Using this checklist across internal functional owners
Preparing for India's DPDP Act cannot be delegated solely to internal legal counsel or IT operations. It requires coordinated operational action across five business functions.
1. Governance & Strategy (Leadership & Legal)
- Determine legal role for every data processing flow (Data Fiduciary vs Data Processor).
- Evaluate whether your organisation meets Significant Data Fiduciary (SDF) thresholds.
- Appoint an internal Privacy Lead or Data Protection Officer (DPO) based in India.
- Publish clear contact details and email addresses for grievance redressal.
- Establish an emergency incident escalation team for personal data breaches.
2. Notice & Consent UX (Product & Design)
- Draft unbundled, standalone privacy notices for all user registration funnels.
- Ensure notice specifies the exact personal data collected and the precise purpose of processing.
- Provide an itemized description of goods or services enabled by the personal data.
- Ensure consent is explicit, informed, and affirmative (no pre-ticked boxes or bundled terms).
- Build an accessible, friction-free mechanism for users to withdraw consent at any time.
- Verify notice is available in English and specified official languages under the Eighth Schedule where applicable.
3. Data Principal Rights & Retention (Engineering & Operations)
- Implement a ticketing pipeline to handle requests for data summaries, corrections, and erasures.
- Establish SLA tracking to ensure rights requests are resolved within statutory timeframes.
- Establish automated retention schedules under Section 8(7) to purge data when purpose is fulfilled.
- Ensure soft-deleted records are permanently scrubbed from search indexes and data pipelines.
4. Vendor & Subprocessor Due Diligence (Procurement & Security)
- Compile an inventory of all third-party cloud hosts, analytics SDKs, and payment gateways.
- Execute binding Data Processing Agreements (DPAs) with every processor under Section 8(2).
- Require vendors to provide contractual breach notifications within strict operational windows.
5. Security Safeguards & Breach Readiness (DevOps & Security)
- Enforce Multi-Factor Authentication (MFA) across all administrative cloud and database portals.
- Encrypt personal data both at rest (AES-256) and in transit (TLS 1.2/1.3).
- Maintain tamper-evident audit logs aligned with 180-day retention rules.
- Document an incident response playbook to notify DPBI and affected users within 72 hours under Rule 7.