Privacy & Data Protection · Checklist

DPDPA Readiness Checklist — every requirement, item by item.

A practical, section-by-section checklist for India's Digital Personal Data Protection Act — built for the teams who have to actually implement it, not just read about it, as DPDPA's phased obligations come into force. See our Compliance Deadline Tracker for which milestone applies to you right now.

Reviewed by Bhawna Narula, Founder & CTO, VVnT SeQuor · Last reviewed October 2026

Mapped to current published standards & statute text

171

Checklist items, each with a test procedure & evidence example

Stages, organized the way a real implementation unfolds

Free to use. Work through it here, no form needed. To get your readiness score, submit it for expert review below.

Expert review

Get your readiness score

Work through the checklist, then submit it — an expert scores it using Self-Compliance and emails you the result.

Check off at least one item below to unlock

Open "How to verify this" on any item for the exact test procedure & evidence an auditor would want Progress saves only in this browser — nothing is sent anywhere until you submit it for review

0 of 171 items checked off

Browsing:

GOV-01Board/senior-management-approved DPDP compliance programme exists and covers all processing of digital personal data (and digitised offline data) across business units, subsidiaries and geographies.High risks8(1); s4
How to verify this →
Test procedureInspect programme charter and approvals; confirm scope against legal-entity and business-unit list.
Practical example / evidenceProgramme charter; board/committee minutes; scope statement
GOV-02Entity's role (Data Fiduciary / Joint Fiduciary / Data Processor) is determined per processing activity and documented, including any s17 exemptions relied on.High risks2; s8(1); s17
How to verify this →
Test procedureReview role-mapping memo; sample 10 activities and test the role assigned against contracts and actual control over purpose/means.
Practical example / evidenceRole-mapping memo; exemption register
GOV-03Policy suite approved, version-controlled and reviewed at least annually: privacy, data protection, retention, breach response, rights handling, children's data, vendor management.Medium risks8(4)
How to verify this →
Test procedureInspect policies for approval date, owner, review cycle; verify they reflect Act/Rules requirements.
Practical example / evidencePolicy documents; policy review log
GOV-04Roles and responsibilities (RACI) defined for executive owner, privacy function, business data owners, IT/security, legal, HR, procurement; resourcing is adequate.Medium risks8(1)
How to verify this →
Test procedureInspect RACI/org chart; interview privacy lead and 3 business data owners on awareness of duties; compare headcount/budget to plan.
Practical example / evidenceRACI; org chart; budget approval
GOV-05Management oversight: privacy KPIs, risks and incidents are reported to senior management/board at defined intervals (suggested: quarterly).Medium risks8(1)
How to verify this →
Test procedureInspect last 4 management/board packs and minutes for privacy reporting and recorded decisions.
Practical example / evidenceBoard/ExCo packs; minutes
GOV-06Privacy and DPDP penalty exposure are integrated into the enterprise risk register with owners and treatment plans.Medium risks33; Schedule
How to verify this →
Test procedureInspect risk register entries; check treatment plans and due dates are current.
Practical example / evidenceRisk register extract
GOV-07Overlap with sectoral and other laws is mapped (e.g. RBI, SEBI, IRDAI, TRAI, CERT-In, IT Act, labour/tax/retention laws) and conflicts are resolved with documented legal opinion.Medium risks38
How to verify this →
Test procedureReview legal register and conflict analysis; confirm stricter sectoral requirement is applied where relevant.
Practical example / evidenceLegal/regulatory register; legal opinions
GOV-08Responsibilities for shared data between group entities / joint fiduciaries are allocated in writing.Medium risks8(1)
How to verify this →
Test procedureInspect intra-group agreements/data-sharing arrangements; confirm accountable entity per dataset.
Practical example / evidenceIntra-group agreements
GOV-09Exceptions, waivers and risk acceptances against DPDP controls are logged, approved by an accountable executive and time-bound.Low risks8(1)
How to verify this →
Test procedureInspect exception register; test 5 items for approval and expiry.
Practical example / evidenceException register

Stage 1 of 20

INV-01A complete inventory / record of processing activities (RoPA) exists: purpose, data elements, data principals, source, systems, recipients, location and retention.High risks4-s8 (basis for all duties)
How to verify this →
Test procedureInspect RoPA; trace 10 business processes end-to-end and confirm each appears with all attributes.
Practical example / evidenceRoPA / data inventory
INV-02Personal data discovery is performed across structured and unstructured stores (databases, SaaS, file shares, email, endpoints, logs, backups, shadow IT) and reconciled to the inventory.High risks8(4)
How to verify this →
Test procedureReview discovery/DSPM scan outputs; sample 5 unlisted repositories and confirm whether they hold personal data.
Practical example / evidenceScan reports; reconciliation log
INV-03Data classification scheme identifies personal data, children's data and high-risk categories (financial, health, biometric, location) with handling rules.Medium risks8(4); s10(1)
How to verify this →
Test procedureInspect classification policy; test labelling on a sample of 15 datasets.
Practical example / evidenceClassification policy; labelled samples
INV-04Data-flow maps cover collection, use, sharing, storage and deletion, including third-party and cross-border flows, and are current.High risks8(1)
How to verify this →
Test procedureInspect data-flow diagrams; validate 3 flows by walkthrough with system owners.
Practical example / evidenceData-flow diagrams
INV-05System/application register maps each system to personal data held, business owner, data owner and hosting location.Medium risks8(1)
How to verify this →
Test procedureCompare application register to CMDB and procurement/vendor list for gaps.
Practical example / evidenceApplication register; CMDB extract
INV-06Inventory covers employees, applicants, contractors, vendor staff, visitors (CCTV, access logs) and customers - not only customer data.Medium risks7(i); s8(1)
How to verify this →
Test procedureCheck inventory for HR, security and facilities processing activities.
Practical example / evidenceRoPA (HR/admin entries)
INV-07Inventory is refreshed on triggers (new product, vendor, system, M&A) and reviewed/signed off by data owners at least annually.Medium risks8(4)
How to verify this →
Test procedureInspect last review; check change-management hooks that trigger updates.
Practical example / evidenceReview sign-offs; change tickets

Stage 2 of 20

NOT-01A notice is given at or before the time of requesting consent; no processing occurs before notice.High risks5(1); Rule 3
How to verify this →
Test procedureWalk through collection journeys; confirm notice precedes data capture.
Practical example / evidenceJourney screenshots
NOT-02Notice is stand-alone, in clear plain language, understandable independently of other documents.High riskRule 3
How to verify this →
Test procedureReview notice presentation; test comprehensibility (readability scoring/user test).
Practical example / evidenceNotice samples; readability check
NOT-03Notice gives an itemised description of personal data and the specific purpose, with itemised goods/services/uses enabled by the processing.High risks5(1); Rule 3
How to verify this →
Test procedureCompare notice content with RoPA for 10 activities.
Practical example / evidenceNotice vs RoPA comparison
NOT-04Notice provides a communication link/means to withdraw consent, exercise rights and complain to the Board.High risks5(1); Rule 3
How to verify this →
Test procedureClick-through test of every link/means in each channel.
Practical example / evidenceLink test evidence
NOT-05Contact details of the DPO / person able to answer questions are published on website/app and included in notices.Medium risks8(9); Rule 9
How to verify this →
Test procedureInspect website, app and notices for contact details; test response.
Practical example / evidenceScreenshots; test email/call log
NOT-06Notice is available in English and Eighth Schedule languages relevant to the user base, and in accessible formats (mobile, screen-reader, audio/low-literacy).Medium risks5(3)
How to verify this →
Test procedureReview language and accessibility coverage; test with accessibility tooling.
Practical example / evidenceLanguage/accessibility matrix
NOT-07Notice versions are controlled and archived; versions are linked to consent records; purpose changes trigger a new notice.Medium risks5; s6(10)
How to verify this →
Test procedureInspect versioning log; trace 5 consents to notice version.
Practical example / evidenceNotice version log
NOT-08Notices are present at every collection point (web, app, forms, call centre scripts, kiosks, CCTV signage, events).Medium risks5(1)
How to verify this →
Test procedureSample at least 10 collection points across channels.
Practical example / evidenceCollection-point inventory; samples
NOT-09Notice accuracy test: actual practices (sharing, processors, retention, purposes) match what the notice and privacy policy say.High risks5(1); s8(1)
How to verify this →
Test procedureCompare notice statements to RoPA, vendor list, system behaviour; log differences.
Practical example / evidenceComparison workpaper

Stage 5 of 20

DPC-01Data minimisation: only data necessary for the specified purpose is collected; forms, APIs and schemas are reviewed for excess fields.Medium risks6(1); s8(4)
How to verify this →
Test procedureReview field inventory vs purpose; sample 5 forms/APIs for unnecessary mandatory fields.
Practical example / evidenceField inventory; review notes
DPC-02Completeness, accuracy and consistency of data are ensured where it is used to decide about a data principal or disclosed to another fiduciary (validation, quality checks, correction workflow).High risks8(3)
How to verify this →
Test procedureInspect data-quality rules and exception reports; test 10 decision datasets.
Practical example / evidenceDQ rules; exception reports
DPC-03Technical and organisational measures are implemented to effectively observe the Act (purpose tags, restricted access, masking, approvals).High risks8(4)
How to verify this →
Test procedureReview control framework mapping to Act obligations; test 5 controls.
Practical example / evidenceControl-to-obligation map
DPC-04Production personal data is not used in test/development without masking or approved anonymisation.High risks8(4); s8(5)
How to verify this →
Test procedureInspect non-production environments for live data; review masking procedure.
Practical example / evidenceEnv scan; masking logs
DPC-05Uncontrolled copies (spreadsheets, email attachments, personal devices, messaging apps) are restricted by policy and DLP.Medium risks8(5)
How to verify this →
Test procedureReview DLP rules and incident samples; sample shared drives/mailboxes.
Practical example / evidenceDLP config; incident samples
DPC-06Automated decision-making/profiling is inventoried, with human review and accuracy checks for decisions materially affecting data principals.Medium risks8(3)
How to verify this →
Test procedureInspect ADM inventory; sample 5 decision flows for oversight and override.
Practical example / evidenceADM inventory; review logs
DPC-07Use of personal data for analytics or AI/ML training is checked against notice/consent and uses de-identification where appropriate.Medium risks6(1); s8(4)
How to verify this →
Test procedureReview model-training datasets and approvals vs purposes.
Practical example / evidenceDataset approvals; purpose check
DPC-08Regular processing reviews: owners recertify purpose, need, access and retention for each activity at least annually.Medium risks8(4)
How to verify this →
Test procedureInspect last review cycle and sign-offs.
Practical example / evidenceRecertification records

Stage 6 of 20

XBT-01All cross-border transfers and remote access from outside India are identified (cloud regions, support teams, affiliates, SaaS, DR/backup).High risks16
How to verify this →
Test procedureReconcile data-flow maps with cloud region configs and vendor locations; interview IT.
Practical example / evidenceTransfer register; cloud configs
XBT-02Destinations are checked against any Central Government restrictions and stricter sectoral localisation rules (e.g. RBI payment data, SEBI, IRDAI).High risks16(1)-(2)
How to verify this →
Test procedureReview country screening against current notifications and sectoral rules.
Practical example / evidenceScreening log; legal opinion
XBT-03Conditions specified by the Central Government for making data available to a foreign State or entity are met.High riskRule 15
How to verify this →
Test procedureInspect requests/orders received and compliance records; confirm legal review.
Practical example / evidenceOrder register; legal review
XBT-04Contractual and technical safeguards apply to transfers (encryption, access limits, tokenisation, contractual terms with overseas recipients).Medium risks8(5)
How to verify this →
Test procedureInspect safeguards for 5 transfers.
Practical example / evidenceContracts; configs
XBT-05Register of transfers (recipient, country, purpose, data categories, safeguard) is maintained and current.Medium risks16; s8(1)
How to verify this →
Test procedureInspect register; verify against IT sources.
Practical example / evidenceTransfer register
XBT-06Process monitors Government notifications and triggers re-assessment and remediation when restrictions change.Medium risks16; Rule 15
How to verify this →
Test procedureInspect regulatory watch log and example reassessments.
Practical example / evidenceWatch log
XBT-07Significant Data Fiduciary: data specified by the Central Government is processed subject to restriction on transfer outside India.High riskRule 13
How to verify this →
Test procedureReview data specified by the Government (if any) and technical localisation controls.
Practical example / evidenceLocalisation design; scan evidence

Stage 10 of 20

PBD-01Privacy by design is embedded in SDLC/product governance with privacy requirements and gate reviews before launch.High risks8(4)
How to verify this →
Test procedureInspect SDLC checklist; sample 5 launches.
Practical example / evidenceSDLC checklist; sign-offs
PBD-02DPIA methodology and triggers are defined; DPIAs are performed for high-risk processing (new tech, large-scale, children, profiling); mandatory annually for SDFs.High risks10(2)(c); Rule 13
How to verify this →
Test procedureInspect methodology; sample 3 DPIAs; check trigger coverage.
Practical example / evidenceDPIA methodology; reports
PBD-03Privacy-by-default settings: minimal collection, opt-in for optional processing, restricted visibility, short default retention.Medium risks6(1); s8(4)
How to verify this →
Test procedureReview default settings of 5 products.
Practical example / evidenceConfig screenshots
PBD-04New project/feature/vendor intake includes privacy review and documented sign-off.Medium risks8(4)
How to verify this →
Test procedureSample the last 10 launches for review evidence.
Practical example / evidenceIntake records
PBD-05Privacy impact documentation is retained and risks are tracked to closure.Medium risks8(4)
How to verify this →
Test procedureInspect DPIA risk register.
Practical example / evidenceDPIA risk log
PBD-06Anonymisation/pseudonymisation standards exist and re-identification risk is tested.Low risks8(4)
How to verify this →
Test procedureReview standards and test results.
Practical example / evidenceStandards; test report

Stage 14 of 20

ALG-01Significant Data Fiduciary status is assessed against s10(1) factors (volume/sensitivity, risk to rights, sovereignty, electoral democracy, security of State, public order) and Government notifications are monitored.Medium risks10(1)
How to verify this →
Test procedureInspect assessment and monitoring approach.
Practical example / evidenceSDF assessment memo
ALG-02A Data Protection Officer based in India is appointed, responsible to the board/governing body and the point of contact for grievance redressal.High risks10(2)(a)
How to verify this →
Test procedureInspect appointment, reporting line and residency.
Practical example / evidenceAppointment letter; org chart
ALG-03An independent data auditor is appointed to evaluate compliance; independence and qualifications are verified.High risks10(2)(b)
How to verify this →
Test procedureInspect engagement and independence declaration.
Practical example / evidenceEngagement letter
ALG-04Annual DPIA and audit are performed and a report with significant observations is furnished to the Board.High risks10(2)(c); Rule 13
How to verify this →
Test procedureInspect last DPIA/audit and Board submission.
Practical example / evidenceDPIA and audit reports; submission proof
ALG-05Due diligence verifies that technical measures, including algorithmic software, are not likely to pose a risk to the rights of data principals.High riskRule 13
How to verify this →
Test procedureInspect due-diligence reports covering algorithmic software.
Practical example / evidenceDue-diligence reports
ALG-06Algorithms/AI models using personal data are inventoried (purpose, data, owner) and risk-assessed for accuracy, bias and explainability.Medium riskRule 13; s8(3)
How to verify this →
Test procedureInspect inventory and assessments for 5 models.
Practical example / evidenceModel inventory; assessments
ALG-07Human oversight exists for automated decisions with material effect, with override and appeal.Medium risks8(3)
How to verify this →
Test procedureInspect oversight procedure and 5 override cases.
Practical example / evidenceOversight procedure
ALG-08Periodic algorithm audits, performance monitoring and model change control are in place.Medium riskRule 13
How to verify this →
Test procedureInspect audit schedule and last audit.
Practical example / evidenceAudit reports
ALG-09Documentation for algorithmic accountability (model cards, testing, training-data provenance) is retained.Medium riskRule 13
How to verify this →
Test procedureInspect documentation for 3 models.
Practical example / evidenceModel documentation

Stage 15 of 20

REC-01Required records are maintained: RoPA, consent/notice records, rights requests, breach register, DPIA/audit reports, vendor contracts, training records.High risks6(10); s8(1)
How to verify this →
Test procedureInspect records inventory against required list.
Practical example / evidenceRecords inventory
REC-02Records are accurate, access-controlled, tamper-evident and retained for the required period.Medium risks8(1)
How to verify this →
Test procedureTest integrity and access controls on 3 record stores.
Practical example / evidenceAccess config; samples
REC-03A control-to-evidence map exists and evidence can be retrieved within a defined time (suggested: 48 hours).Medium risks8(1)
How to verify this →
Test procedureRetrieval test for 10 controls.
Practical example / evidenceControl-evidence map; test
REC-04Mock regulatory request exercise (Board inquiry/information call) is performed and the response team is defined.Medium risks27; s36
How to verify this →
Test procedureInspect last exercise and lessons learned.
Practical example / evidenceExercise report
REC-05Independent internal/external audit of DPDP compliance is performed with an audit plan; reports are version-controlled and findings tracked.Medium risks8(1)
How to verify this →
Test procedureInspect audit plan, reports and tracker.
Practical example / evidenceAudit reports
REC-06Management decisions on exceptions and risk acceptance are recorded.Low risks8(1)
How to verify this →
Test procedureInspect decision log.
Practical example / evidenceDecision log

Stage 16 of 20

TRN-01Role-based training covers all employees and contractors, with specialised modules for HR, marketing, IT, support, product, procurement, privacy team and leadership.Medium risks8(4)
How to verify this →
Test procedureInspect training matrix and content.
Practical example / evidenceTraining matrix; materials
TRN-02Training content covers consent/notice, rights, children's data, breach reporting, retention and penalties under the Act and Rules.Medium risks8(4)
How to verify this →
Test procedureReview content against obligations.
Practical example / evidenceTraining content
TRN-03Induction training within 30 days of joining; annual refreshers; completion tracked against target (suggested >=95%) with escalation.Medium risks8(4)
How to verify this →
Test procedureInspect completion reports; test 10 new joiners.
Practical example / evidenceLMS completion reports
TRN-04Staff can recognise and promptly report suspected breaches; reporting awareness is tested (e.g. phishing simulation, spot checks).Medium risks8(5); Rule 7
How to verify this →
Test procedureInspect simulation results; interview 5 staff.
Practical example / evidenceSimulation results
TRN-05Third-party/processor personnel with access to personal data receive awareness training.Low risks8(2)
How to verify this →
Test procedureInspect vendor training attestations.
Practical example / evidenceAttestations
TRN-06Training effectiveness is assessed (quiz scores, remediation) and records are retained.Low risks8(4)
How to verify this →
Test procedureInspect assessment results and retention.
Practical example / evidenceAssessment records

Stage 17 of 20

GRV-01Grievance redressal mechanism is established with a named responsible person (Grievance Officer/DPO) and reachable channels.High risks8(10); s13; Rule 9
How to verify this →
Test procedureInspect appointment and channels; submit a test grievance.
Practical example / evidenceAppointment; test evidence
GRV-02Business contact details of the DPO / responsible person are published and included in every rights-related response.High risks8(9); Rule 9
How to verify this →
Test procedureInspect website/app and sample responses.
Practical example / evidenceScreenshots; responses
GRV-03Grievance process covers acknowledgement, investigation, resolution and response within the period prescribed in Rule 14 (reported as up to 90 days - verify Gazette).High risks13; Rule 14
How to verify this →
Test procedureTest 15 grievances for timeliness.
Practical example / evidenceGrievance register
GRV-04Escalation path exists for unresolved grievances; data principals are informed of the right to approach the Board after exhausting redressal.Medium risks13
How to verify this →
Test procedureInspect escalation procedure and response templates.
Practical example / evidenceProcedure; templates
GRV-05Grievance outcomes and root causes are tracked, with trend reports to management.Medium risks8(10)
How to verify this →
Test procedureInspect trend reports.
Practical example / evidenceTrend reports
GRV-06Channels are accessible for children/guardians, nominees and persons with disabilities.Low risks9; s14
How to verify this →
Test procedureReview accessibility of channels.
Practical example / evidenceAccessibility review

Stage 18 of 20

REG-01Regulatory watch tracks Act/Rules amendments, Government notifications, Board orders and sectoral circulars, with an accountable owner.Medium risks38
How to verify this →
Test procedureInspect watch log and last 3 changes handled.
Practical example / evidenceWatch log
REG-02Implementation roadmap addresses phased commencement (Consent Manager ~Nov 2026; core obligations ~May 2027) with milestones and status.High riskRule 1
How to verify this →
Test procedureInspect roadmap and milestone tracking.
Practical example / evidenceRoadmap; status reports
REG-03Readiness to respond to Board inquiries, directions and information calls, and to consider voluntary undertakings.Medium risks27; s32; s36
How to verify this →
Test procedureInspect playbook and legal retainer.
Practical example / evidenceResponse playbook
REG-04Penalty exposure is mapped to the Schedule (security up to INR 250 cr; breach notification/children up to INR 200 cr; SDF up to INR 150 cr; other up to INR 50 cr) and used for prioritisation.Medium risks33; Schedule
How to verify this →
Test procedureInspect exposure analysis.
Practical example / evidenceExposure analysis
REG-05Periodic compliance reviews (suggested: quarterly) with evidence repository and management attestations.Medium risks8(1)
How to verify this →
Test procedureInspect last 2 reviews and attestations.
Practical example / evidenceReview reports
REG-06Exemptions under s17 relied on are documented, narrow and legally reviewed.Medium risks17
How to verify this →
Test procedureInspect exemption register.
Practical example / evidenceExemption register

Stage 19 of 20

CMI-01Annual (minimum) audit cycle covers all 20 domains with risk-based frequency; results reported to management.Medium risks8(1)
How to verify this →
Test procedureInspect audit calendar and coverage.
Practical example / evidenceAudit calendar
CMI-02KPIs/KRIs are defined and tracked: rights SLA %, withdrawal latency, breach detection/response times, training completion, retention exceptions, vendor assurance coverage, DPIA completion.Medium risks8(4)
How to verify this →
Test procedureInspect KPI dashboard and thresholds.
Practical example / evidenceKPI dashboard
CMI-03Emerging risks (AI/GenAI, new cloud/SaaS, IoT, biometrics, ad-tech) are assessed before adoption.Medium risks8(4)
How to verify this →
Test procedureInspect emerging-risk assessments.
Practical example / evidenceRisk assessments
CMI-04Gaps are tracked with owners and due dates; overdue items are escalated and closure is validated.High risks8(1)
How to verify this →
Test procedureInspect tracker; test closure of 5 items.
Practical example / evidenceRemediation tracker
CMI-05Continuous control monitoring (DSPM, consent-platform telemetry, DLP alerts, retention-job failures) is in place.Low risks8(4)
How to verify this →
Test procedureReview monitoring coverage and alert handling.
Practical example / evidenceMonitoring configs
CMI-06Management review and improvement plan (with budget) incorporate lessons from incidents, complaints and audits.Medium risks8(1)
How to verify this →
Test procedureInspect last management review.
Practical example / evidenceReview minutes

Stage 20 of 20

Frequently asked questions

Does DPDPA apply to us if we only process data within India?

DPDPA applies broadly to processing of digital personal data within India, and to processing outside India where it relates to offering goods or services to individuals in India. Scope for your specific operations should be confirmed with counsel.

Is a DPIA mandatory for every business?

Not for every processing activity, but it's expected for higher-risk processing — large-scale data use, data involving children, or activities that could significantly affect individuals — and is mandatory for Significant Data Fiduciaries.

How is DPDPA different from GDPR?

They share a similar underlying logic (lawful basis, individual rights, breach notification) but differ in specifics — consent mechanics, the role of Consent Managers, and penalty structure. Treat DPDPA as its own framework rather than assuming GDPR compliance covers it automatically.

Empanelled as NITCON’s Technology Partner.

Free V-SeQuor Testing & Evaluation.

DPDPA Readiness Checklist — every requirement, item by item.

Get your readiness score

Governance & Accountability

Personal Data Inventory

Lawful Basis & Purpose

Notice & Transparency

Data Processing Controls

Children's Personal Data

Data Principal Rights Management

Cross-Border Data Transfers

Security Safeguards

Personal Data Breach Management

Retention & Deletion

Privacy by Design & by Default

Algorithmic Accountability (SDF)

Records, Audit & Evidence

Training & Awareness

Grievance Redressal

Compliance & Regulatory Readiness

Continuous Monitoring & Improvement

Frequently asked questions

Related reading

Empanelled as NITCON’s Technology Partner.

Free V-SeQuor Testing & Evaluation.

DPDPA Readiness Checklist — every requirement, item by item.

Get your readiness score

Governance & Accountability

Personal Data Inventory

Lawful Basis & Purpose

Consent Management

Notice & Transparency

Data Processing Controls

Children's Personal Data

Data Principal Rights Management

Data Sharing & Processors

Cross-Border Data Transfers

Security Safeguards

Personal Data Breach Management

Retention & Deletion

Privacy by Design & by Default

Algorithmic Accountability (SDF)

Records, Audit & Evidence

Training & Awareness

Grievance Redressal

Compliance & Regulatory Readiness

Continuous Monitoring & Improvement

Frequently asked questions

Related reading

DPDPA Compliance: A Practical Checklist for Indian Businesses

DPDPA Significant Data Fiduciary: What the November 2026 Deadline Means for You