DPDP Readiness Checklist Track your compliance progress
0 of 8 done
v1 · no save/export yet
Consent notice Give a notice with or before every request for consent Law, from 13 May 2027 (Section 5(1), Rule 3): when you ask for consent, the notice must say what you collect, why, how to withdraw consent, and how to complain to the Board. Good practice: tell people what you collect even where consent is not needed. Keep a record of the consent each user gave and when If you can't show what a user agreed to at the moment they signed up, you can't rely on their consent later. User rights Publish a rights-request process Explain how a user can ask for a copy of their data, correct it, or delete it — including which email or form they should use and how long you'll take to respond. Set up a way for users to raise complaints Law: set up a way to raise complaints (a grievance-redressal mechanism, Section 8(10)). Publish who can answer questions about your data use (Section 8(9)). Good practice: name a role and a working email. Breach response Have a written breach playbook Who inside your team gets paged when data leaks, who decides whether it's reportable, who drafts the notice to affected users, and who talks to the Board. Law, from 13 May 2027: tell affected users and the Board without delay, and send the Board a detailed report within 72 hours (Rule 7). Retention Write down how long you keep each type of personal data — and delete on schedule Law, from 13 May 2027 (Section 8(7)): erase personal data when consent is withdrawn or the purpose is no longer served, unless another law needs you to keep it. Law (Rule 8(3)): keep the data, traffic data and logs of each processing for at least one year, for the purposes in the Seventh Schedule, then erase them. Law, only for the classes listed in the Third Schedule (Rule 8(1)): erase after the time set there, and warn the user 48 hours before (Rule 8(2)). Good practice: write a retention period per data type, automate deletion, and log deletions. Cross-border Review where your user data actually lives Map your vendors and infrastructure. If any Indian user data leaves India, check whether that destination is on any restricted list. Children's data Decide how you'll handle users under 18 If your product can be used by children, you'll need verifiable parental consent (Section 9(1)). You must not track or monitor their behaviour, or target ads at them (Section 9(3)). If children aren't your audience, document your age-gating. Educational only — not legal advice. Ticking every box does not certify compliance; it means you have the pieces in place to have a productive conversation with counsel.