DPDP Act Compliance Checklist: What to Fix Before 13 November 2026
Prepare Your Business for India’s Digital Personal Data Protection Framework
India’s Digital Personal Data Protection (DPDP) framework is changing how organisations should approach the collection, use, storage, and protection of digital personal data. For businesses that handle customer information, employee records, website enquiries, or digital transactions, preparing for compliance involves more than updating a privacy policy.
The Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 establish requirements covering matters such as consent, transparency, security safeguards, individual rights, and accountability. The framework is being introduced in phases, giving organisations time to prepare for the provisions that apply to them. Official notification and rules.
For businesses searching for a DPDP Act compliance checklist, the immediate priority is understanding what changes by 13 November 2026, what comes later, and which gaps are worth addressing now.
This guide provides a practical checklist for reviewing your data collection practices, consent processes, vendors, security controls, and internal responsibilities.
What Is the DPDP Act Compliance Deadline in India?
Know which obligations apply at each stage
The DPDP Act does not introduce every obligation on a single date. The government notified the DPDP Rules, 2025 alongside a phased commencement schedule in November 2025.
The distinction matters because the date in this article’s title relates to a specific milestone, not the general deadline for every organisation.
| Date |
What it means |
| 13 November 2025 |
The commencement notifications and DPDP Rules were notified, with specified provisions taking effect immediately. |
| 13 November 2026 |
The Consent Manager registration provisions, including Rule 4 and the relevant provisions of the Act, are scheduled to take effect. |
| 13 May 2027 |
The main group of operational provisions, including many core obligations for Data Fiduciaries, is scheduled to take effect. |
These dates follow the notified phased commencement schedule. Check the latest official notifications for any subsequent changes before making legal or operational decisions.
What this means for most businesses: 13 November 2026 should be treated as a specific Consent Manager milestone. Businesses that collect or process personal data should still use the time before the broader May 2027 implementation phase to prepare their systems and processes.
A business does not automatically need to register as a Consent Manager merely because it collects personal data. The registration requirement is relevant to entities operating as Consent Managers under the framework.
DPDP Act Compliance Checklist: 10 Areas to Review Now
Start with the systems and processes that use personal data
Use this checklist as an internal readiness exercise. The exact legal requirements will depend on your organisation’s role, processing activities, applicable exemptions, and the provisions in force at the relevant time.
1. Create an Inventory of Personal Data
Find out what your organisation collects and where it goes
You cannot manage data protection effectively if you do not know which personal data your business holds.
Review the data collected through:
- Website contact and demo forms
- Customer registration and account creation
- eCommerce orders and payment-related workflows
- Employee recruitment and HR systems
- CRM and customer support platforms
- Mobile applications and SaaS products
- Email, SMS, and WhatsApp communication
- Analytics tools and third-party integrations
For each data source, document what information is collected, why it is needed, where it is stored, who can access it, and which service providers receive it.
Action to take: Create a central data inventory and assign an owner to keep it updated.
2. Review Privacy Notices and Consent Language
Explain data use in language people can understand
A privacy notice should explain the personal data being collected and the purposes for which it will be processed. Under the DPDP framework, notices and consent mechanisms must meet applicable requirements, including requirements around clarity and purpose-specific information.
Review the wording shown on your website, applications, forms, and other collection points.
Check whether users can understand:
- What personal data is being requested
- Why the information is required
- Which purposes the organisation intends to fulfil
- How they can exercise applicable rights
- How to contact the organisation with questions or grievances
Action to take: Identify outdated, vague, or overly broad notices and prepare revised versions that match actual data practices.
Do not assume that placing a link to a general privacy policy beside a form automatically satisfies every notice or consent requirement.
3. Review Consent Collection and Withdrawal
Make permission meaningful and manageable
Where consent is the applicable legal basis for processing, the organisation should review how consent is requested, recorded, and managed.
Ask your team:
- Is the consent request clear and understandable?
- Can the purpose of consent be identified?
- Is consent recorded in a way that can be retrieved?
- Can the organisation demonstrate when and how consent was obtained?
- Is there a workable process for handling withdrawal requests?
- Are downstream systems updated when consent status changes?
Marketing subscriptions, product updates, customer support, and account operations may involve different purposes and requirements. Avoid treating one broad checkbox as permission for every activity.
Action to take: Map consent collection and withdrawal processes to the systems that rely on the relevant data.
4. Review Data Access and Security Controls
Limit exposure before an incident happens
Data protection preparation should include a review of the systems and people who can access personal data.
Check for:
- Shared administrator accounts
- Excessive permissions
- Inactive employee accounts
- Unprotected data exports
- Weak authentication practices
- Missing access logs
- Unencrypted data transfers
- Poorly controlled third-party access
Apply access controls based on job responsibilities and business needs. Review how sensitive data is transmitted between websites, applications, APIs, cloud systems, and service providers.
Action to take: Prioritise high-risk access gaps and document who is responsible for resolving them.
Need Help Reviewing Your Security Readiness?
Businesses can also review the technical controls that support secure digital operations. Explore FlyingStars Security Solutions for relevant security services, including SSL certificates, Data Loss Prevention, and data classification. These services can support parts of a wider security programme, but they do not by themselves establish DPDP compliance.
5. Check Vendor and Data Processor Relationships
Know which external services handle your data
Businesses often share personal data with cloud hosting providers, CRM platforms, analytics services, email platforms, support tools, and software vendors.
Create a list of providers that process personal data on your organisation’s behalf or receive it as part of a business workflow.
Review:
- What data each provider receives
- Why the provider needs that information
- Contractual data protection responsibilities
- Access and account management
- Security and incident escalation procedures
- Data return, deletion, and retention practices
- Whether data is transferred to other providers
Action to take: Prioritise critical vendors and ensure that contracts, responsibilities, and incident communication processes are documented.
The applicable legal requirements should be checked against the final rules and your organisation’s role. Do not assume that a vendor’s general security certification replaces the need to assess the arrangement.
6. Define a Personal Data Breach Response Process
Prepare before a security incident occurs
A data breach can expose personal information through compromised accounts, misdirected emails, vulnerable applications, unauthorised access, or lost devices.
Your organisation should have a documented process for identifying, escalating, investigating, and responding to suspected personal data breaches.
Include:
- A clear incident reporting channel
- Named incident response responsibilities
- A process for assessing the type and scope of affected data
- Coordination between IT, security, legal, and business teams
- Evidence preservation and investigation steps
- A process for determining applicable notification requirements
- A record of decisions and remediation activities
Action to take: Run a tabletop exercise using a realistic scenario, such as an exposed customer database or compromised employee account.
The DPDP Rules include breach-related requirements that take effect under the phased schedule. Prepare now, but verify the precise notification duties and applicable timelines under the provisions in force when an incident occurs.
7. Review Data Retention and Deletion
Do not keep personal data without a clear reason
Old customer records, unused accounts, outdated recruitment information, and redundant data exports can create unnecessary exposure.
Document the reasons for retaining different data types and identify when information can be deleted or anonymised, subject to applicable legal, contractual, and operational requirements.
Check:
- Whether retention periods are documented
- Whether old records can be identified
- Whether deletion processes cover relevant systems
- Whether backups and archived data are addressed
- Whether vendors follow agreed deletion procedures
- Whether retention exceptions have an accountable owner
Action to take: Build a retention schedule and prioritise information that no longer serves a documented purpose.
Avoid deleting records indiscriminately. Other laws or legitimate obligations may require certain records to be retained.
8. Prepare for Data Principal Requests
Plan how people can exercise their rights
The DPDP framework provides for rights of individuals, referred to as Data Principals, including rights relating to access to information, correction, erasure, grievance redressal, and nomination, subject to the Act and applicable rules.
Prepare a process for receiving and handling these requests.
Your process should identify:
- Where requests can be submitted
- How the organisation verifies the request appropriately
- Which team owns each request type
- How relevant systems and vendors are involved
- How responses and decisions are recorded
- How grievances are escalated
Action to take: Create a request-handling workflow and test it using a sample access, correction, or erasure request.
Confirm the applicable timelines and detailed procedures against the provisions in force. Do not rely on an internal target as a substitute for a statutory deadline.
9. Review Children’s Data and Special Use Cases
Identify processing that may require additional safeguards
The DPDP framework includes specific provisions relating to children’s personal data and certain other situations. Businesses should identify whether their products or services are likely to involve children’s data or any processing that may be subject to additional requirements.
Consider:
- Age-related information collected during registration
- Education and student platforms
- Family or guardian-related workflows
- Age verification and consent processes
- Whether an applicable exemption may be relevant
- How staff handle requests involving children
Action to take: Flag relevant use cases for legal and privacy review before changing how data is collected or processed.
Do not assume that a general consent checkbox satisfies the specific requirements that may apply to children.
10. Assign Accountability and Track Remediation
Turn a checklist into a managed programme
Compliance tasks can stall when ownership is unclear. Assign responsibility across legal, IT, security, HR, marketing, customer support, and procurement as appropriate for your organisation.
Maintain a remediation tracker containing:
| Field |
What to record |
| Gap identified |
The issue that needs attention |
| Risk or impact |
Why the gap matters |
| Action required |
The proposed remediation |
| Owner |
Person or team accountable |
| Target date |
Planned completion date |
| Evidence |
Policy, configuration, record, or test result |
| Status |
Not started, in progress, blocked, or complete |
Action to take: Review progress regularly with senior stakeholders and escalate high-risk gaps that need budget, technical work, or external advice.
What Is a Consent Manager Under the DPDP Rules 2025?
Understand the specific November 2026 milestone
A Consent Manager is an entity that enables a Data Principal to give, manage, review, or withdraw consent through an accessible and transparent platform, within the framework’s requirements.
The DPDP Rules, 2025 include conditions for Consent Manager registration. The relevant registration provisions are part of the one-year commencement phase scheduled for 13 November 2026.
This is distinct from the obligations that apply to an ordinary organisation acting as a Data Fiduciary.
Before deciding whether registration is relevant to your business, ask:
- Does the organisation intend to operate as a Consent Manager under the DPDP framework?
- Does its proposed service fit the applicable definition and registration conditions?
- Have the relevant eligibility and governance requirements been assessed?
- Are the required technical, operational, and accountability arrangements in place?
- Has the organisation reviewed the official rules and applicable registration process?
Important: Simply collecting consent from customers does not automatically make a business a Consent Manager. Most businesses should focus first on understanding their own data processing obligations and whether the Consent Manager framework is relevant to their proposed activities.
DPDP Penalties: Why Early Preparation Matters
Treat compliance gaps as business risks
The DPDP Act contains a schedule of monetary penalties for specified contraventions. The potential amount depends on the type of contravention and the applicable statutory provisions. The framework also provides for consideration of factors such as the nature and gravity of a breach and actions taken to mitigate its effects. <Cite refs={[“turn640453search6″,”turn640453search7”]} />
The Act’s schedule includes maximum penalties of up to ₹250 crore for failure to take reasonable security safeguards to prevent a personal data breach, and up to ₹200 crore for specified failures involving breach notification or children’s data obligations. Other contraventions have different prescribed maximums.
These figures are statutory maximums, not automatic fines for every mistake. The relevant penalty provisions and adjudication powers are subject to the notified commencement schedule. The main penalty and adjudication framework is scheduled to take effect in the May 2027 phase, rather than all penalties becoming applicable on 13 November 2026. <Cite refs={[“turn640453search4″,”turn640453search6”]} />
Organisations should therefore avoid both extremes: assuming there is no need to prepare before the relevant provisions commence, or claiming that all DPDP penalties automatically apply from the November 2026 milestone.
Action to take: Prioritise data protection risks, assign remediation owners, document decisions, and obtain qualified legal advice for questions about specific obligations or potential liability.
How FlyingStars Can Support Your Security Readiness
Strengthen the technical foundations around data protection
DPDP compliance involves legal, organisational, and technical work. Technology can support the security side of the programme, but it cannot replace lawful processing, appropriate notices, consent management, governance, or legal review.
FlyingStars offers security-related services that may be relevant to parts of an organisation’s technical readiness:
These solutions may help address particular technical risks, depending on your architecture and requirements. They should not be presented as a standalone DPDP compliance package or a guarantee of compliance.
Planning your next steps? Review your data flows, identify the highest-priority security gaps, and consult the appropriate legal, privacy, and technology stakeholders before finalising your remediation plan.
DPDP Act Compliance Checklist: Quick Summary
Use this list to organise your next review
- Inventory personal data and the systems that process it.
- Review privacy notices and consent language.
- Document consent collection and withdrawal workflows where applicable.
- Review access controls, authentication, and secure data transfers.
- Assess vendors and data processor arrangements.
- Document incident escalation and breach response procedures.
- Review retention, deletion, and backup practices.
- Prepare processes for Data Principal requests and grievances.
- Identify children’s data and other use cases requiring additional review.
- Assign owners, target dates, and evidence for remediation actions.
- Determine whether the Consent Manager registration framework applies to your organisation.
- Track the November 2026 and May 2027 milestones separately.
Completing this checklist does not by itself establish legal compliance. Use it to identify gaps and organise the work needed for your organisation’s circumstances.
Conclusion: Prepare Early, Track Each Deadline Correctly
The DPDP Act and Rules introduce a phased framework for protecting digital personal data in India. The 13 November 2026 milestone is specifically relevant to Consent Manager registration provisions, while the main group of operational requirements is scheduled for 13 May 2027.
For businesses, the practical starting point is to understand what data they hold, why they use it, who can access it, how consent and requests are managed, and how security incidents are handled. A structured checklist can help turn those questions into owned, trackable actions.
Use the months ahead to identify gaps, strengthen technical safeguards, review policies and contracts, and seek qualified legal guidance where required. Most importantly, keep the November 2026 milestone separate from the broader implementation timeline when planning your compliance programme.
