DPDP compliance checklist: 40 controls to finish before 13 May 2027

If you have only a few weeks before 13 May 2027, finish these eleven controls first: an accountable owner (1), a published contact person (4), a data inventory (6), Rule 3 notices (11), valid consent capture (14) and consent records (15) at your main collection points, closed access gaps (26), an incident playbook (31), processor contracts (33), a request route (38) and a published grievance period (39). Together they give you someone in charge, a map, lawful collection, the largest security gaps closed and a way to answer a breach and a complaint. The other 29 complete the programme. Each row below gives what done looks like, the provision, the evidence to keep, an owner with a fallback for small teams, and whether it costs only time or also money; target dates come from the dated plans in DPDP compliance deadline: 13 May 2027.

Like the Act (s. 2(y)), we say "she" and "her" for every person. "s." is a section of the Digital Personal Data Protection Act, 2023; "Rule" is a rule of the DPDP Rules, 2025.

Jump to what you need.

• Accountable owners and DPOs: How to run it, Governance, Order of work.
• Programme, product and legal teams: Data map, Notices and consent, Children, Rights.
• CISOs and IT leads: Security, Breach, Retention.
• Procurement and partnerships: Processors and partners.

How to run the checklist

Download the tracker. dpdp-checklist-tracker.csv holds all 40 rows with columns for status, due date and a link to the evidence. It opens in Excel or Google Sheets.

Sit down with the people who handle personal data every day: programmes or product, IT, HR, fundraising or marketing, finance and customer service. For each control, mark it done, partly done or open. A control counts as done only when the evidence in its row exists and someone other than its owner has seen it.

Evidence is the point of the exercise. Where you rely on consent and it is questioned, you must prove the notice and the consent (s. 6(10)). Records are also how you would show that your safeguards were reasonable (s. 8(5)) and how quickly and effectively you mitigated a breach (s. 33(2)(e)). Keep one evidence folder, organised by control number, with a date and version on every item. A notice that was live in March 2027 is worth far less if you cannot show that it was the March version. We recommend storing screenshots, exports and signed documents there rather than links to live systems, which change.

The owners are roles. Each row also names a fallback for a small organisation with no CISO, CTO or legal team, usually the director, one accountable person, the programme lead or an outside IT provider. What matters is that each row has one name against it.

The cost column says whether a control needs only staff time, or also money for engineering, a platform, translation or legal help. The Act has no turnover or headcount threshold, and the exemption for startups and other notified classes (s. 17(3)) has not been used, so a small organisation works through the same 40 rows with less effort in each: its inventory can be one sheet and its playbook two pages. If you are unsure whether, or how far, the Act reaches you, start with Does the DPDP Act apply to you?.

A gap assessment and this checklist do different jobs. The assessment finds and ranks your gaps against the law at one point in time. The checklist is the list of controls you then close, with the evidence that shows each one is working.

Governance and roles: controls 1 to 5

Only a Significant Data Fiduciary must appoint a DPO (s. 10(2)(a)). Everyone else must publish a contact person (control 4). We recommend giving that role to one named individual, whatever your size.

Data map and basis: controls 6 to 10

The inventory is the control everything else depends on. You cannot write an itemised notice, name the vendors who hold her data (s. 11(1)(b)), set retention periods or erase across systems without it. Data mapping explains how to build one quickly, paper and WhatsApp included, and the applicability guide has a memo format for each exemption you rely on.

Notices, consent, cookies and AI: controls 11 to 20

Controls 13 and 16 deserve extra testing because both fail out of sight. A notice can be perfect on paper while a call-centre script or a field visit asks the question first and explains afterwards, which s. 5(1) does not allow; only listening to calls and watching visits will show it. Withdrawal can work on the screen where she clicks while the data keeps flowing to a CRM, an SMS vendor and an analytics tool, because each copy needs its own integration; only a test that follows one withdrawal through every system will show it.

Controls 17 and 18 apply to adults as well as children. The Act has no cookie provision, but cookies and device identifiers are personal data when they relate to an identifiable person (s. 2(t)) and need a basis like any other; see cookies and product analytics. Training a model is a purpose you decide, so it needs its own basis; see DPDP and AI. Samples you can copy are in How to write a DPDP consent notice, and the s. 5(2) campaign is set out in The data you already hold. If people may reach you through a registered Consent Manager (s. 6(7)), see Consent Managers under DPDP.

Children and lawful guardians: controls 21 to 24

A child is anyone under eighteen (s. 2(f)); a 16- or 17-year-old cannot consent for herself. A school record that shows only a parent's name does not establish that she is an adult (Rule 10(1)). The educational-institution exemption covers only tracking and behavioural monitoring, for the institution's educational activities or the safety of enrolled children (Fourth Schedule, Part A, item 3). It is not a general exemption from parental consent. Field methods for parents without smartphones are in Consent in the field.

Security safeguards: controls 25 to 30

Rule 6 sets the minimum safeguards; the duty in s. 8(5) is to take "reasonable" ones, which can mean more.

Control 30 is our addition to the Rule 6 list. Our view: it is where many social-sector and early-stage organisations would struggle to show their safeguards were reasonable, because a well-encrypted database is little defence if its contents also sit in a WhatsApp group on thirty personal phones. The CERT-In log points in control 29 come from the Directions and CERT-In's FAQs of 18 May 2022 (Q35 and Q36).

Breach response: controls 31 and 32

There is no size or harm threshold for a personal data breach (s. 2(u)), and Rule 7 sets none. Hour-by-hour timings, sample notices and a 90-minute drill script are in Data breach under DPDP.

Processors and partners: controls 33 and 34

You remain responsible for processing done on your behalf "irrespective of any agreement to the contrary" (s. 8(1)). An indemnity moves money; it does not move the duty. Contract terms are covered in processor contracts, and the CSR and NGO split in DPDP for CSR foundations.

Retention and erasure: controls 35 to 37

Control 36 is the only place this checklist states the Rule 8(3) floor; control 29 is a separate, security-driven retention under Rule 6(1)(e). A retention schedule should show both the floor and the end date for each data set.

Rights, grievances and accuracy: controls 38 to 40

A person must use your grievance route before she can go to the Board (s. 13(3)), so the grievance desk in control 39 decides how many complaints reach the regulator.

If you are notified as a Significant Data Fiduciary

These are not counted in the 40, because they apply only to a fiduciary or class the government notifies under s. 10(1). None had been notified as of 25 October 2026.

• Data Protection Officer: an individual based in India, responsible to the board, and the point of contact for grievances (s. 10(2)(a)).
• Independent data auditor to evaluate compliance (s. 10(2)(b)).
• DPIA and audit every twelve months, with significant observations reported to the Board (s. 10(2)(c), Rule 13(1)–(2)).
• Algorithmic due diligence: checking that technical measures, including algorithmic software, are not likely to pose a risk to people's rights (Rule 13(3)).
• Data kept in India where the government specifies, on a committee's recommendation (Rule 13(4)).

The order of work, ranked by penalty and reach

Rank the open controls by two things: the penalty attached to the duty, and how many people it touches. The caps come from the Schedule to the Act; a penalty needs an inquiry, a finding that the breach is significant, and a hearing (s. 33(1)).

The eleven-control minimum in the opening paragraph is our judgement of the smallest set that touches each priority above except children, plus the contact person and request route the law requires you to publish (s. 8(9), Rule 9, Rule 14(1)). If you serve children, add controls 21 and 22 to it. Compressed calendars for teams starting in January or March 2027 are in Starting late.

Where the law is unclear

These are our positions until the Board or the courts decide otherwise.

What is a "reasonable time" to stop processing after withdrawal (s. 6(6))? Our position: seven days for systems and processors, and marketing messages stopped at once. Why: the Act gives no period, and withdrawal must be as easy as consent (s. 6(4)), which suggests the effect should follow quickly. Would change if: the Board or rules set a period. Confidence: low.

Does a legitimate use need a notice? The Act does not require one; section 5(1) attaches the notice to requests for consent. We give a short information notice for s. 7(a) uses anyway. Why: s. 7(a) depends on a "specified purpose" she knew of when she gave the data, and an information notice is the best evidence of it. Would change if: the Board accepts other evidence of the purpose as sufficient. Confidence: medium.

Is meeting Rule 6 enough to show reasonable safeguards? Not always. Why: Rule 6 lists what safeguards "shall include, at the minimum", and s. 8(5) asks for reasonable safeguards to prevent a breach. What is reasonable for a children's health database is more than for a newsletter list. Would change if: the Board publishes security standards or decides cases that set a baseline. Confidence: high.

Must erased data be removed from backups at once? We let backups expire on a short, documented cycle and never restore erased records into live use. Why: the Rules require backups for continuity (Rule 6(1)(d)) and are silent on erasing from them. Would change if: the Board expects immediate erasure from backups. Confidence: medium.

How does the Rule 8(3) floor sit with erasure on withdrawal? We keep the minimum it needs, in a restricted store, for its stated purposes only, and erase it after a year unless another law requires more. Why: Rule 8(3) requires retention for the Seventh Schedule purposes, while s. 8(7) allows retention where a law requires it. Would change if: the Board reads the floor narrowly. Confidence: medium.

Next steps

1. Download the tracker and put a name in the owner column of every row.
2. Take the target dates from the plan that fits you in DPDP compliance deadline: 13 May 2027: small organisation, large organisation, SaaS vendor or late start.
3. Open the evidence folder now, organised by control number, and add to it every week.
4. Report the open controls, ranked by the priority table above, to the board or trustees each quarter.
5. Re-run the checklist after go-live, and mark a control done only if its evidence folder supports it.

For what each duty means, see The DPDP Act and Rules. For how the Board would weigh a failure, see DPDP penalties.

How we wrote this checklist. We worked from the text of the Digital Personal Data Protection Act, 2023 (No. 22 of 2023), the Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E), as corrected by G.S.R. 892(E)), the commencement notification G.S.R. 843(E), and the CERT-In Directions of 28 April 2022 with CERT-In's FAQs of 18 May 2022. Statements about notifications are as of 25 October 2026. The owners, evidence, cost tags and priorities are our recommendations, not legal requirements. This checklist explains the law; it is not legal advice for your situation.