Digital Personal Data Protection - Compliace Checklist

India's Digital Personal Data Protection (DPDP) Act, 2023 became fully enforceable when the DPDP Rules, 2025 were notified on 13 November 2025. Every organisation that determines why and how personal data is processed — a Data Fiduciary under Section 2(i) — now works to a fixed compliance clock that closes around May 2027, with maximum penalties of INR 250 crore and, for repeat offenders, the power for the Central Government to block public access to the platform entirely.

Who must comply with the DPDP Act?

The Act applies to any Data Fiduciary — defined in Section 2(i) as any person who, alone or in conjunction with others, determines the purpose and means of processing personal data. This covers companies, LLPs, partnerships, HUFs, associations of persons and the State itself. Liability rests with the Fiduciary under Section 8(1) regardless of whether processing is outsourced to a third-party Data Processor.

The definition of personal data in Section 2(t) is deliberately broad: any data about an identifiable individual, including names, phone numbers, email addresses, IP addresses, device identifiers, transaction records and health records. Data collected on paper and later digitised is equally covered — a scanned KYC form becomes digital personal data. Only genuinely anonymised data falls outside the Act's scope.

What are the DPDP compliance deadlines?

The DPDP Rules 2025 commence in three stages, each measured from 13 November 2025:

• Immediate — Rules 1, 2 and 17 to 21. Governance structure, data mapping and Data Processor contract review.
• 12 months, by November 2026 — Rule 4. Consent Manager registration and the seven-year record retention obligation.
• 18 months, approximately May 2027 — Rules 3, 5 to 16, 22 and 23. Notice and consent redesign, security safeguards, breach notification, grievance redressal, children's data protection and Significant Data Fiduciary obligations.

What are the penalties under the DPDP Act?

Penalties are set by the Schedule to Section 33 and are calibrated so that non-compliance is never economically rational:

• Up to INR 250 crore (approximately USD 30 million) — failure to take reasonable security safeguards to prevent a personal data breach.
• Up to INR 200 crore — breach of obligations relating to children, including processing without verifiable parental consent, and tracking or behavioural advertising directed at children under 18.
• Up to INR 50 crore — failure to notify a data breach, breach of notice and consent obligations, and other duties under the Act.

Section 37 carries the most severe consequence. Where the Board has imposed monetary penalties on a Data Fiduciary on two or more separate occasions, the Central Government may direct that public access to that Fiduciary's platform or computer resources be blocked — effectively a forced shutdown of digital operations.

What must a Data Fiduciary actually do?

Phase 1 — Foundation, immediately

• Constitute a DPDP task force spanning legal, IT, HR and senior management, with a Compliance Lead accountable to the Board.
• Complete a data mapping exercise covering every category of personal data held, the legal basis for holding it, where it is stored, who processes it and where it flows, including cross-border transfers.
• Audit Data Processor contracts and add DPDP-compliant security safeguard clauses to all new and renewed agreements.
• Assess whether the organisation is likely to be notified as a Significant Data Fiduciary, which triggers Data Protection Officer appointment, annual Data Protection Impact Assessments and independent audits.

Phase 2 — Notice and consent, by 18 months

• Rebuild every consent touchpoint — website forms, mobile applications and physical sign-up forms — to meet the notice and consent architecture of Section 6 and Rule 3.
• Remove all pre-ticked boxes and bundled consents, moving to granular, purpose-specific consent.
• Make consent withdrawal as easy as giving consent in the first place.
• Issue retroactive notices to existing users who consented before the Act commenced.

Phase 3 — Technical infrastructure, by 18 months

• Encrypt personal data at rest and in transit.
• Deploy access controls and log management with a minimum of one year of log retention.
• Build a breach detection and notification pipeline capable of meeting the 72-hour Board notification window.
• Automate data erasure workflows, including 48-hour advance notice to Data Principals before erasure.

Phase 4 — Continuous governance

• Apply a Privacy by Design review to every new product, service and system.
• Run annual DPDP training for all employees who handle personal data.
• Maintain a compliance calendar tracking Board notifications, regulatory updates, audit deadlines and DPIA cycles.

The three principles underpinning the Act

• Privacy by Design — data protection must be embedded into products, services and processes from the outset, not added afterwards.
• Fiduciary responsibility — the organisation determining how and why data is processed bears full accountability, regardless of who actually processes it.
• Data minimisation — only data strictly necessary for the stated purpose may be collected and processed.

What the complete framework contains

The full 17-page framework sets out the end-to-end Data Fiduciary compliance process flow mapped to each applicable Section and Rule, the complete penalty schedule, the commencement timeline, and a comprehensive compliance checklist mapping every material action to its regulatory reference, deadline, priority level and penalty exposure — designed to be used as a master action register for a DPDP compliance programme. It also includes an appendix of key statutory definitions with their practical impact.

Prepared by Thinkbiz Professionals LLP, a multi-disciplinary firm of Chartered Accountants, Company Secretaries, Lawyers and Registered Valuers based in Noida, advising clients across India, the UAE, Singapore, Malaysia and the United States. This summary is general advisory information and does not constitute legal advice.