Insights · Resource
Free resource
DPDPA readiness checklist
Twelve obligation areas under the DPDP Act 2023, each with the evidence a DPO should be able to produce. Use it to brief your Board or to scope remediation.
✓ Here's your checklist. Print it or save it as a PDF.
- 01 · Personal data inventoryA current map of every system holding personal data, including SaaS and cloud storage.
- 02 · Data classificationFields tagged by category: identity, financial, health, children's, biometric.
- 03 · Notice (Section 5)A clear, itemised notice in English and the relevant Indian languages, given at or before collection.
- 04 · Consent (Section 6)Consent that is free, specific and informed, and as easy to withdraw as it was to give. Records kept.
- 05 · Purpose limitationEach dataset tied to a stated purpose. No processing beyond that purpose.
- 06 · Retention & erasure (Section 8(7))Retention schedules defined, with deletion executed and evidenced when the purpose ends.
- 07 · Security safeguards (Section 8(5))Reasonable safeguards documented, tested and evidenced.
- 08 · Breach readiness (Section 8(6))A tested runbook for notifying the Board and affected principals within 72 hours.
- 09 · Children's data (Section 9)Verifiable parental consent, with no tracking or targeted advertising directed at children.
- 10 · Data principal rights (Sections 11–13)Working processes for access, correction, erasure, nomination and grievances.
- 11 · Processors & contractsEvery processor bound by contract, with a current sub-processor list.
- 12 · SDF assessment (Section 10)A determination of whether you are a Significant Data Fiduciary, with plans for the additional duties if so.
General information, not legal advice. Confirm obligations with your counsel.