| Done | Obligation | Reference | From |
|---|---|---|---|
| Map the personal data you hold: what you collect, where it is stored, why you use it and who you share it with. | s.8(4), s.11 | 13 May 2027 | |
| For each purpose, record the ground you rely on: consent, or a certain legitimate use under section 7. | s.4, s.7 | 13 May 2027 | |
| Prepare a standalone notice in clear and plain language that itemises the personal data, explains each purpose, and links to withdrawal, rights and complaints to the Board. | s.5, r.3 | 13 May 2027 | |
| Offer the notice and consent request in English or any language in the Eighth Schedule to the Constitution. | s.5(3), s.6(3) | 13 May 2027 | |
| Make consent free, specific, informed, unconditional and unambiguous, by a clear affirmative action, limited to the data you need. | s.6(1) | 13 May 2027 | |
| Make withdrawal as easy as giving consent, and stop processing (and make your processors stop) within a reasonable time after withdrawal. | s.6(4), s.6(6), r.3(c) | 13 May 2027 | |
| Send a notice to people who consented before commencement, as soon as reasonably practicable. | s.5(2) | 13 May 2027 | |
| Keep records that prove you gave notice and obtained consent. | s.6(10) | 13 May 2027 | |
| Engage Data Processors only under a valid contract that includes reasonable security safeguards. | s.8(2), r.6(1)(f) | 13 May 2027 | |
| Put in place security safeguards: encryption, masking or tokens, access control, logging and monitoring, backups and organisational measures. | s.8(5), r.6 | 13 May 2027 | |
| Retain logs and personal data needed to detect and investigate unauthorised access for one year, unless another law requires otherwise; keep processing logs for at least one year for Seventh Schedule purposes. | r.6(1)(e), r.8(3) | 13 May 2027 | |
| Prepare a breach plan: inform each affected person without delay, inform the Board without delay, and send the Board a detailed report within seventy-two hours. | s.8(6), r.7 | 13 May 2027 | |
| Ensure completeness, accuracy and consistency of data used for decisions about a person or shared with another Data Fiduciary. | s.8(3) | 13 May 2027 | |
| Erase data when consent is withdrawn or the purpose is no longer served, unless a law requires you to keep it, and make processors erase it too. | s.8(7), s.8(8) | 13 May 2027 | |
| If you are in a Third Schedule class, erase data after three years of inactivity and warn the person at least forty-eight hours before. | r.8, Third Schedule | 13 May 2027 | |
| Prominently publish the business contact of your Data Protection Officer or a person who can answer questions, and include it in every rights response. | s.8(9), r.9 | 13 May 2027 | |
| Run a grievance redressal system and respond within a reasonable period not exceeding ninety days. | s.8(10), s.13, r.14(3) | 13 May 2027 | |
| Publish how people can use their rights and which identifiers you need; handle access, correction, erasure and nomination requests. | s.11, s.12, s.14, r.14 | 13 May 2027 | |
| Get verifiable parental consent before processing a child's data, and do not track, behaviourally monitor or target ads at children unless a Fourth Schedule exemption applies. | s.9, r.10, r.12 | 13 May 2027 | |
| Verify that a lawful guardian of a person with disability was appointed by a court, designated authority or local level committee. | s.9(1), r.11 | 13 May 2027 | |
| Check any Government restrictions or requirements before transferring data outside India, and any stricter sector rules. | s.16, r.15 | 13 May 2027 | |
| If you use a Consent Manager, confirm that it is registered with the Board. | s.6(9), r.4 | 13 November 2026 | |
| If notified as a Significant Data Fiduciary: appoint a Data Protection Officer based in India, appoint an independent data auditor, and do a DPIA and audit every twelve months. | s.10, r.13 | 13 May 2027 | |
| Train staff, assign owners and review these measures regularly as part of your technical and organisational measures. | s.8(4) | 13 May 2027 |
From dpdpr.in, 02 November 2026. Independent reference, not legal advice.