The discussions around India’s data protection law have finally made their way out of the boardrooms. The Digital Personal Data Protection Act, 2023 (DPDP Act) is in effect, and the DPDP Rules, 2025, were officially announced on November 13, 2025. Full compliance for most businesses is set for May 2027. This gives you a time cushion, but it is closing.
A recent survey reported 70% of businesses in India have little understanding of the DPDP Act. If your business has any level of data operations involving the personal data of Indian citizens, whether you are a Bengaluru-based startup or a multinational with offices in India, this DPDP compliance checklist is for you.
Let us walk through what you actually need to do, step by step.
What Is the DPDP Act and Who Does It Apply To?
The DPDP Act applies to any organization that processes digital personal data of individuals in India. This includes data collected online and offline data that is later converted to digital form. It also covers foreign companies that offer goods or services to people in India.
Under the law, your organization is called a Data Fiduciary — the entity that decides why and how personal data is processed. Individuals whose data you collect are called Data Principals.
The DPDP Compliance Checklist for 2026
Step 1: Know What Data You Collect and Why
Before anything else, map your data. You need to know:
- What personal data you collect (names, emails, phone numbers, Aadhaar numbers, location, purchase history, etc.)
- Where it is stored (cloud servers, local databases, third-party tools)
- Who has access to it inside and outside your organization
- Why you are collecting it — the specific purpose, not vague terms like ‘business operations’
The DPDP Act strictly requires purpose limitation. You can only use personal data for the purpose you stated when collecting it. Vague descriptions are no longer acceptable.
Step 2: Update Your Consent Process
Consent is the foundation of the DPDP Act. Unlike Europe’s GDPR, which allows other legal bases such as legitimate interest, the DPDP Act makes consent the primary way to process personal data. Your consent process must be:
- Free not bundled with service access as a condition
- Specific tied to a clearly stated purpose
- Informed explained in plain language, available in the user’s preferred Indian language
- Revocable users must be able to withdraw consent at any time, easily
This means the days of checkbox-heavy privacy notices buried in fine print are over. Your notices need to be standalone documents written clearly.
Step 3: Set Up a Privacy Notice That Actually Works
Your privacy notice must now list each piece of data you collect — individually. Saying you collect ‘user information’ is not enough. You need to explicitly mention the mobile number, email address, IP address, browsing behaviour, device ID, and anything else you track.
Include a direct link or method through which users can withdraw consent or exercise their rights. This is now a legal requirement, not optional.
Step 4: Build a Data Principal Rights Portal
Under the DPDP Act, individuals have the following rights:
- Right to access know what data you hold about them
- Right to correction fix inaccurate or outdated information
- Right to erase request deletion when the purpose is fulfilled
- Right to grievance redressal raise complaints and get a resolution
- Right to nominate appoint someone to exercise rights on their behalf
You need a working system not just a policy document that lets users submit these requests and get timely responses.
Step 5: Implement Six Security Safeguards
The DPDP Rules 2025 require Data Fiduciaries to implement these six technical safeguards:
- Encryption of personal data in storage and transit
- Access controls — who can see what data, and with what authorization
- Audit logging and monitoring of access to personal data
- Regular data backups
- Mechanisms to detect unauthorized access
- System and processing logs retained for at least one year
Step 6: Handle Children’s Data with Extra Care
If your platform serves users under 18, you must verify parental identity before processing their data. Tools like DigiLocker can be used for this verification. You also cannot show targeted advertising to children or track their behaviour.
Step 7: Check If You Are a Significant Data Fiduciary
Some organizations will be classified as Significant Data Fiduciaries (SDFs) based on the volume of data processed, the sensitivity of data, and the national security implications. If your business is designated as an SDF, you have additional requirements, including annual data audits, appointing a Data Protection Officer (DPO), and restrictions on cross-border data transfers.
Step 8: Review Your Vendor and Third-Party Contracts
Every vendor who processes personal data on your behalf is a Data Processor. Your contracts with them must include DPDP-compliant data processing terms. You are responsible for what your vendors do with user data.
Key Timelines to Remember
- November 2025: DPDP Rules notified; Data Protection Board of India established
- November 2026: Consent Manager registration opens
- May 2027: Full compliance kicks in — consent, notice, breach reporting, data principal rights, SDF obligations.
How AI Can Make DPDP Compliance Easier
Manual compliance is not scalable. If you process data for thousands or millions of users, tracking consent records, managing rights requests, and monitoring breaches through spreadsheets will not hold up in an audit.
AI-powered compliance platforms like DPDP AI can automate data mapping, flag violations before they happen, manage consent workflows, generate audit-ready documentation, and send breach notifications — all without manual effort. The goal is to move compliance from a periodic exercise to a continuous, automated system.
Final Thought
DPDP compliance is not just a legal checkbox. It is about building trust with your customers. Organizations that get this right early will have a competitive edge — because data privacy is fast becoming a purchase decision, not just a regulatory formality. Start with this checklist, assess your gaps, and begin fixing them one step at a time.
