This checklist maps every obligation under the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 that applies to a foreign entity processing personal data of Data Principals within the territory of India. Each item cites the specific Section or Rule, the obligation it creates, and the evidence artefact required to demonstrate compliance.
Phase 1 — Jurisdictional and data mapping (Months 1–3)
Obligation 1 — Determine applicability (Section 3): Document whether your processing falls within Section 3(a) (processing within India) or Section 3(b) (processing outside India in connection with offering goods or services to Data Principals in India). This determination must be evidence-based, not assumed.
Obligation 2 — Create a Record of Processing Activities: While DPDPA does not use the GDPR terminology of ROPA, Section 8(1) requires the Data Fiduciary to implement appropriate technical and organisational measures. A comprehensive processing inventory is the baseline organisational measure without which no subsequent obligation can be fulfilled.
Obligation 3 — Classify data categories: Map every category of personal data you process against the purposes for which it is processed. DPDPA does not create a separate category of sensitive personal data (unlike the 2019 Bill), but Section 9 creates enhanced obligations for children's data and data of persons with disabilities.
Obligation 4 — Identify legal basis for each processing activity (Sections 6 and 7): Every processing activity must be grounded in either consent (Section 6) or a legitimate use (Section 7). There is no third basis. Document the legal basis for each processing activity in your inventory.
Phase 2 — Consent and notice architecture (Months 3–6)
Obligation 5 — Draft notice under Section 5: The notice must be clear, standalone, and specify every purpose of processing, the manner of exercising rights, and the manner of making a complaint to the Board. Rule 3 prescribes the format requirements.
Obligation 6 — Implement consent mechanism under Section 6: Consent must be free, specific, informed, unconditional, unambiguous, and with a clear affirmative action. Pre-ticked checkboxes, consent walls, and bundled consent mechanisms are non-compliant. Withdrawing consent must be comparable in ease to giving it (Section 6(4)).
Obligation 7 — Implement verifiable parental consent for children's data (Section 9): If you process data of children (persons below 18 years), verifiable consent of the parent or lawful guardian is mandatory before processing. Behavioural monitoring and targeted advertising directed at children are prohibited. Rule 10 prescribes the verification methodology.
Phase 3 — Security, breach and governance (Months 6–9)
Obligation 8 — Implement reasonable security safeguards (Section 8(4)): The standard is reasonableness, not perfection. But reasonableness must be demonstrated through documented controls — encryption, access management, vulnerability assessment, and security audit logs.
Obligation 9 — Establish breach notification protocol (Section 8(6) read with Rule 7): Every personal data breach must be reported to the Data Protection Board and each affected Data Principal. The notification must include the nature of the breach, approximate number of Data Principals affected, and the measures taken. The notification must be in the form prescribed by Rule 7.
Obligation 10 — Implement data retention and erasure framework (Section 8(7)): Personal data must be erased when the purpose for which it was collected is no longer being served and retention is not necessary for any legal purpose. This requires a purpose-mapped retention schedule — not a blanket retention policy.
Phase 4 — Rights infrastructure and vendor governance (Months 9–12)
Obligation 11 — Enable Data Principal rights (Sections 11–14): Implement mechanisms for access, correction, erasure, and grievance redressal. Grievance redressal must include a designated contact person and an escalation mechanism. Respond within the timelines prescribed by the Rules.
Obligation 12 — Execute Data Processor Agreements (Section 8(2)): Every Data Processor must process personal data only under a valid contract with appropriate safeguards. Map your vendor chain. Execute DPAs with each processor and sub-processor.
Obligation 13 — Assess cross-border transfer compliance (Section 16): Verify that no personal data of Indian Data Principals is transferred to a jurisdiction notified as restricted by the Central Government. Map every cross-border data flow, including cloud routing, disaster recovery, and vendor sub-processing chains.
"A compliance checklist is not a defence. The evidence that you implemented each item on the checklist — contemporaneously, completely, and with traceable records — is the defence."
— Anandaday Misshra