212 days until DPDP's core obligations apply on 14 May 2027Check your readiness free
Corelinksys DPDP

DPDP compliance checklist: 40 points to check before May 2027

Use these 40 questions to see how ready your organisation is for the DPDP Act and DPDP Rules, 2025. Each point shows the Section of the Act or Rule it comes from.

By Corelinksys DPDP · Updated 13 October 2026

Key points

  • 40 checks across 8 areas: governance, data inventory, notice and consent, rights, security, breach response, retention, and children and vendors.
  • Each point cites the Section of the DPDP Act or Rule it comes from.
  • Anything that is not a clear Yes is a gap to close before 14 May 2027.
  • The same questions are available as a free online readiness check with an emailed score.
Want your score? Answer the same 40 questions in our free online DPDP Readiness Check and get your score by area and your top gaps by email.

Mark each point Yes, Partly or No. Anything that is not a clear Yes is a gap to plan for before 14 May 2027.

A. Governance

  1. A named person or team is accountable for DPDP compliance. Sec 8(1)
  2. Contact details for data protection questions are published on your website. Sec 8(9)
  3. Leadership has approved a data protection policy. Sec 8
  4. Staff who handle personal data were trained on DPDP in the last 12 months. Sec 8(5)
  5. You have assessed whether you could be notified as a Significant Data Fiduciary. Sec 10

B. Data inventory

  1. You have a written list of every system that holds personal data. Sec 8
  2. For each category of personal data you know the purpose it is collected for. Sec 5, 6
  3. You know which vendors and cloud services receive personal data. Sec 8(2)
  4. Source code, logs and test data have been checked for personal data. Sec 8(5)
  5. The inventory has an owner and is reviewed at least once a year. Sec 8

C. Notice and consent

  1. Every form that collects personal data shows a notice at or before collection. Sec 5 · Rule 3
  2. Notices state the data collected, the purpose, and how to withdraw consent or complain. Rule 3
  3. Notices are offered in English and in the local language your users read. Sec 5(3)
  4. Consent is recorded with what was agreed, when, and through which channel. Sec 6
  5. Withdrawing consent is as easy as giving it, and processing stops when it is withdrawn. Sec 6(4)

D. Rights and grievances

  1. People can request a summary of their data and who it was shared with. Sec 11
  2. Correction and erasure requests have a defined process and owner. Sec 12
  3. Grievances are logged and answered within a fixed time limit. Sec 13 · Rule 14
  4. Identity is verified before a rights request is fulfilled. Rule 14
  5. People can nominate someone to exercise their rights on their behalf. Sec 14

E. Security safeguards

  1. Personal data is encrypted at rest and in transit. Rule 6
  2. Access to personal data is limited by role and reviewed regularly. Rule 6
  3. Logs of access to personal data are kept for at least one year. Rule 6
  4. Backups are protected and restores are tested. Rule 6
  5. Safeguards are reviewed after every major system change. Rule 6

F. Breach response

  1. A written breach response plan names who does what. Sec 8(6)
  2. Staff know how and to whom to report a suspected breach. Sec 8(6)
  3. You can inform affected people without delay, in plain language. Rule 7
  4. You can send a detailed report to the Data Protection Board within 72 hours. Rule 7
  5. A breach drill has been run in the last 12 months. Sec 8(6)

G. Retention and erasure

  1. Each category of personal data has a defined retention period. Sec 8(7)
  2. Data is erased when its purpose is served or consent is withdrawn. Sec 8(7)
  3. People are told at least 48 hours before their data is erased. Rule 8
  4. Erasure covers backups, exports and vendor copies. Sec 8(7)
  5. Every erasure is logged as evidence. Sec 8(7)

H. Children and vendors

  1. You know which of your users are under 18. Sec 9
  2. Verifiable parental consent is obtained before processing a child's data. Sec 9 · Rule 10
  3. No tracking, behavioural monitoring or targeted advertising is aimed at children. Sec 9(3)
  4. Every vendor that processes personal data has a contract covering DPDP duties. Sec 8(2)
  5. Vendors are required to report breaches to you promptly. Sec 8(2)

How to use this checklist

Start with the areas where you answered No. Gaps in breach response and security safeguards carry the highest penalties, so they usually come first. Then work through notices and consent, which touch every form and website you run.

Frequently asked questions

What should a DPDP compliance checklist cover?

At minimum: governance and ownership, a data inventory, notices and consent, Data Principal rights and grievances, security safeguards, breach response, retention and erasure, children's data and vendor contracts.

How long does DPDP compliance take?

For most mid-size organisations, six to twelve months: data mapping, policy approval, system and form changes, vendor contract updates and staff training. Starting early leaves time before 14 May 2027.

Is there a free DPDP readiness assessment?

Yes. The Corelinksys DPDP Readiness Check is free, takes about 10 minutes and emails you a score with your top gaps.

Official sources

This guide explains the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 in plain language for operational planning. It is not legal advice; check details against the official text and with your legal counsel.

Get DPDP-ready before 14 May 2027.

Start with the free readiness check, or talk to us about a gap assessment.

Book a consultationTake the free check