DPDP Compliance Checklist

A starting point for eight common business types — not a certificate. Completing every item here doesn't make a business legally compliant on its own; DPDP compliance depends on facts specific to your data practices that a general checklist can't capture.

8 min readLast updated: Last updated: September 2026
Key Takeaway
  • These checklists are a starting point for a conversation with your own team and counsel, not a substitute for one.
  • Every business should start with the general checklist below, then add the sector-specific items relevant to it — they're additive, not alternatives.
  • A completed checklist tells you where to look next, not that you're finished — DPDP compliance is an ongoing practice, not a one-time certification.
  • The most useful checklist is the one your team actually revisits, not the most exhaustive one that gets completed once and filed away.

General Business

  • Data inventory covers every system, spreadsheet, and vendor holding personal data.
  • Every consent request is purpose-specific, unbundled, and unticked by default.
  • A notice accompanies each consent request, in plain language.
  • Withdrawal is at least as easy as giving consent was.
  • A retention schedule exists per data category, with an actual deletion mechanism.
  • A published contact handles Data Principal rights requests and grievances.
  • A breach-response runbook exists and has been tested at least once.
  • Every vendor touching personal data has a data-protection-adequate contract.

Website

  • Cookie banner actually blocks non-essential scripts until consent is given.
  • Analytics and advertising pixels are gated behind their own purpose-specific consent.
  • Every form separates its core purpose from any optional marketing consent.
  • A consent log records what a given visitor actually agreed to, and when.

SaaS Company

  • Clear delineation of when you're acting as Data Fiduciary versus Data Processor for customer-uploaded data.
  • Data-processing terms with customers address sub-processor disclosure and breach-notification timelines.
  • Customer data deletion is genuinely available on account closure, not just access removal.
  • Cross-border data storage/processing locations are documented and disclosed to customers.

E-commerce

  • Checkout consent is separated from marketing consent, not bundled into one step.
  • If your platform exceeds the Third Schedule's user threshold (Chapter 08), the 3-year inactivity erasure rule and 48-hour notice requirement are implemented.
  • Payment data handling is scoped to what your payment processor actually requires, not stored redundantly in-house.
  • Order-history retention is tied to a documented business or legal justification, not indefinite by default.

Healthcare

  • Security safeguards are proportionate to the sensitivity of health data specifically, even though DPDP doesn't create a separate "sensitive data" tier.
  • Any children's health data processing has a verifiable-parental-consent pathway, with a documented view on whether a Section 9 exemption for healthcare purposes applies.
  • Access controls restrict health records to staff who genuinely need them for care delivery.
  • Breach-response plan accounts for the particularly high sensitivity of a health-data breach.

Digital Marketing

  • Marketing consent is channel-specific or at minimum separately toggleable per channel (email, SMS, WhatsApp).
  • Unsubscribe/withdrawal propagates to every downstream tool — CRM, ad platform, automation sequence.
  • Retargeting pixels are gated behind consent, not firing on page load by default.
  • No known or likely-minor users are included in targeted-advertising audiences.

Mobile Application

  • In-app permission requests (location, contacts, camera) are purpose-specific and explained in plain language at the point of request.
  • SDKs bundled into the app (analytics, ad networks, crash reporting) are inventoried for what data they collect and whether it's gated.
  • Account deletion in-app genuinely removes or anonymises the associated personal data, not just deactivates the account.
  • If the app has a plausible under-18 user base, Chapter 11's children's-data requirements are addressed directly, not assumed away.

Enterprise

  • A realistic assessment of whether Significant Data Fiduciary status is plausible, with the DPO, auditor, and DPIA groundwork started ahead of any formal notification.
  • Cross-departmental governance ownership is assigned, not left solely to IT or legal in isolation.
  • Vendor due diligence is standardised across procurement, not handled ad hoc per business unit.
  • Employee training reaches every function that handles personal data day to day, not only a compliance team.
Important

Completing every box above is a genuinely strong starting position — but it is not, on its own, a claim that your organisation is "100% DPDP compliant" or free of legal risk. Compliance depends on facts specific to your business (what data you actually hold, how your specific systems behave, decisions only qualified counsel can make for your situation) that a general checklist can't capture. Treat this as the floor to build from, not the finish line.

Related Topics

Chapter 18

DPDP Implementation

The full step-by-step roadmap this checklist condenses.

Chapter 20

DPDP Technology

Where software can help operationalise the items on this checklist.

Frequently Asked Questions

Does completing this checklist make my business legally compliant?

No — this checklist is a practical starting point, not a certification. DPDP compliance depends on your specific data practices and legal judgment calls that only qualified counsel can make for your business.

Which checklist should I use if my business spans more than one category?

Start with the general business checklist, then layer on every sector-specific list that applies — an e-commerce SaaS company handling healthcare data, for instance, would reasonably draw on all three.

How often should these checklists be revisited?

Whenever your business changes meaningfully — a new product line, a new major vendor, a new data category — plus at least periodically as a standing habit, since a checklist completed once and never revisited tends to drift out of date.

Sources

← PreviousDPDP ImplementationNext →DPDP Technology