---
title: "DPDP Compliance Checklist for Data Fiduciaries | dpdpr.in"
description: "DPDP Act compliance checklist for Data Fiduciaries: every duty under the Act and DPDP Rules 2025 with its deadline, in a printable list."
url: "https://dpdpr.in/guides/compliance-checklist/"
canonical: "https://dpdpr.in/guides/compliance-checklist/"
site: "dpdpr.in"
updated: "2026-11-02"
disclaimer: "Independent reference, not legal advice. Not affiliated with the Government of India or MeitY."
---

# Data Fiduciary compliance checklist

An interactive checklist of the main DPDP Act and Rules obligations for Data Fiduciaries, with section and rule references.

- [ ] Map the personal data you hold: what you collect, where it is stored, why you use it and who you share it with. (s.8(4), s.11; from 13 May 2027)
- [ ] For each purpose, record the ground you rely on: consent, or a certain legitimate use under section 7. (s.4, s.7; from 13 May 2027)
- [ ] Prepare a standalone notice in clear and plain language that itemises the personal data, explains each purpose, and links to withdrawal, rights and complaints to the Board. (s.5, r.3; from 13 May 2027)
- [ ] Offer the notice and consent request in English or any language in the Eighth Schedule to the Constitution. (s.5(3), s.6(3); from 13 May 2027)
- [ ] Make consent free, specific, informed, unconditional and unambiguous, by a clear affirmative action, limited to the data you need. (s.6(1); from 13 May 2027)
- [ ] Make withdrawal as easy as giving consent, and stop processing (and make your processors stop) within a reasonable time after withdrawal. (s.6(4), s.6(6), r.3(c); from 13 May 2027)
- [ ] Send a notice to people who consented before commencement, as soon as reasonably practicable. (s.5(2); from 13 May 2027)
- [ ] Keep records that prove you gave notice and obtained consent. (s.6(10); from 13 May 2027)
- [ ] Engage Data Processors only under a valid contract that includes reasonable security safeguards. (s.8(2), r.6(1)(f); from 13 May 2027)
- [ ] Put in place security safeguards: encryption, masking or tokens, access control, logging and monitoring, backups and organisational measures. (s.8(5), r.6; from 13 May 2027)
- [ ] Retain logs and personal data needed to detect and investigate unauthorised access for one year, unless another law requires otherwise; keep processing logs for at least one year for Seventh Schedule purposes. (r.6(1)(e), r.8(3); from 13 May 2027)
- [ ] Prepare a breach plan: inform each affected person without delay, inform the Board without delay, and send the Board a detailed report within seventy-two hours. (s.8(6), r.7; from 13 May 2027)
- [ ] Ensure completeness, accuracy and consistency of data used for decisions about a person or shared with another Data Fiduciary. (s.8(3); from 13 May 2027)
- [ ] Erase data when consent is withdrawn or the purpose is no longer served, unless a law requires you to keep it, and make processors erase it too. (s.8(7), s.8(8); from 13 May 2027)
- [ ] If you are in a Third Schedule class, erase data after three years of inactivity and warn the person at least forty-eight hours before. (r.8, Third Schedule; from 13 May 2027)
- [ ] Prominently publish the business contact of your Data Protection Officer or a person who can answer questions, and include it in every rights response. (s.8(9), r.9; from 13 May 2027)
- [ ] Run a grievance redressal system and respond within a reasonable period not exceeding ninety days. (s.8(10), s.13, r.14(3); from 13 May 2027)
- [ ] Publish how people can use their rights and which identifiers you need; handle access, correction, erasure and nomination requests. (s.11, s.12, s.14, r.14; from 13 May 2027)
- [ ] Get verifiable parental consent before processing a child's data, and do not track, behaviourally monitor or target ads at children unless a Fourth Schedule exemption applies. (s.9, r.10, r.12; from 13 May 2027)
- [ ] Verify that a lawful guardian of a person with disability was appointed by a court, designated authority or local level committee. (s.9(1), r.11; from 13 May 2027)
- [ ] Check any Government restrictions or requirements before transferring data outside India, and any stricter sector rules. (s.16, r.15; from 13 May 2027)
- [ ] If you use a Consent Manager, confirm that it is registered with the Board. (s.6(9), r.4; from 13 November 2026)
- [ ] If notified as a Significant Data Fiduciary: appoint a Data Protection Officer based in India, appoint an independent data auditor, and do a DPIA and audit every twelve months. (s.10, r.13; from 13 May 2027)
- [ ] Train staff, assign owners and review these measures regularly as part of your technical and organisational measures. (s.8(4); from 13 May 2027)

[Printable version](https://dpdpr.in/guides/compliance-checklist/print/)

Independent reference, not legal advice.