DPDP compliance checklist: every duty, who it applies to, who does the work

A DPDP compliance checklist is the full list of duties India's Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 put on a business. Most duties apply to every business that collects personal data, whether or not it is a Significant Data Fiduciary (SDF). Only a short list is for SDFs alone. Most duties start on 13 May 2027. About half can be handled by a consent tool. The rest are changes to your own product, systems and contracts, such as encryption, access logs and breach response.

This guide lists every duty. For each one it shows whether it applies to you, what is expected, and who has to do the work.

Who's who

Term	Who it is	Example
Data Principal	The person the data is about: the owner of the data. For a child, the parent; for a person with disability who has a lawful guardian, the guardian	A customer, a website visitor, an employee
Data Fiduciary	The business that decides why and how the data is used. It carries the duties in this checklist	Your company, for your own customers
Data Processor	A business that processes data on the fiduciary's behalf	Your email tool, CRM, cloud host or contact centre
Consent Manager	A company registered with the Board that lets people give, manage, review and withdraw consent across businesses from one platform	A consent dashboard used by many banks
Significant Data Fiduciary (SDF)	A fiduciary the Government names because of the volume or sensitivity of its data, or its risk to people or the State	None named yet
Data Protection Board	The regulator that hears complaints, runs inquiries and imposes penalties. It works as a digital office

The data owner: rights and duties

The Act gives the Data Principal six rights. Each one is a duty for you: a way to receive the request, and a reply within your published time.

The person can	What you must do	Where in the law
Know before agreeing: get a notice in English or a language of the Eighth Schedule	Show the notice before or with every consent request	s.5, R.3
Withdraw consent at any time, as easily as they gave it	Stop, and make your processors stop, within a reasonable time. Processing done before the withdrawal stays lawful	s.6(4)-(6)
Get a summary of their data, how it is used, and every business it was shared with	Reply with the summary, the names of other fiduciaries and processors, and what was shared	s.11
Correct, complete, update or erase their data	Make the change, or erase unless the purpose or a law needs the data	s.12
Raise a grievance and get an answer	Reply within the period you publish, at most 90 days. The person must try you first before going to the Board	s.13, R.14(3)
Nominate someone to act for them after death or incapacity	Record the nominee and honour their requests	s.14, R.14(4)
Use a Consent Manager to give or withdraw consent	Accept consent and withdrawals that come through a registered Consent Manager	s.6(7)-(9)
Complain to the Board after using your grievance channel	Answer the Board's inquiry	s.13(3), s.27

The rights to a summary and to correction and erasure cover data processed on consent or given voluntarily for a stated purpose. They do not cover the other legitimate uses, such as employment.

The Data Principal also has five duties. Breaking them can cost them up to ₹10,000:

1. Follow the law when using their rights.
2. Not impersonate anyone when giving personal data.
3. Not hide material facts when giving data for a Government ID or proof of identity or address.
4. Not file false or frivolous grievances or complaints.
5. Give only verifiably true information when asking for a correction or erasure.

These duties never excuse yours. Your obligations stay the same even if a person fails theirs (s.8(1)).

Key dates

Date	What starts
13 November 2025	The Rules were published. The Data Protection Board was set up in law
13 November 2026	Consent Managers can register with the Board
13 May 2027	Almost every duty in this list, and the penalties

How to read the tables

• Non-SDF / SDF: Yes means the duty always applies. If relevant means it applies only if you do that thing, for example process children's data. No means it does not apply.
• Who does the work:
  • Consent tool: a consent management platform covers it.
  • Your systems: an engineering change in your own product or infrastructure, which no consent tool can make.
  • Your process: policy, contracts or people.
  • Shared: a tool helps, but your systems must act too.
• pactbase: what pactbase does for that duty today.
• Where in the law: "s." is a section of the Act; "R." is a rule.

As of October 2026, the Government has not named any business as a Significant Data Fiduciary. If you have not been named, the Non-SDF column is yours.

1. Lawful basis, notice and consent

Duty	Where in the law	Non-SDF	SDF	What is expected	Who does the work	pactbase
Process personal data only for a lawful purpose, with consent or for a listed legitimate use	s.4	Yes	Yes	A list of every purpose, each with its basis	Shared	Purpose registry with a basis on each purpose
Use legitimate use only for the listed cases: data the person gave you for a stated purpose, State benefits and functions, legal duties, court orders, medical emergencies, epidemics, disasters, and employment	s.7	Yes	Yes	Employee data can rest on employment. Marketing cannot: it needs consent	Your process	Basis tag per purpose
Give a notice before or when you ask for consent: itemised data, purpose, the goods or services it enables, how to withdraw, how to use rights, how to complain to the Board	s.5(1), R.3	Yes	Yes	A standalone notice in plain language, linked at every place you collect data	Consent tool	Versioned notices, linked from every form
Offer the notice and the consent request in English or any of the 22 languages of the Eighth Schedule	s.5(3), s.6(3)	Yes	Yes	A language choice on the notice and the consent request	Consent tool	22 languages on the banner and notices
Show a contact for privacy questions in the consent request itself	s.6(3)	Yes	Yes	Contact details next to the request	Consent tool	Contact shown on the consent request
Send a notice to people whose data you collected before the law started, as soon as reasonably practicable	s.5(2)	Yes	Yes	Notify old customers and leads. You may keep processing until they withdraw	Consent tool	Re-consent campaigns with proof in the ledger
Consent must be free, specific, informed, unconditional and unambiguous, given by a clear action, and limited to the data needed	s.6(1)	Yes	Yes	One unticked box per purpose. Refusing optional consent never blocks the service	Consent tool	Consent forms and cookie banner
A consent term that breaks the law is invalid to that extent	s.6(2)	Yes	Yes	No clauses that waive rights, for example the right to complain	Your process	—
Cookies and trackers that collect personal data need consent (our reading of the Act)	s.6	Yes	Yes	Find every tracker, hold it until the visitor agrees, check that Reject works	Consent tool	Scanner, banner, script blocking, Reject and GPC tests
Withdrawing must be as easy as giving consent	s.6(4)	Yes	Yes	A withdraw link in every notice and email, and a preference page	Consent tool	Preference center and trust center
After a withdrawal, stop processing within a reasonable time and make your processors stop	s.6(6)	Yes	Yes	The withdrawal reaches your email, CRM, billing and ad tools	Shared	Webhooks, consent API and withdrawal notices to processors. Your tools act on them
If a dispute arises, prove that you gave notice and got consent	s.6(10)	Yes	Yes	A tamper-evident record per decision: notice version, time, source, purposes	Consent tool	Append-only consent ledger and receipts
Accept consent given through a registered Consent Manager	s.6(7)-(9), R.4	If relevant	If relevant	Connect with Consent Managers once they are registered	Consent tool	Not yet

2. Handling data responsibly

Duty	Where in the law	Non-SDF	SDF	What is expected	Who does the work	pactbase
You stay responsible for everything your processors do for you	s.8(1)	Yes	Yes	Know every processor and what it does	Your process	Vendor register, records of processing
Use a processor only under a valid contract	s.8(2)	Yes	Yes	A data processing agreement with every vendor that touches personal data	Your process	Vendor and DPA templates
Keep data complete, accurate and consistent when it is used for a decision about the person or shared with another business	s.8(3)	Yes	Yes	Data quality checks in your CRM and core systems; corrections reach every copy	Your systems	Correction requests, sent on to your systems
Put technical and organisational measures in place to comply with the Act	s.8(4)	Yes	Yes	Named owners, policies, training, records of processing	Your process	Records of processing, policy library, employee training

3. Security safeguards: work in your own systems

The Act requires reasonable security safeguards (s.8(5)), and Rule 6 lists the minimum. No consent tool can do this work for you. It is engineering and IT work in your own product, cloud and offices, and it carries the highest penalty in the Act.

Duty	Where in the law	Non-SDF	SDF	What is expected	Who does the work	pactbase
Encrypt, obfuscate, mask or tokenise personal data	R.6(1)(a)	Yes	Yes	Encryption at rest (databases, files, recordings, backups) and in transit. Masking in screens and logs	Your systems	—
Control access to the systems that hold personal data, yours and your processors'	R.6(1)(b)	Yes	Yes	Role-based access, single sign-on with multi-factor, least privilege, regular access reviews	Your systems	—
See who accesses personal data, through logs, monitoring and review	R.6(1)(c)	Yes	Yes	Audit logs of who opened which record, with alerts	Your systems	—
Keep processing going after a breach or loss, for example with backups	R.6(1)(d)	Yes	Yes	Tested backups and a recovery plan	Your systems	—
Keep those logs and the related personal data for one year, unless another law requires otherwise	R.6(1)(e)	Yes	Yes	Log retention of at least one year	Your systems	—
Write security duties into every processor contract	R.6(1)(f)	Yes	Yes	A security clause in each DPA	Your process	DPA templates
Take organisational measures so the safeguards are actually followed	R.6(1)(g)	Yes	Yes	A security programme, policies, training and periodic reviews	Your process	Employee training

4. Breaches, retention and erasure

Duty	Where in the law	Non-SDF	SDF	What is expected	Who does the work	pactbase
Tell each affected person about a breach without delay: what happened, the likely consequences, what you are doing, what they can do, and who to contact	s.8(6), R.7(1)	Yes	Yes	Templates, a recipient list, a log of what was sent	Shared	Breach register with notice tracking
Tell the Data Protection Board without delay, then send a detailed report within 72 hours of becoming aware	s.8(6), R.7(2)	Yes	Yes	An incident log, a 72-hour clock, a report template	Shared	Breach register with a 72-hour clock. Detecting the breach is your security team's job
Erase data when consent is withdrawn or the purpose is served, whichever comes first, unless a law requires you to keep it	s.8(7)(a)	Yes	Yes	A retention period for each purpose and system, and deletion jobs	Shared	Retention schedules, deletion reminders and a deletion log
Make your processors erase too	s.8(7)(b)	Yes	Yes	An erasure instruction to each processor, with confirmation	Shared	Withdrawal and erasure notices to processors
Large platforms: treat data as no longer needed after 3 years without contact, and warn the person 48 hours before erasing	s.8(8), R.8(1)-(2)	If relevant	If relevant	Only e-commerce and social media platforms with 2 crore+ registered users in India, and online gaming platforms with 50 lakh+	Your systems	—
Keep personal data, traffic data and processing logs for at least one year from the processing, including at your processors, then erase them	R.8(3)	Yes	Yes	Retention rules must not delete these before one year	Your systems	Retention schedules can record it

5. Transparency, rights and grievances

Duty	Where in the law	Non-SDF	SDF	What is expected	Who does the work	pactbase
Publish the business contact of a person who answers privacy questions (the DPO, if you have one), on your site and in every reply to a rights request	s.8(9), R.9	Yes	Yes	A contact on your site or app, and in every response	Consent tool	Privacy contact on the trust center and in response templates
Publish how people can use their rights, and what identifier they need to give	R.14(1)	Yes	Yes	A rights page that names the identifier: email, mobile number, customer ID	Consent tool	Rights section on the trust center
Right of access: a summary of the person's data, how it is processed, and every business it was shared with	s.11	Yes	Yes	Verified intake, a lookup across your systems, a reply	Shared	Verified requests with deadlines and templates. Your systems supply the data
Rights to correct, complete, update and erase	s.12	Yes	Yes	The same workflow; the change reaches every system	Shared	Request workflow and webhooks
Right to nominate someone to act after death or incapacity	s.14, R.14(4)	Yes	Yes	A nomination request and a record of it	Consent tool	Nomination requests
A working grievance channel, with a response period of no more than 90 days published on your site	s.8(10), s.13, R.14(3)	Yes	Yes	Intake, an owner, a clock, a reply, a log	Consent tool	Grievances with deadline tracking

The rights to access, correct and erase cover data processed on consent or given voluntarily for a stated purpose. People must use your grievance channel before they can complain to the Board, so a fast, well-run channel is your first line of defence.

6. Children, guardians, transfers and Government requests

Duty	Where in the law	Non-SDF	SDF	What is expected	Who does the work	pactbase
Get verifiable parental consent before processing a child's data (under 18), checking that the parent is an identifiable adult	s.9(1), R.10	If relevant	If relevant	An age question, then a parent check against details you already hold, or a token such as DigiLocker	Shared	Parental consent with the check method recorded
Get verifiable consent from the lawful guardian of a person with disability, checking the guardian was appointed by a court or designated authority	s.9(1), R.11	If relevant	If relevant	A guardian check and a record of it	Shared	Guardian consent records
Do not process children's data in a way likely to harm them; no tracking, behavioural monitoring or targeted ads aimed at children	s.9(2)-(3)	If relevant	If relevant	Trackers and ad targeting off for children	Shared	Script blocking
Use the listed exemptions for children's data only within their limits, for example healthcare, schools, child safety, email-only accounts	s.9(4), R.12	If relevant	If relevant	Write down which exemption you rely on	Your process	—
Do not transfer data to a country the Government restricts. Stricter sector rules (RBI, IRDAI, SEBI) still apply	s.16, R.15	Yes	Yes	Know where every processor stores your data. No country is restricted yet	Shared	Cross-border transfer register with a restricted-country check
Give the Government information it asks for, for the listed purposes and within the time it sets	s.36, R.23	Yes	Yes	The ability to export your records quickly	Consent tool	Audit pack: one ZIP of your evidence for a period

7. Extra duties for Significant Data Fiduciaries only

The Government names SDFs based on the volume and sensitivity of the data they process, the risk to people, and the risk to sovereignty, security, elections or public order. None has been named yet. Data you process for your clients does not count towards this: your client is the fiduciary for that data.

Duty	Where in the law	Non-SDF	SDF	What is expected	Who does the work	pactbase
Appoint a Data Protection Officer based in India, answerable to the board	s.10(2)(a)	No	Yes	A named DPO who is also the grievance contact	Your process	DPO contact on the trust center
Appoint an independent data auditor	s.10(2)(b)	No	Yes	An external auditor	Your process	—
Every 12 months, carry out a Data Protection Impact Assessment and an audit, and send the key findings to the Board	s.10(2)(c), R.13(1)-(2)	No	Yes	An annual DPIA and audit report	Shared	DPIA module and audit pack
Check that algorithms and technical systems do not put people's rights at risk	R.13(3)	No	Yes	Algorithm reviews	Your systems	—
Keep data the Government specifies, and its traffic data, inside India	R.13(4)	No	Yes	Data localisation when directed	Your systems	Cross-border transfer register

A non-SDF does not have to do these, but a yearly impact assessment and a named privacy owner are good practice and win trust in enterprise deals.

8. If you process data for your clients

If you run a SaaS platform, a contact centre, a BPO, a cloud service or an agency, much of the data you hold belongs to your clients. Under the Act, the client is the Data Fiduciary and you are its Data Processor. The Act puts no direct duty on you, but your clients stay liable and must pass the duties on to you by contract. From 2027, expect every serious client to ask for these.

What clients will require	Comes from	Non-SDF	SDF	What is expected	Who does the work	pactbase
Process only on the client's documented instructions	s.8(1)-(2)	Yes, by contract	Yes, by contract	A DPA with every client; no other use of their data	Your process	DPA templates
Apply Rule 6 security to all client data, including files, recordings, transcripts and AI outputs	R.6(1)(f)	Yes, by contract	Yes, by contract	The same controls as in section 3	Your systems	—
Tell the client about a breach fast enough for them to report to the Board within 72 hours	s.8(6), R.7	Yes, by contract	Yes, by contract	An incident process with a client notice deadline, often 24 hours or less	Your process	Breach register for your own incidents
Help the client answer access and erasure requests and withdrawals	s.6(6), s.11, s.12	Yes, by contract	Yes, by contract	An API or console to find and delete one person's data	Your systems	Client events can be pushed into your systems by webhook
Keep processing logs for one year, then erase or return data when told or when the contract ends	s.8(7)(b), R.8(3)	Yes, by contract	Yes, by contract	Per-client retention settings and deletion confirmations	Your systems	—
Use sub-processors only with approval and on the same terms	s.8(2)	Yes, by contract	Yes, by contract	A published sub-processor list	Your process	Vendor register
Say where client data is stored and accessed from	s.16, sector rules	Yes, by contract	Yes, by contract	Data residency per client; an Indian region by default for regulated clients	Your systems	Cross-border transfer register

One exemption matters for exporters. If you process personal data of people outside India under a contract with a client outside India, most of the Act does not apply to that data (s.17(1)(d)). Two duties still apply: you stay responsible for your processors, and you must keep the data secure.

9. Other Indian rules you must follow anyway

These are not part of the DPDP Act, but they often come up in the same review.

Duty	Rule	What is expected
Report cyber incidents to CERT-In within 6 hours	CERT-In directions, April 2022	An incident process that runs alongside the DPDP breach steps
Keep system logs for 180 days, in India	CERT-In directions, April 2022	Log retention and storage location
Commercial calls and SMS: registration, consent and do-not-disturb checks	TRAI commercial communication regulations	Check numbers against preferences before you call or send
Sector rules on outsourcing and data location	RBI, IRDAI, SEBI	Clauses passed down by regulated clients
IT Act section 43A stays until 13 May 2027, when the DPDP Act removes it	IT Act, 2000	Keep your current security practices until then

10. Exemptions you should know

Some processing is exempt from most of the Act. Write down which exemption you rely on and why.

Exemption	What is exempt	Where in the law
Enforcing a legal right or claim	Most duties and rights, except responsibility for processors and security	s.17(1)(a)
Courts, tribunals and regulators doing their work	Same as above	s.17(1)(b)
Preventing, detecting, investigating or prosecuting an offence	Same as above	s.17(1)(c)
Data of people outside India, processed under a contract with a party outside India	Same as above	s.17(1)(d)
Court-approved mergers, demergers and similar schemes	Same as above	s.17(1)(e)
Finding the assets of a person who has defaulted on a loan from a financial institution	Same as above	s.17(1)(f)
Research, archiving or statistics, with no decision about any individual	The whole Act, if the standards in the Second Schedule are followed: lawful, limited to what is needed, accurate, kept only as long as needed, secure, accountable	s.17(2)(b), R.16
Startups and other notified fiduciaries	The Government may exempt them from the notice, accuracy, erasure, SDF and access duties. None notified yet	s.17(3)
Children's data in listed cases	Parental consent and the no-tracking rule do not apply to: healthcare and allied health; schools (for education and safety); crèches and day care (for safety); school transport (location tracking); email-only accounts; real-time location for a child's safety; blocking harmful content; and checking that a user is not a child	s.9(4), R.12, Fourth Schedule

11. Consent Managers

A Consent Manager is a separate, registered role, not the same as a consent management platform. Registration with the Board opens on 13 November 2026.

• Who can register: a company incorporated in India with a net worth of at least ₹2 crore, sound finances and management, and an interoperable platform independently certified against the Board's standards.
• What it must do: act for the person, not the business; never be able to read the data it routes; keep records of consents, notices and sharing for at least seven years; avoid conflicts of interest with fiduciaries; publish its owners and directors; not sub-contract its duties; and report audits to the Board.
• What it means for you: once Consent Managers are live, be ready to accept consent and withdrawals that come through them.

pactbase is a consent management platform for businesses. It is not a registered Consent Manager.

12. If someone complains: from grievance to appeal

1. Your grievance channel first. The person must use it before going to the Board.
2. Complaint to the Board. The Board also acts on your breach reports and on Government references. It works as a digital office.
3. Inquiry. The Board aims to finish within six months, and can extend this by up to three months at a time.
4. Mediation or an undertaking. The Board can send a matter to mediation, or accept a voluntary undertaking from you. An accepted undertaking ends that proceeding. Breaking it is treated as a breach of the Act.
5. Penalty. Only for a significant breach, after a hearing. See the table below.
6. Appeal. To the Appellate Tribunal (TDSAT), in digital form, within 60 days of the order.
7. Repeat penalties. If you are penalised two or more times, the Board can ask the Government to block public access to your service in India.

Penalties

Breach	Penalty up to
No reasonable security safeguards	₹250 crore
Not telling the Board or affected people about a breach	₹200 crore
Children's duties	₹200 crore
Extra SDF duties	₹150 crore
Any other duty in the Act or Rules	₹50 crore
A person's own duties (for example a false complaint)	₹10,000

The Board decides the amount for each case, based on: the nature, gravity and duration of the breach; the type of data; whether it repeats; any gain made or loss avoided; how quickly and well you limited the harm; and whether the penalty is proportionate.

What changed in October 2026

The Government issued the DPDP (Removal of Difficulties) Order, 2026. It fixes the wording in two places:

• Children and persons with disabilities: the consent rules apply to each group separately.
• SDF audits: the yearly SDF audit is a "data audit".

No date or duty changed. The SDF timeline is still 13 May 2027, and no restricted countries or SDFs have been named.

Where to start: ten steps

1. List your purposes and give each one a basis: consent or legitimate use.
2. Map your data: which systems and vendors hold personal data, and where they store it.
3. Publish a plain notice in the languages your customers use, and link it from every form.
4. Fix your consent capture: unticked boxes, a working cookie banner, and a record of every decision.
5. Connect withdrawals to your email, CRM and ad tools so they stop when a person says stop.
6. Sign DPAs with every processor, with security, breach notice and erasure clauses.
7. Close the security gaps: encryption, access control, access logs kept for a year, backups.
8. Set retention periods for each purpose and system, keeping logs for at least one year.
9. Rehearse a breach: who tells the people affected, and who sends the Board report within 72 hours.
10. Open your rights and grievance channels, with a named contact and published response times.

How pactbase helps

pactbase is a consent management platform built for the DPDP Act. It covers the consent-tool rows above, gives your own systems events and APIs for the shared rows, and keeps the records that prove you did each step.

• Consent: purposes with a basis, versioned notices, consent forms, an append-only ledger and receipts, re-consent campaigns.
• Cookies: a scanner, a banner in 22 languages, script blocking, and tests that Reject really works.
• Trust Center: your notice, your privacy contact and people's choices in one public place.
• Data Rights: verified access, correction, erasure and nomination requests, and grievances, each with a deadline.
• Webhooks and a consent API, so a withdrawal or an erasure reaches your own tools within seconds.

The security, data quality and product changes are yours to make, and this checklist shows which ones. For the first step, read legitimate use vs consent.

Start free or book a demo to walk through this list for your business.

Frequently asked questions

What rights does a data principal have under DPDP?

The right to a notice, to withdraw consent, to a summary of their data and who it was shared with, to correct and erase it, to a grievance answer, to nominate someone, and to complain to the Board after using your grievance channel.

Does the DPDP Act apply to businesses that are not Significant Data Fiduciaries?

Yes. Almost every duty applies to every business that processes personal data in digital form. Only five extra duties are for SDFs alone: an India-based DPO, an independent auditor, a yearly impact assessment and audit, algorithm checks, and data localisation when directed.

When do DPDP compliance duties start?

Most duties, and the penalties, start on 13 May 2027. Consent Managers can register from 13 November 2026.

Can a consent tool make my business DPDP compliant?

Only in part. A consent tool covers notice, consent, withdrawal, rights requests, grievances and proof. Security safeguards, data quality, retention in your own systems and processor contracts are changes you make yourself.

What security does DPDP require?

At minimum: encryption, masking or tokenisation; access control; access logs with monitoring; backups; logs kept for one year; security clauses in processor contracts; and organisational measures to make sure all of this is followed.

How fast must a data breach be reported under DPDP?

Tell affected people and the Data Protection Board without delay, then send the Board a detailed report within 72 hours of becoming aware. CERT-In separately expects cyber incidents within 6 hours.

Do the DPDP Act's duties apply to a company that processes data for clients?

The client, as Data Fiduciary, stays responsible. It must bind you by contract to its instructions, security, breach notice and erasure, so in practice these duties reach you through your client agreements.

Source

This checklist is based on the DPDP Act, 2023 and the DPDP Rules, 2025 as published in the Gazette of India, checked on 25 October 2026. Verify each duty against the official DPDP Rules, 2025 (MeitY) before you act on it.