DPDP Compliance Checklist: A 90-Day Roadmap From Zero to Audit-Ready
TL;DR
A DPDP programme can reach audit-ready in roughly 90 days if work runs in parallel across six streams: governance, data mapping, notice and consent, rights and grievances, security and breach response, and vendors and retention. This roadmap sets out week-by-week tasks, owners and the evidence each step must produce, with a master checklist at the end. The deadline for most obligations is 13 May 2027.
Who this is for: DPOs, compliance leads and founders who have to take an organisation from "we have a privacy policy" to "we can prove compliance" before the DPDP Act's main obligations take effect.
Most DPDP guidance explains what the law requires. Far less explains the order in which to do it. Order matters: notices depend on knowing your purposes, consent depends on notices, rights handling depends on knowing where data lives, and breach response depends on all of them.
This roadmap gives you that order. It assumes a mid-sized organisation with a privacy policy but few operational controls, and a small core team supported by IT, legal and business owners. Larger organisations can run the same sequence with more parallel teams. For the dates behind it, see the DPDP compliance timeline. For the obligations themselves, see The DPDP Act, Explained.
The six workstreams
The programme runs in six streams, which overlap rather than run one after another:
- Governance: ownership, budget, policy and reporting
- Data mapping: the Record of Processing Activities
- Notice and consent: notices, consent capture and withdrawal
- Rights and grievances: access, correction, erasure, nomination and complaints
- Security and breach response: Rule 6 safeguards and Rule 7 notifications
- Vendors and retention: processor contracts, transfers and erasure
Weeks 1–3: Mobilise and map
Goal: know what personal data you hold, why, and who owns it.
Checklist
- Appoint an accountable programme owner, and decide whether to appoint a DPO
- Secure executive sponsorship and budget; agree a monthly steering review
- Assess Significant Data Fiduciary risk (Section 10) and children's data exposure (Section 9)
- Interview every business function about its processing purposes
- Build the [Record of Processing Activities](/blog/ropa-dpdp): purposes, data items, Data Principals, systems, vendors, transfers, retention
- Confirm scope, including any Section 17 exemptions, using the [5-minute scope test](/blog/does-dpdp-apply-to-me)
Evidence produced: programme charter, ROPA (first version), scope and SDF assessment.
Weeks 4–6: Fix the legal basis, notices and consent
Goal: every purpose has a valid lawful basis, and every consent you collect meets the Section 6 standard.
Checklist
- Assign a lawful basis to every purpose: consent, or a specific legitimate use under Section 7
- Stop or redesign any processing that fits neither
- Draft itemised, standalone notices that meet Rule 3, one per purpose or journey
- Plan Eighth Schedule language coverage for consumer-facing notices
- Redesign consent journeys: unbundled, no pre-ticked boxes, one record per purpose (see [what makes consent valid](/blog/valid-consent-dpdp))
- Design withdrawal so that it is as easy as giving consent and reaches every downstream system
- Plan notices to existing users under Section 5(2)
- Design verifiable parental consent if children may use your services (Rule 10)
Evidence produced: lawful-basis register, approved notice set with version numbers, consent and withdrawal designs.
Weeks 7–9: Build rights and breach processes
Goal: you can answer any rights request and handle any breach within the legal timelines.
Checklist
- Publish how to make requests and which identifier is needed (Rule 14)
- Publish DPO or contact details (Section 8(9))
- Build the request workflow: intake, verification, locating data, decision, response and record (see [Data Principal rights](/blog/data-principal-rights))
- Set internal response targets well inside the 90-day grievance limit
- Create a nominee process for Section 14
- Write the breach response plan with owners for each Rule 7 notice and CERT-In reporting (see the [Rule 7 playbook](/blog/dpdp-breach-notification))
- Prepare notice templates for affected individuals and the Board
- Confirm Rule 6 safeguards: encryption or masking, access control, logging and monitoring, backups, and log retention of at least one year
Evidence produced: published rights page, request log, breach response plan, notice templates, security control register.
Weeks 10–12: Vendors, retention and integration
Goal: your vendors are bound by the same rules, and data is erased on schedule.
Checklist
- List every processor from the ROPA and rank them by risk
- Sign DPDP processor terms: documented instructions, Rule 6 safeguards, prompt breach notification, support for rights requests, deletion at exit
- Check cross-border transfers against Section 16 and any sector localisation rules
- Approve a retention schedule with a period, trigger and erasure method for each purpose, noting legal holds
- Implement erasure jobs, including the 48-hour advance notice where the Third Schedule applies (Rule 8)
- Integrate consent and withdrawal with CRM, marketing, analytics and vendor systems
- Send notices to existing users
Evidence produced: signed processor contracts, transfer register, retention schedule, erasure logs, integration test results.
Week 13: Test, train and report
Goal: prove that it works, and show the board.
Checklist
- Run a breach tabletop exercise against the Rule 7 and CERT-In timelines
- Test a full rights request end to end, including erasure at vendors
- Test a consent withdrawal end to end
- Train staff who handle personal data, with extra sessions for support, marketing and engineering
- Present a readiness report to the board: controls in place, evidence available, open risks and owners
- Set the operating rhythm: monthly metrics, quarterly reviews, annual ROPA refresh (and, for SDFs, annual DPIA and audit under Rule 13)
Evidence produced: test reports, training records, board readiness report.
The DPDP evidence pack
At the end of 90 days, you should be able to hand any auditor, customer or regulator the following:
| Evidence | Supports |
| Record of Processing Activities | Notice, access, retention, breach scoping |
| Versioned notices and language versions | Section 5, Section 6(3), Rule 3 |
| Consent and withdrawal records per purpose | Section 6, Section 6(10) burden of proof |
| Rights and grievance log with response times | Sections 11–14, Rule 14 |
| Breach response plan, templates and incident log | Section 8(6), Rule 7 |
| Security control register and log retention evidence | Section 8(5), Rule 6 |
| Signed processor contracts and transfer register | Section 8(2), Section 16 |
| Retention schedule and erasure logs | Section 8(7), Rule 8 |
| Training records and board reports | Accountability under Section 8(1) |
Common roadmap mistakes
- Starting with the privacy policy. Write the policy last, once you know what you actually do.
- Running streams in sequence. Vendor contracts and system integration take longest, so start them early.
- Treating it as a legal project. Most of the work is operational and technical. Involve IT and business owners from the start.
- No evidence trail. Controls you cannot prove will not help you in front of the Board.
- Stopping at day 90. Compliance is an operating rhythm, not a one-off project.
How ConsentifyAI helps
ConsentifyAI brings the six workstreams into one platform. The ROPA module maps your processing. Notices and consent are versioned and captured per purpose. Rights requests are tracked against deadlines. Every action is recorded in a tamper-evident audit trail that becomes your evidence pack. Instead of assembling proof from spreadsheets and inboxes, your compliance status is visible and up to date.
Sources & references
- DPDP Act, 2023 — Sections 5–17
- DPDP Rules, 2025 — Rules 3, 6, 7, 8, 9, 10, 13, 14
Frequently asked questions
How long does DPDP compliance take?
A focused mid-sized organisation can build the core programme in around 90 days, with system integration and vendor contracts often continuing longer. Large enterprises and likely Significant Data Fiduciaries should plan for longer.
What is the first step in DPDP compliance?
Appoint an accountable owner and build a Record of Processing Activities. Every other control depends on knowing what personal data you hold, why, where and with whom it is shared.
Do we need a Data Protection Officer?
Only Significant Data Fiduciaries must appoint a DPO based in India. Every fiduciary must publish the contact details of a person who can answer questions about its processing, and most programmes benefit from a named privacy owner.
What evidence should a DPDP programme produce?
A Record of Processing Activities, versioned notices, consent and withdrawal records, a rights and grievance log, a breach response plan and log, signed processor contracts, a retention schedule with erasure records, and evidence of training.
When is the DPDP compliance deadline?
13 May 2027 for the substantive obligations on Data Fiduciaries.
Related reading
DPDP Compliance Timeline: Every Deadline Between Now and Full Enforcement
The DPDP Act is being switched on in three phases. The Data Protection Board provisions have been live since 13 November 2025. Consent Manager rules take effect on 13 November 2026. Every substantive obligation on businesses, including notice, consent, security, breach reporting, retention, rights and penalties, becomes enforceable on 13 May 2027. From October 2026, that leaves roughly seven months. For most organisations, that is just enough time if work starts now.
ReadROPA Under DPDP: Map Every Data Flow Before Someone Else Does
Unlike the GDPR, the DPDP Act does not explicitly require a Record of Processing Activities. But without one, you cannot write itemised notices, tell individuals who received their data, erase it on time, scope a breach within 72 hours, or prove compliance. A DPDP ROPA records each processing activity's purpose, data, individuals, lawful basis, systems, recipients, transfers, retention and safeguards. It is the foundation every other DPDP control is built on.
ReadValid Consent Under DPDP: Why Your Checkbox Isn't Enough
Under Section 6 of the DPDP Act, consent is valid only if it is free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the data necessary for the stated purpose. It must come with a standalone, itemised notice. It must be as easy to withdraw as to give. And the business, not the customer, must be able to prove all of this (Section 6(10)). A checkbox captures a click. It does not, by itself, meet any of these tests.
Read