50-Point Audit-Ready Checklist

DPDP Compliance Checklist for Indian Businesses

A rigorous, actionable compliance checklist compiled by LLM Advocates technology lawyers. Structured across all 8 chapters of the Digital Personal Data Protection Act 2023 and the 23 DPDP Rules 2025.

Book Independent Compliance Audit Interactive Self-Assessment Tool

1. Notice & Consent Architecture (Sections 5 & 6, Rule 3)

[ ] Notice is presented before or at the time of requesting consent under Section 5(1).
[ ] Notice explicitly specifies personal data categories collected and exact purposes (Section 5(1)(i)).
[ ] Notice explains how the Data Principal can exercise rights under Sections 11–14 (Section 5(1)(ii)).
[ ] Notice details the grievance redressal mechanism and contact details of the DPO/Grievance Officer (Section 5(1)(iii)).
[ ] Notice is available in English and 22 constitutional Eighth Schedule languages (Section 5(3), Rule 3).
[ ] Consent is free, specific, informed, unconditional, and unambiguous (Section 6(1)).
[ ] No bundled consent (consent is not conditioned on unnecessary data collection for goods/services).
[ ] No pre-ticked checkboxes or dark patterns (every purpose has an explicit affirmative toggle).
[ ] One-click withdrawal mechanism is available and as easy as giving consent (Section 6(4)).
[ ] Tamper-evident cryptographic proof chain (SHA-256) is recorded for every consent grant (Section 6(10)).

2. Purpose Limitation & Legitimate Uses (Sections 4 & 7)

[ ] All data collection is tethered to a specified lawful purpose (Section 4(1)).
[ ] Voluntary sharing basis is documented strictly for specified purposes (Section 7(a)).
[ ] Employment data processing is restricted to necessary employment purposes (Section 7(i)).
[ ] Medical emergency and epidemic response exceptions are documented (Section 7(d),(e)).
[ ] Secondary use prohibition: data collected for purpose A is never used for purpose B without fresh consent.

3. Data Governance, Processors & Security (Section 8)

[ ] Data Processing Agreements (DPAs) are signed with every third-party SaaS/vendor under Section 8(2).
[ ] Personal data accuracy and completeness are maintained when shared or used in decisions (Section 8(3)).
[ ] Reasonable technical security safeguards (AES-256 encryption, MFA, RBAC) are deployed under Section 8(4).
[ ] Automated deletion/erasure triggers are configured once the purpose is served (Section 8(7)).
[ ] Documented 72-hour breach response runbook for reporting incidents to DPBI and users (Section 8(6)).
[ ] Grievance redressal officer published with guaranteed 90-day resolution SLA (Section 8(9)).

4. Processing of Children's Personal Data (Section 9)

[ ] Age-gating mechanism implemented to identify Data Principals under 18 years of age.
[ ] Verifiable parental consent obtained before processing child data (Section 9(1)).
[ ] Absolute ban on tracking or behavioral monitoring of children (Section 9(3)).
[ ] Absolute ban on targeted advertising directed at children (Section 9(3)).
[ ] No processing likely to cause detrimental effect on child well-being (Section 9(2)).

5. Data Principal Rights Fulfillment (Sections 11–14)

[ ] User portal for requesting a summary of personal data processed (Section 11(1)(a)).
[ ] User portal for viewing identities of all Data Fiduciaries & Processors shared with (Section 11(1)(b)).
[ ] Workflow for correcting inaccurate or misleading personal data (Section 12(1)).
[ ] Automated cascade erasure across internal databases and third-party vendors (Section 12(3)).
[ ] Nomination mechanism enabling users to designate a representative in event of death (Section 14).
[ ] Public grievance redressal filing form with tracking reference number (Section 13).

6. Significant Data Fiduciary (SDF) Mandates (Section 10, Rule 10)

[ ] Formally appointed India-resident Data Protection Officer reporting to Board (Rule 10).
[ ] Independent data auditor engaged for periodic statutory audits (Section 10(2)(b)).
[ ] Periodic Data Protection Impact Assessments (DPIAs) conducted (Section 10(2)(c)).

Need Professional Validation of Your Checklist?

Self-reported checklists are helpful, but only an independent compliance audit by privacy counsels provides legal defensibility.

Book a DPDP Compliance Audit