-party Data Processors have adequate safeguards for processing personal data.

Establish processor agreements

Execute contracts with Data Processors specifying processing terms, security requirements, and breach notification obligations.

Monitor ongoing processor compliance

Periodically review and audit Data Processors to ensure continued compliance with contractual and legal obligations.

Disclaimer: The information on this page is for educational purposes only and does not constitute legal advice or solicitation.

DPDPA Compliance Checklist

Data Mapping & Inventory

Consent Management

Data Protection Officer

Security Measures

Breach Notification

Cross-border Transfers

Children's Data

Grievance Redressal

Data Retention & Erasure

Vendor & Processor Management

Explore More

Data Mapping Guide

DPIA Framework

Compliance Guide

Vendor Assessment