Tick items as you complete them. Your ticks are saved only in this browser (localStorage); nothing is sent to us. This is a summary, not legal advice. Check each linked provision.
Not sure which items apply to you? Try Am I covered? first. Add the start dates to your calendar with the .ics file .
Map the personal data you hold: what you collect, where it is stored, why you use it and who you share it with. s.8(4) , s.11 · From 13 May 2027 For each purpose, record the ground you rely on: consent, or a certain legitimate use under section 7. s.4 , s.7 · From 13 May 2027 Prepare a standalone notice in clear and plain language that itemises the personal data, explains each purpose, and links to withdrawal, rights and complaints to the Board. s.5 , r.3 · From 13 May 2027 Offer the notice and consent request in English or any language in the Eighth Schedule to the Constitution. s.5(3) , s.6(3) · From 13 May 2027 Make consent free, specific, informed, unconditional and unambiguous, by a clear affirmative action, limited to the data you need. s.6(1) · From 13 May 2027 Make withdrawal as easy as giving consent, and stop processing (and make your processors stop) within a reasonable time after withdrawal. s.6(4) , s.6(6) , r.3(c) · From 13 May 2027 Send a notice to people who consented before commencement, as soon as reasonably practicable. s.5(2) · From 13 May 2027 Keep records that prove you gave notice and obtained consent. s.6(10) · From 13 May 2027 Engage Data Processors only under a valid contract that includes reasonable security safeguards. s.8(2) , r.6(1)(f) · From 13 May 2027 Put in place security safeguards: encryption, masking or tokens, access control, logging and monitoring, backups and organisational measures. s.8(5) , r.6 · From 13 May 2027 Retain logs and personal data needed to detect and investigate unauthorised access for one year, unless another law requires otherwise; keep processing logs for at least one year for Seventh Schedule purposes. r.6(1)(e) , r.8(3) · From 13 May 2027 Prepare a breach plan: inform each affected person without delay, inform the Board without delay, and send the Board a detailed report within seventy-two hours. s.8(6) , r.7 · From 13 May 2027 Ensure completeness, accuracy and consistency of data used for decisions about a person or shared with another Data Fiduciary. s.8(3) · From 13 May 2027 Erase data when consent is withdrawn or the purpose is no longer served, unless a law requires you to keep it, and make processors erase it too. s.8(7) , s.8(8) · From 13 May 2027 If you are in a Third Schedule class, erase data after three years of inactivity and warn the person at least forty-eight hours before. r.8 , Third Schedule · From 13 May 2027 Prominently publish the business contact of your Data Protection Officer or a person who can answer questions, and include it in every rights response. s.8(9) , r.9 · From 13 May 2027 Run a grievance redressal system and respond within a reasonable period not exceeding ninety days. s.8(10) , s.13 , r.14(3) · From 13 May 2027 Publish how people can use their rights and which identifiers you need; handle access, correction, erasure and nomination requests. s.11 , s.12 , s.14 , r.14 · From 13 May 2027 Get verifiable parental consent before processing a child's data, and do not track, behaviourally monitor or target ads at children unless a Fourth Schedule exemption applies. s.9 , r.10 , r.12 · From 13 May 2027 Verify that a lawful guardian of a person with disability was appointed by a court, designated authority or local level committee. s.9(1) , r.11 · From 13 May 2027 Check any Government restrictions or requirements before transferring data outside India, and any stricter sector rules. s.16 , r.15 · From 13 May 2027 If you use a Consent Manager, confirm that it is registered with the Board. s.6(9) , r.4 · From 13 November 2026 If notified as a Significant Data Fiduciary: appoint a Data Protection Officer based in India, appoint an independent data auditor, and do a DPIA and audit every twelve months. s.10 , r.13 · From 13 May 2027 Train staff, assign owners and review these measures regularly as part of your technical and organisational measures. s.8(4) · From 13 May 2027