The DPDP Rules were notified in November 2025. The Consent Manager framework starts on 13 November 2026, and the main obligations apply from 13 May 2027.
Most DPDP checklists list duties. This one lists the evidence you need to show for each duty, because that is what a client, an auditor or the Data Protection Board of India will ask for. A policy on its own proves little. A signed record, a log or a register proves a lot.
Key dates
- Date
- 13 Nov 2026
- What starts
- Consent Manager framework (Rule 4)
- Date
- 13 May 2027
- What starts
- All other Data Fiduciary obligations
Note: CERT-In's 6-hour incident reporting and 180-day log rules are already in force under a separate law. They do not wait for the DPDP dates.
How to read the checklist
Each control has an "Applies to" value:
- All: every company that processes digital personal data.
- If you do that kind of processing: for example, only if you process children's data or use Consent Managers.
- SDF only: only Significant Data Fiduciaries notified by the government.
"Good practice" in the Reference column means the control is not named in the law, but you need it to prove the duties that are. A data map is the clearest example. The Act does not say "keep a data map", but you cannot write an accurate notice, answer a rights request or report a breach without one.
The "From" column shows the date the control starts to apply. The "Evidence to keep" column is the part to start on now: evidence takes time to build up, and a log that begins the day before an audit shows very little.
Governance: Own it at the top
Someone senior has to own DPDP compliance, and you need paper that shows it.
- #
- 1
- Control
- Privacy governance policy
- What it means
- A board-approved privacy policy that says who owns DPDP compliance and how it is run.
- Evidence to keep
- Approved policy; employee acknowledgements
- Applies to
- All
- From
- 13 May 2027
- Reference
- Good practice; supports Sec 8(1)
- #
- 2
- Control
- Privacy compliance monitoring
- What it means
- Regular management review of how privacy controls are working.
- Evidence to keep
- Review minutes; compliance metrics
- Applies to
- All
- From
- 13 May 2027
- Reference
- Good practice; supports Sec 8(1)
- #
- 3
- Control
- Publish a privacy contact (DPO for SDFs)
- What it means
- Publish the business contact of a person who can answer questions about your data processing. Significant Data Fiduciaries must appoint an India-based DPO.
- Evidence to keep
- Appointment letter; screenshot of published contact
- Applies to
- All
- From
- 13 May 2027
- Reference
- Sec 8(9), Sec 10(2); Rule 9
- #
- 4
- Control
- Privacy training and awareness
- What it means
- Train staff who handle personal data, at joining and every year.
- Evidence to keep
- Training completion and attendance records
- Applies to
- All
- From
- 13 May 2027
- Reference
- Good practice; supports Sec 8(5)
Know your data: You can't protect what you haven't mapped
Every other control depends on knowing what personal data you hold and why.
- #
- 5
- Control
- Personal data inventory and mapping
- What it means
- A record of what personal data you hold, why, where it sits and who it is shared with.
- Evidence to keep
- Record of processing (RoPA) / data map
- Applies to
- All
- From
- 13 May 2027
- Reference
- Good practice; needed for Sec 5, 8, 11
- #
- 6
- Control
- Lawful basis and purpose limitation
- What it means
- Every processing activity has a basis: consent or a listed legitimate use, for a specified purpose.
- Evidence to keep
- Lawful basis recorded per activity
- Applies to
- All
- From
- 13 May 2027
- Reference
- Sec 4, 6, 7
- #
- 7
- Control
- Data minimisation
- What it means
- Collect only the data needed for the stated purpose; mask what you can.
- Evidence to keep
- Form/field review; masking settings
- Applies to
- All
- From
- 13 May 2027
- Reference
- Sec 6(1)
- #
- 8
- Control
- Data accuracy and quality
- What it means
- Keep data complete and accurate where it drives decisions or is shared with another fiduciary.
- Evidence to keep
- Validation rules; correction logs
- Applies to
- All
- From
- 13 May 2027
- Reference
- Sec 8(3)
Notice and consent: Clear, separate and provable
Consent only counts if it was clear, separate and can be proved later.
- #
- 9
- Control
- Privacy notice and transparency
- What it means
- A standalone, plain-language notice listing the data, the purpose and how to withdraw consent or complain.
- Evidence to keep
- Published notice with version history
- Applies to
- All
- From
- 13 May 2027
- Reference
- Sec 5; Rule 3
- #
- 10
- Control
- Consent management
- What it means
- Free, specific, informed consent, as easy to withdraw as to give. You must be able to prove it.
- Evidence to keep
- Consent logs or register; consent screens
- Applies to
- All
- From
- 13 May 2027
- Reference
- Sec 6; Sec 6(10)
- #
- 11
- Control
- Consent Manager integration
- What it means
- Be ready to accept and honour consent given through a registered Consent Manager.
- Evidence to keep
- Integration or readiness note
- Applies to
- If you use Consent Managers
- From
- 13 Nov 2026
- Reference
- Sec 6(7)-(9); Rule 4
Children and guardians: Extra care, verified consent
These controls apply only if you process data of children or of persons with disabilities.
- #
- 12
- Control
- Verifiable parental consent
- What it means
- Get verifiable consent from a parent before processing data of anyone under 18.
- Evidence to keep
- Parental consent and verification records
- Applies to
- If you process children's data
- From
- 13 May 2027
- Reference
- Sec 9(1); Rule 10
- #
- 13
- Control
- No tracking or targeted ads to children
- What it means
- No tracking, behavioural monitoring or targeted advertising directed at children.
- Evidence to keep
- Ad/tag settings excluding children
- Applies to
- If you process children's data
- From
- 13 May 2027
- Reference
- Sec 9(3)
- #
- 14
- Control
- Guardian consent verification
- What it means
- Verify the lawful guardian before processing data of a person with a disability.
- Evidence to keep
- Guardianship proof; verification record
- Applies to
- If you process data of persons with disabilities
- From
- 13 May 2027
- Reference
- Sec 9(1); Rule 11
Rights and grievances: Answer people on time
People can ask to see, correct or erase their data, and you must answer them on time.
- #
- 15
- Control
- Data principal rights and grievances
- What it means
- Let people access, correct and erase their data and raise grievances. Respond within 90 days.
- Evidence to keep
- Rights request register; grievance register
- Applies to
- All
- From
- 13 May 2027
- Reference
- Sec 11-14; Rule 14
Security safeguards: Reasonable security, provable
Rule 6 asks for reasonable security. These seven controls are how you show it.
- #
- 16
- Control
- Encryption and data protection
- What it means
- Encrypt, mask or tokenise personal data at rest and in transit.
- Evidence to keep
- Encryption and TLS configuration
- Applies to
- All
- From
- 13 May 2027
- Reference
- Sec 8(5); Rule 6
- #
- 17
- Control
- Logical access control
- What it means
- Only the right people can reach personal data.
- Evidence to keep
- IAM / access configuration
- Applies to
- All
- From
- 13 May 2027
- Reference
- Sec 8(5); Rule 6
- #
- 18
- Control
- Periodic access review
- What it means
- Review who has access and remove what isn't needed.
- Evidence to keep
- Signed access review records
- Applies to
- All
- From
- 13 May 2027
- Reference
- Sec 8(5); Rule 6
- #
- 19
- Control
- Security logging and monitoring
- What it means
- Log and monitor access to personal data to detect misuse.
- Evidence to keep
- Logging config; sample logs
- Applies to
- All
- From
- 13 May 2027
- Reference
- Sec 8(5); Rule 6
- #
- 20
- Control
- Log retention (1 year)
- What it means
- Keep these logs and related personal data for at least one year, unless another law says otherwise.
- Evidence to keep
- Retention setting of 1 year or more
- Applies to
- All
- From
- 13 May 2027
- Reference
- Rule 6
- #
- 21
- Control
- Backup and recovery
- What it means
- Keep processing going if data is lost or systems are compromised.
- Evidence to keep
- Backup logs; restore test record
- Applies to
- All
- From
- 13 May 2027
- Reference
- Sec 8(5); Rule 6
- #
- 22
- Control
- Technical and organisational measures
- What it means
- An overall, documented set of measures that covers all of the above.
- Evidence to keep
- Control coverage summary
- Applies to
- All
- From
- 13 May 2027
- Reference
- Sec 8(4); Rule 6
Vendors and transfers: You answer for your processors
The Data Fiduciary stays responsible for what its processors do.
- #
- 23
- Control
- Processor contracts
- What it means
- Use processors only under a valid contract with security obligations. Their failures are yours.
- Evidence to keep
- Signed DPAs; vendor register
- Applies to
- All
- From
- 13 May 2027
- Reference
- Sec 8(1), 8(2); Rule 6
- #
- 24
- Control
- Cross-border data transfer
- What it means
- Know where data goes outside India and check it against government restrictions and sector rules.
- Evidence to keep
- Transfer register; DLP settings
- Applies to
- All
- From
- 13 May 2027
- Reference
- Sec 16; Rule 15
Breaches and incidents: Detect, respond, report
A breach has two clocks: one under DPDP and one under CERT-In.
- #
- 25
- Control
- Personal data breach notification
- What it means
- Tell affected people and the Data Protection Board without delay; full report to the Board within 72 hours.
- Evidence to keep
- Breach register; copies of notifications
- Applies to
- All
- From
- 13 May 2027
- Reference
- Sec 8(6); Rule 7
- #
- 26
- Control
- Incident response plan
- What it means
- A tested plan so you can meet the breach timelines (and CERT-In's 6-hour rule, already in force).
- Evidence to keep
- Incident log; test records
- Applies to
- All
- From
- 13 May 2027
- Reference
- Supports Sec 8(6); Rule 7
Retention and disposal: Delete when the purpose ends
Personal data should not outlive the purpose it was collected for.
- #
- 27
- Control
- Data retention and erasure
- What it means
- Erase data once the purpose is served. Large e-commerce, gaming and social platforms must give 48 hours' notice first.
- Evidence to keep
- Retention schedule; erasure logs; sample notices
- Applies to
- All (48h notice: large platforms)
- From
- 13 May 2027
- Reference
- Sec 8(7); Rule 8
- #
- 28
- Control
- Secure data disposal
- What it means
- Wipe or destroy media and devices that held personal data.
- Evidence to keep
- Disposal or wipe certificates
- Applies to
- All
- From
- 13 May 2027
- Reference
- Sec 8(7)
Regulator requests: Be ready when the government asks
Have a process ready before an official request arrives.
- #
- 29
- Control
- Government and regulatory requests
- What it means
- Handle official information requests, including ones you must not disclose.
- Evidence to keep
- Request register; non-disclosure records
- Applies to
- All
- From
- 13 May 2027
- Reference
- Sec 36; Rule 23
Significant Data Fiduciaries: Extra duties if notified as an SDF
These three controls apply only if the government notifies you as a Significant Data Fiduciary.
- #
- 30
- Control
- DPIA and independent audit
- What it means
- A Data Protection Impact Assessment and an independent data audit every 12 months.
- Evidence to keep
- DPIA report; independent audit report
- Applies to
- SDF only
- From
- 13 May 2027
- Reference
- Sec 10(2); Rule 13
- #
- 31
- Control
- Algorithmic due diligence
- What it means
- Check that algorithms and software don't put data principals' rights at risk.
- Evidence to keep
- Algorithm risk assessments
- Applies to
- SDF only
- From
- 13 May 2027
- Reference
- Rule 13
- #
- 32
- Control
- Data localisation
- What it means
- Keep government-specified personal data and its traffic data inside India.
- Evidence to keep
- Cloud region / residency evidence
- Applies to
- SDF only
- From
- 13 May 2027
- Reference
- Rule 13(4)
Where most companies get stuck
- No data map, so notices, rights requests and breach reports can't be done properly.
- Consent collected but not provable, because there are no consent logs.
- Vendors with no DPA, even though the company is responsible for them.
- Logs kept for 30 or 90 days, not the one year the Rules require.
How this maps to ISO 27001 and SOC 2
If you already have ISO 27001 or SOC 2, controls 16 to 26 and 28 largely overlap with what you have: encryption, access control, access reviews, logging, backups, vendor contracts, incident response and secure disposal. Check the log retention period against the one-year rule.
The new work is mostly in data mapping, notice, consent, rights and children's data. Those are privacy controls that a security framework does not fully cover. See our DPDP compliance consulting page for how we help with that part.
General information based on the DPDP Act 2023 and DPDP Rules 2025 as notified. Not legal advice.