DPDP Compliance
Checklist

Any data fiduciary that processes the digital personal data of individuals in India — whether the processing happens in India or abroad in connection with offering goods or services to people in India. There is no turnover or headcount threshold, so startups and large enterprises alike are in scope.

The Act received presidential assent in August 2023, and the DPDP Rules 2025 phase the operative obligations over a runway extending into 2026–27. Consent notices, security safeguards, and breach reporting land first, with Consent Manager registration and Significant Data Fiduciary duties following. Because data mapping and consent re-engineering take months, most organizations should start six to nine months before their obligations bite.

Start with a gap assessment and a data inventory: map every processing activity and its lawful basis. From there, draft privacy notices and consent flows, implement reasonable security safeguards, build data-principal rights and grievance mechanisms, and put a breach response playbook in place. Significant Data Fiduciaries must additionally appoint a DPO and an independent auditor.

For most SMEs and mid-market companies, an end-to-end DPDP program — gap assessment, data mapping, policies, consent flows, breach playbooks, and training — costs ₹1.5–4 lakh (indicative). The final figure depends on your data footprint, the number of processing activities, and whether Significant Data Fiduciary obligations apply.

The Data Protection Board can impose monetary penalties of up to ₹250 crore per instance for failing to maintain reasonable security safeguards, up to ₹200 crore for breach-notification and children’s-data violations, and lower slabs for other defaults. Penalties apply per instance, so a single incident touching several obligations can compound quickly.