Toolkit
DPDP Act (India) readiness cheat sheet
A one-page summary to work from, not a substitute for the full guide or the official text.
Saves a one-page PDF straight to your device. It is put together by your browser, on this page — nothing is uploaded.
Who it's for. Any Data Fiduciary processing digital personal data in India, or outside India when that processing is connected to offering goods or services to people in India.
Scope
- Covers digital personal data — collected digitally, or collected offline and later digitised
- Applies outside India too, where it's connected to offering goods or services to Data Principals in India
- Excludes personal or domestic use, and data the Data Principal has already made publicly available
- Most core duties (Rules 3, 5–16, 22, 23) phase in from 13 May 2027 — but the mapping and redesign work needs to start well before then
Key requirements
- Pick consent or a 'certain legitimate use' under section 7 for each processing purpose
- Give an itemised, understandable notice before relying on consent, with a withdrawal path as easy as giving it (Rule 3)
- Apply Rule 6's minimum security safeguards: encryption or masking, access controls, logging and monitoring, backups
- Retain logs and the relevant personal data for at least one year (Rule 8)
- Notify affected Data Principals without delay, and the Board within 72 hours — there is no materiality threshold (Rule 7)
- Get verifiable parental consent before processing a child's data; no tracking or targeted advertising to children (Rule 10)
- If you may be a Significant Data Fiduciary: plan for an India-based DPO, an independent auditor and an annual DPIA
Evidence to gather
- Data inventory mapping purposes, flows, processors and storage locations
- Notices and consent records, including withdrawal logs
- Rule 6 security control evidence and access/monitoring logs
- Breach register, and the notices sent to the Board and to affected people
- Retention and erasure records, including the one-year log retention
- Data Processor contracts
- DPIA and audit reports, for Significant Data Fiduciaries
Common gaps
- Treating it as 'just GDPR' and reusing GDPR notices and consent flows unchanged
- Assuming the 2027 date means there's nothing to do yet — data mapping and logging changes take real time
- No process yet for the 72-hour Board report, which has no materiality threshold unlike many other regimes
- Missing the one-year minimum log-retention requirement in Rule 8
This is general educational information, condensed by MajorCyber™ in its own words, not legal, audit or certification advice, and not a compliance assessment, certification or attestation of any kind. It is a starting checklist, not a complete statement of the framework's requirements — confirm anything material against the full DPDP Act (India) guide, the official text, or a qualified adviser.