DPDP Compliance Checklist

Ask a general AI assistant about DPDP and it will answer you in GDPR. Answer a few real questions about how your product handles user data and get a readiness check against India's own Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025, including the duties that never reach a company your size.

This tool is free. Prefer we just handle it for you?

What does your product do, and what personal data do you collect from users (for example name, email, phone, location, payment details, health data)? *Include anything that arrives on paper and then gets typed or scanned in, such as KYC documents, intake forms or business cards. Paper that gets digitised is covered too. If you are outside India but have Indian users, say so.

Whose personal data do you hold, besides customers? *Employees, contractors, job applicants and past applicants all count. This is the population founders forget, and it is usually the one that asks questions first.

How do you actually collect consent today, and how would you prove that a specific user consented on a specific day? *Describe the real flow rather than the policy language. The second half of the question matters as much as the first, because under DPDP the company carries the burden of proving consent was validly obtained.

Do you have a written rule for how long data is kept and when it gets deleted? And what happens today if a user emails asking for their data, or asking you to delete it?"Nothing written down yet" is a perfectly normal answer at this stage and is more useful to us than a guess.

What security measures are in place today (encryption, access controls, logging), and if you had a data breach on a Saturday night, who decides what happens and who do they contact?"Not sure" is a valid answer. The breach half of the question is about the process and the named owner, because the clock for reporting starts the moment someone becomes aware.

Which third parties touch personal data, and have you signed data-protection terms with them? Has any customer sent you a data-processing agreement or a security questionnaire?Analytics, payment gateway, cloud hosting, email and SMS, CRM, ad networks, AI APIs and offshore contractors all count. The last question matters because that contract usually arrives well before the compliance deadline does.

Could anyone under 18 realistically sign up or use your product? *Under DPDP a child is anyone under 18, which is higher than the line most global products are built to.

Do you store or transfer user data outside India (a cloud region, an overseas vendor, an offshore team with access)? *

Are you in a regulated sector with its own data rules (fintech or payments, lending, healthcare, insurance, capital markets, edtech)?These regimes sit on top of DPDP and several of them are stricter, so a DPDP-only answer would mislead you.

Is your company recognised as a startup by DPIIT? *

Upload your current privacy policy or user notice, if you have one.PDF, Word (.docx), plain text (.txt) or Markdown (.md), or paste a link to your live privacy policy page. Skip it if you don't have one yet and we will assess on your answers alone.

Email *

Legal basis

ConceptIndia

DPDP Security Safeguards & Breach Notification

Rule 6 requires encryption, access controls, masking, monitoring, incident-response plans, and processor security clauses. Rule 7 requires breach notification to the Board and every affected Data Principal without undue delay, with a detailed report within 72 hours and no internal 'materiality' filter.

DefinitionIndia

Significant Data Fiduciary (SDF)

A Data Fiduciary specifically notified by the Central Government (S.10) — not a self-assessment by size or user count — that carries added obligations: an India-based DPO, annual DPIA and independent audit, and algorithmic-risk review.

ConceptIndia

DPDP Notice & Consent Standard

Notice must be standalone and precede consent (S.5, Rule 3); consent must be free, specific, informed, unconditional, and unambiguous via clear affirmative action (S.6) — DPDP has no GDPR-style 'legitimate interest' basis, and withdrawal must be as easy as giving consent.

LawIndia

Digital Personal Data Protection Rules, 2025

Operational rules under the DPDP Act, notified 13 November 2025. Translate the Act's principles into concrete detail: notice format, consent-manager registration, security controls, breach timelines, retention defaults, children's-data verification, and cross-border transfer conditions.

ConceptIndia

DPDP Retention & Erasure Rules

Personal data must be erased once its specified purpose is no longer served (S.8(7)) — purpose-tied, not 'as long as necessary.' Rule 8 layers a 48-hour pre-erasure notice, a one-year minimum log-retention floor, and a 3-year default erasure window for entities above defined scale thresholds.

ConceptIndia

DPDP Children's & Disability Data Rules

DPDP sets the 'child' threshold at under 18 (not COPPA's 13 or GDPR's 16), requires verifiable parental/guardian consent via an actual verification method, and absolutely bars tracking or targeted advertising directed at anyone flagged under 18 — a prohibition that cannot be unlocked even with parental consent.

LawIndia

Digital Personal Data Protection Act, 2023

India's cross-sector data protection statute — 44 sections across 9 chapters, Presidential assent 11 August 2023. Governs how Data Fiduciaries handle the digital personal data of Data Principals; phased commencement runs through 13 May 2027.

ConceptIndia

DPDP Section 17(3) Startup Exemption — Not Yet Notified

S.17(3) lets the Central Government exempt DPIIT-recognised startups from notice, accuracy, erasure, and Significant Data Fiduciary obligations — but as of the last verification for BuildWright's internal DPDP checklist, that notification has not been issued. DPIIT recognition alone changes nothing under DPDP today.

DefinitionIndia

Data Principal (DPDP Act)

The individual to whom the personal data relates — the DPDP Act's term for the person holding rights under the Act (consent, access, correction, erasure, grievance, nomination).

DefinitionIndia

Data Fiduciary (DPDP Act)

Any entity that, alone or with others, determines the purpose and means of processing personal data — the DPDP Act's term for the party bearing compliance obligations (S.2(i)).

ConceptIndia

DPDP Penalty Framework (Section 33)

All DPDP penalties are purely monetary, imposed by the Data Protection Board after inquiry — no criminal sanctions. Range: ₹10,000 (Data Principal duty breach) up to ₹250 crore (security-safeguard failure leading to a breach), with up to a 2x enhancement for serious/repeat violations.

Learn the details

Guides that walk through every step.

Guide

buildwright.co.in

What Your Website Legally Needs in India: Terms, Privacy, Refunds, and the E-Commerce Rules

A live Indian website needs Terms of Use, a DPDP-compliant Privacy Policy, and a Refund Policy if it takes payment. Selling to consumers pulls in the Consumer Protection (E-Commerce) Rules 2020, with a B2B exclusion most founders get wrong.

Prefer to skip the paperwork?

BuildWright can take this off your plate — done properly, the first time.