45 checks in 12 sections: applicability, your data inventory, notice and consent, Consent Managers, rights and grievances, children's data, security, breach response, retention, vendors, transfers and governance
Free download
DPDPA checklist: see where you stand on the DPDP Act and Rules 2025
45 yes/partial/no checks, the evidence the Board would ask for, and a score that tells you what to fix first.
Prepared by CISOGenie · Last updated October 2026
Get the DPDPA Readiness Checklist (Act + Rules 2025)
Fill out the form below to get instant access to this resource.
Free. No sales call. Printable PDF checklist.
This checklist is general guidance, not legal advice. Using it doesn't by itself make you compliant with the DPDP Act. The PDF carries the full disclaimer.
Summarize this page with:
This free DPDPA checklist turns India's Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 into 45 checks you can answer in about an hour. Each check names the section or Rule it comes from and the evidence you'd show the Data Protection Board. Score yourself, and you'll know which gaps to close before the Consent Manager rules start in November 2026 and the main duties in May 2027.
What's inside
4 extra checks for Significant Data Fiduciaries
The evidence to keep for every check, so a "Yes" holds up when someone asks for proof
A scoring table that tells you what to fix first
A worked example: a 120-person lending app taken from 59% to 84%
The key DPDPA dates on one page
Who it's for
DPOs, legal and compliance leads, CTOs and founders of businesses that handle personal data of people in India.
What is the DPDP Act? for readers new to the law
DPDPA compliance checklist guide the long-form companion
A preview of section H, Breach response
| # | Check | Evidence to keep |
|---|---|---|
H3 | We can send the Board a detailed report within 72 hours of becoming aware of a breach | Board report template; timeline from the last drill |
H4 | One incident record also feeds CERT-In's 6-hour report and sector regulators | Plan section mapping each regulator's clock |
Key DPDPA dates
| Date | What starts |
|---|---|
November 2025 | Rules notified; Data Protection Board set up |
13 November 2026 | Consent Manager registration (Rule 4) |
13 May 2027 | Notice, security, breach reporting, rights, children's data and erasure duties |
Source: DPDP Rules, 2025, Rule 1 (commencement), MeitY. DPDP Rules 2025 summary
Frequently Asked Questions
What is a data fiduciary under DPDPA?
A data fiduciary is any person or company that decides why and how personal data is processed. If you collect customer data for your own app or service, you're a data fiduciary. If you only process it on a client's instructions, you're a data processor, and the client is the fiduciary.
Does DPDPA apply to my company?
DPDPA applies if you process digital personal data in India, or if you're outside India and offer goods or services to people in India. Size doesn't matter. A five-person start-up with an app and an Indian user base is covered, though some notified start-ups get limited exemptions.
When do the DPDP Rules 2025 take effect?
The Rules take effect in three phases. The Board and its procedures started when the Rules were notified in November 2025. Consent Manager registration starts on 13 November 2026. Most other duties, including breach reporting and rights requests, start on 13 May 2027.
How is DPDPA different from GDPR?
DPDPA is narrower and more consent-centred than GDPR. It has fewer lawful grounds, no separate category of sensitive data, and it introduces Consent Managers, which GDPR doesn't have. Penalties are fixed amounts of up to ₹250 crore, not a share of turnover. Read our DPDPA vs GDPR comparison.
What are the penalties under DPDPA?
The Data Protection Board can impose penalties of up to ₹250 crore for each breach of duty. The highest band covers failing to take reasonable security safeguards. Failing to report a breach and breaching children's data duties carry up to ₹200 crore each, Significant Data Fiduciary duties up to ₹150 crore, and other duties up to ₹50 crore.
The DPDPA Readiness Checklist from CISOGenie is a free, printable checklist of 45 checks covering India's Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025. Each check cites its section or Rule and the evidence to keep for the Data Protection Board. A scoring table shows what to fix first, ahead of the Consent Manager rules in November 2026 and the main duties in May 2027. CISOGenie is an AI-powered GRC platform for DPDPA, ISO 27001, SOC 2 and 40+ frameworks.
DPDPA compliance with CISOGenie