# DPDP compliance checklist: 78 checks anchored to the Act and Rules

> Canonical page: https://mksd0398.github.io/dpdp-act-skill/compliance-checklist/
> Not legal advice. Educational compliance reference only; no lawyer-client relationship arises from its use and the author is not a lawyer. Verify statutory text against the Gazette of India and consult qualified Indian legal counsel before acting.

The working checklist for auditing an organisation, a product, a contract, or a privacy notice.
Every item carries its statutory anchor. Do not raise a finding without one.

Scoring convention used in reports:
- **GAP** = a specific provision is not met, with the evidence stated.
- **RISK** = arguably met, but the position is weak or undocumented and would not survive s.6(10)
  burden of proof or a Board inquiry.
- **OPEN** = cannot be determined without a Rule, a notification, or a fact the client must supply.
- **OK** = met, with the evidence stated.

---

## A. Scoping (do this before anything else)

| # | Question | Anchor |
|---|---|---|
| A1 | Is any personal data processed in digital form, or collected on paper and digitised later? | s.2(n), s.3(a) |
| A2 | Is the entity outside India? If so, is the processing connected to offering goods or services to Data Principals in India? Mere behaviour monitoring is **not** a trigger. | s.3(b) |
| A3 | Does any carve-out apply: purely personal or domestic processing, or data the individual herself made public? | s.3(c) |
| A4 | For each processing activity, is the entity a Data Fiduciary (determines purpose **and** means) or a Data Processor? Map joint arrangements. | s.2(i), s.2(k) |
| A5 | Has the entity been **notified** as a Significant Data Fiduciary? If not, s.10 does not apply. Do not assume. | s.2(z), s.10(1) |
| A6 | Are any children (under 18) or persons with disability having a lawful guardian in the user base? | s.2(f), s.2(j)(ii), s.9 |
| A7 | Which s.17 exemptions are in play, and does the client understand that s.8(1) and s.8(5) survive all of them? | s.17(1) |
| A8 | Which sectoral regulator also sits over this data: RBI, IRDAI, SEBI, TRAI, CERT-In, NHA, UIDAI? DPDP does not displace them. | s.16(2), s.38(1) |

---

## B. Lawful basis and purpose

| # | Question | Anchor |
|---|---|---|
| B1 | Is there a written **record of processing activities** mapping each purpose to its lawful basis? Not required by name, but without it s.6(10) is unanswerable. | s.4, s.6(10) |
| B2 | For each purpose, is the basis consent or a **named** s.7 clause? Reject any answer of "legitimate interest". | s.4(1), s.7 |
| B3 | Where s.7(a) is claimed, did the Data Principal actually **volunteer** the data for **that** purpose, and has she not indicated non-consent? | s.7(a) |
| B4 | Where s.7(i) employment is claimed, is the use genuinely employment or loss/liability protection, rather than marketing or surveillance dressed up? | s.7(i) |
| B5 | Is each purpose a "lawful purpose", meaning not expressly forbidden by law? | s.4(2) |
| B6 | Is any purpose broader than what the collected data set supports, so consent would be read down? | s.6(1) and Illustration |

---

## C. Notice

| # | Question | Anchor |
|---|---|---|
| C1 | Does a notice accompany or **precede** every consent request? | s.5(1) |
| C2 | Does it state the personal data and the purpose, with an **itemised description** of the data? | s.5(1)(i), Rule 3(b)(i) |
| C3 | Does it describe the **specific goods or services** or uses enabled, rather than a vague category? | Rule 3(b)(ii) |
| C4 | Does it explain how to **withdraw consent** (s.6(4)) and how to raise a **grievance** (s.13)? | s.5(1)(ii) |
| C5 | Does it explain how to **complain to the Board**? Most notices miss this one. | s.5(1)(iii), Rule 3(c)(iii) |
| C6 | Is it **standalone and understandable independently** of the T&C or any other document? | Rule 3(a) |
| C7 | Is it offered in **English or any Eighth Schedule language**, at the user's option? 22 languages. | s.5(3) |
| C8 | Does it give the **particular communication link** to the site or app for exercising each of these? | Rule 3(c) |
| C9 | For consent obtained **before** commencement, has a retrospective notice gone out, or is one planned? | s.5(2) |

---

## D. Consent mechanics

| # | Question | Anchor |
|---|---|---|
| D1 | Free, specific, informed, unconditional, unambiguous, with a **clear affirmative action**? No pre-ticked boxes, no consent by continued use, no bundling. | s.6(1) |
| D2 | Is consent **granular per purpose**, or one blanket tick? | s.6(1) |
| D3 | Is service access **conditioned** on consent to unnecessary processing? That defeats "unconditional" and "free". | s.6(1) |
| D4 | Any waiver, indemnity or limitation clause riding on the consent that would be void? | s.6(2) and Illustration |
| D5 | Is the consent request in **clear and plain language**, with the language option, and with DPO or authorised-person contact details? | s.6(3) |
| D6 | Is **withdrawal as easy as giving**? Compare the click counts honestly: one-tap in, versus an email to support, is a finding. | s.6(4), Rule 3(c)(i) |
| D7 | On withdrawal, does the system **cease processing** and **propagate the stop to every Processor** within a reasonable time? | s.6(6) |
| D8 | Are **consent artefacts logged**: timestamp, purpose string, notice version, language served, method, and withdrawal events? | s.6(10) |
| D9 | If a Consent Manager is used, is it registered with the Board, and is the accountability-to-the-Data-Principal relationship reflected in contracts? | s.6(7)-(9), Rule 4 |

---

## E. Security, breach and vendors

| # | Question | Anchor |
|---|---|---|
| E1 | **Encryption, obfuscation, masking, or virtual tokens** applied to personal data? | Rule 6(1)(a) |
| E2 | **Access controls** on the computer resources used by the Fiduciary and every Processor? | Rule 6(1)(b) |
| E3 | **Logs, monitoring and review** giving visibility on who accessed personal data? | Rule 6(1)(c) |
| E4 | **Backups and continuity** measures for loss of confidentiality, integrity or availability? | Rule 6(1)(d) |
| E5 | Are logs and the associated personal data retained **one year**? Reconcile with s.8(7) erasure and document the reconciliation. | Rule 6(1)(e) |
| E6 | Does **every Processor contract** contain a security-safeguards clause? | s.8(2), Rule 6(1)(f) |
| E7 | Is there a **valid written contract** with every Processor for goods/services activity? Not a PO, not a click-through, if that will not survive scrutiny. | s.8(2) |
| E8 | Does the breach playbook notify **each affected Data Principal without delay**, separately from the Board timeline? | s.8(6), Rule 7(1) |
| E9 | Does it deliver the Board's **initial intimation without delay** and the **detailed 72-hour report**, with cause and responsible-person findings? | Rule 7(2) |
| E10 | Does the playbook treat **loss of access** (ransomware, destructive incidents) as a notifiable personal data breach? | s.2(u) |
| E11 | Has anyone told the client there is **no harm threshold**? Most breach plans imported from GDPR have one. | s.8(6) |
| E12 | Are **onward Processors and sub-processors** in the incident escalation chain? | s.8(1), s.8(5) |

---

## F. Retention and erasure

| # | Question | Anchor |
|---|---|---|
| F1 | Is there a **retention schedule** mapping purpose to trigger to period to disposal method? | s.8(7) |
| F2 | Does erasure fire on **withdrawal of consent**, and on **purpose exhaustion**, whichever is earlier? | s.8(7)(a) |
| F3 | Does erasure **propagate to Processors**, including backups and analytics copies? | s.8(7)(b) |
| F4 | Where retention continues, is the **specific legal obligation** cited, per activity? | s.8(7) opening words |
| F5 | Does the client fall in a **Third Schedule class** (large e-commerce, online gaming, social media)? If so, apply the deemed period and the erasure workflow. | Rule 8(1) |
| F6 | Is the **48-hour pre-erasure notice** implemented for those classes? | Rule 8(2) |
| F7 | Is the **one-year minimum** for personal data, associated traffic data and processing logs honoured? | Rule 8(3) |

---

## G. Children and persons with disability

| # | Question | Anchor |
|---|---|---|
| G1 | Is there **age assurance** at the point of collection? | s.9(1) |
| G2 | Is **verifiable parental consent** obtained, with due-diligence checks that the person is an identifiable adult, via held identity details, voluntarily provided details, or a virtual token from an authorised entity or DigiLocker? | s.9(1), Rule 10 |
| G3 | For a person with disability having a lawful guardian, is **guardian verification** implemented? | s.2(j)(ii), s.9(1), Rule 11 |
| G4 | Is any processing likely to cause **detrimental effect on a child's well-being**? Note this is **never exemptible**. | s.9(2), s.9(4) |
| G5 | Is **tracking, behavioural monitoring, or targeted advertising** switched off for child users, including analytics SDKs, ad pixels, retargeting and lookalike audiences? Consent does not cure this. | s.9(3) |
| G6 | Does the client rely on a **Fourth Schedule** exemption? Verify the class and the specific purpose against the Gazette. | s.9(4), Rule 12 |
| G7 | Has the client wrongly assumed an age of 13 or 16? | s.2(f) |

---

## H. Significant Data Fiduciary (only if notified)

| # | Question | Anchor |
|---|---|---|
| H1 | **DPO** appointed, **based in India**, an individual, **responsible to the board of directors** or similar governing body, and named as the grievance contact? | s.10(2)(a) |
| H2 | **Independent data auditor** appointed? Independent of the compliance function being audited. | s.10(2)(b) |
| H3 | **DPIA and audit every twelve months** from designation? | s.10(2)(c), Rule 13(1) |
| H4 | Is the **report of significant observations furnished to the Board**? | Rule 13(2) |
| H5 | **Algorithmic due diligence**: has the client verified that its technical measures, including algorithmic software used for hosting, display, upload, publishing, transmission, storage or sharing, do not risk Data Principal rights? | Rule 13(3) |
| H6 | Any **localisation** obligation triggered for Government-specified categories, including traffic data on the flow? | Rule 13(4) |

---

## I. Rights machinery

| # | Question | Anchor |
|---|---|---|
| I1 | Are the **means and required particulars** for exercising rights **prominently published** on the website or app? | Rule 14(1) |
| I2 | Can the client actually produce a **s.11 access response**: summary of data, processing activities, and the identities of Fiduciaries and Processors it was shared with plus a description of what was shared? Most cannot produce the sharing list. | s.11(1) |
| I3 | Is the **law-enforcement sharing carve-out** correctly applied and not over-applied? | s.11(2) |
| I4 | Is there a **correction, completion and updating** workflow that actually writes back to downstream systems? | s.12(2) |
| I5 | Is there an **erasure** workflow with the "necessary for the specified purpose or for legal compliance" test applied per record, not per system? | s.12(3) |
| I6 | Is a **grievance mechanism** live, with the response period **published**, and within a reasonable period not exceeding ninety days? | s.8(10), s.13, Rule 14(3) |
| I7 | Is the **nomination** facility available? | s.14, Rule 14(4) |
| I8 | Is the **business contact information** of the DPO or answering person published, and included in every response to a rights communication? | s.8(9), Rule 9 |
| I9 | Has the client been told there is **no portability right** and **no right against automated decisions**, so it should not over-build? | s.11 to s.14 |

---

## J. Cross-border and governance

| # | Question | Anchor |
|---|---|---|
| J1 | Where does the data physically go? Any country on a **s.16(1) notified restriction list**? | s.16(1) |
| J2 | Does a **sectoral localisation rule** bind independently (RBI payment data, insurance, telecom, CERT-In)? | s.16(2) |
| J3 | Any arrangement making data available to a **foreign State** or a State-controlled entity? | Rule 15 |
| J4 | Is accountability documented at board level, given s.8(1) makes contrary agreements irrelevant? | s.8(1) |
| J5 | Where the client is a **Processor for foreign clients under a foreign contract**, has the s.17(1)(d) exemption been properly claimed, with s.8(1) and s.8(5) still honoured? | s.17(1)(d) |

---

## K. Documents to request in any audit

1. Privacy notice and every consent screen, in every language served.
2. Consent log schema and a sample export.
3. Record of processing activities, purpose to lawful basis map.
4. Data inventory and data flow diagrams, including third-country flows.
5. All Data Processor contracts and sub-processor lists.
6. Retention schedule and the erasure runbook.
7. Incident response plan, with the DPDP notification annexes.
8. Security architecture: encryption at rest and in transit, access control model, logging design.
9. Age assurance and parental-consent design, if any child users.
10. Grievance policy, published response period, and the last twelve months of grievance logs.
11. SDF designation notification, DPO appointment letter, auditor engagement, last DPIA and audit report, if applicable.
12. Any sectoral regulatory correspondence on data handling.

---

## L. Remediation priority order

Rank findings by the Schedule ceiling behind them, then by how quickly the Board could see it.

1. **s.8(5) security safeguards**, Rule 6 minimums. Ceiling Rs 250 crore. Highest exposure, and a
   breach makes the gap self-evident.
2. **s.8(6) and Rule 7 breach readiness.** Ceiling Rs 200 crore. Cheap to fix, catastrophic to miss,
   and it is the failure the Board hears about first because the breach itself brings the file.
3. **s.9 children.** Ceiling Rs 200 crore. Often a single ad-SDK configuration.
4. **s.10 and Rule 13 SDF duties**, if notified. Ceiling Rs 150 crore.
5. **Everything else**, Schedule item 7. Ceiling Rs 50 crore. Notice, consent, retention, rights.

Then re-rank by effort. A tracking pixel disabled for under-18 accounts in an afternoon outranks a
six-month consent re-platforming, even though both sit at the same ceiling.