DPDP readiness checklist: what India's data protection law asks of your app, and when

1 Dates and status

• Put 13 May 2027 in your plan as the date most DPDP duties apply.

  G.S.R. 843(E) brings sections 3 to 17 and 27 to 34 of the Act into force eighteen months after publication, and Rule 1(4) does the same for Rules 3, 5 to 16, 22 and 23. The calendar date is our calculation from the Gazette date of 13 November 2025.

  Official source

• If you plan to rely on a registered consent manager, note that those provisions start one year after publication, which we calculate as 13 November 2026.

  Section 6(9), section 27(1)(d) and Rule 4 are in the one-year tranche.

  Official source

• Keep meeting the current rules until then: section 43A of the IT Act and the SPDI Rules, 2011.

  Our reading: the Act's section 44(2), which omits section 43A, is in the eighteen-month tranche, and a MeitY release of 11 March 2026 still lists the SPDI Rules as a current safeguard.

  Official source

• Recheck MeitY's DPDP page before each planning cycle.

  The Board was established on 13 November 2025 and MeitY advertised for its Chairperson and Members in May 2026; we found no appointment notified by 20 October 2026. A Removal of Difficulties Order of 5 October 2026 changed wording only.

  Official source

2 Know your data

• List every item of personal data you collect, why, where it is stored, how long you keep it, and which processors (hosting, SMS, email, analytics, AI) touch it.

  Rule 3 requires the notice to itemise the data and its purposes, and Rule 6(1)(f) requires security provisions in your contracts with processors. You cannot do either without the list.

  Official source

• Check whether the Act reaches you if you are outside India.

  Section 3(b) applies the Act to processing outside India when it is connected with offering goods or services to people in India.

  Official source

• Find every place a user under 18 could sign up, and plan verifiable parental consent before processing their data.

  The Act defines a child as anyone under 18 (section 2(f)), requires verifiable parental consent (section 9, Rule 10), and bans tracking, behavioural monitoring and targeted advertising directed at children.

  Official source

3 Notice and consent

• Write a notice that stands on its own, itemises the data and each purpose, and links to withdrawing consent, exercising rights and complaining to the Board.

  Rule 3. Withdrawing consent must be as easy as giving it.

  Official source

• Collect consent with a clear affirmative action, never a pre-ticked box, and keep a record of each consent.

  Section 6(1) requires consent that is free, specific, informed, unconditional and unambiguous, and section 6(10) puts the burden of proving it on you.

  Official source

• Offer the notice in English or a language of the Eighth Schedule, and send it to existing users who consented before the law applies.

  Sections 5(3) and 5(2).

  Official source

4 Security safeguards

• Encrypt, mask or tokenise personal data where you store it, and control who and what can reach it.

  Rule 6(1)(a) and (b) list these as minimum reasonable security safeguards.

  Official source

• Log access to personal data, review the logs, and keep the logs and personal data for one year unless another law requires otherwise.

  Rule 6(1)(c) and (e); Rule 8(3) also requires processing logs to be kept for at least one year from the processing.

  Official source

• Keep backups and a plan to keep processing if data is destroyed or access is lost.

  Rule 6(1)(d).

  Official source

5 Breaches

• Prepare a template to tell each affected user without delay what happened, what it means for them, what you are doing and whom to contact.

  Rule 7(1) lists what the notice to each affected Data Principal must contain.

  Official source

• Prepare to tell the Data Protection Board without delay, and to send a detailed report within 72 hours of becoming aware.

  Rule 7(2). CERT-In's separate 6-hour reporting rule for cyber incidents also applies to Indian body corporates.

  Official source

6 Rights, retention and contact

• Publish on your website or app the contact of a person who can answer questions about your processing, or of your Data Protection Officer if you must have one.

  Rule 9. Only Significant Data Fiduciaries must appoint a Data Protection Officer based in India (section 10(2)(a)).

  Official source

• Build ways for users to access a summary of their data, correct it, erase it and nominate someone, and answer grievances within 90 days at most.

  Sections 11 to 14 and Rule 14(3); MeitY's release on the Rules says requests must be answered within a maximum of 90 days.

  Official source

• Erase personal data when consent is withdrawn or the purpose is no longer served, unless a law requires you to keep it.

  Section 8(7). For e-commerce and social media platforms with at least 2 crore registered users in India, and online gaming with at least 50 lakh, the Third Schedule sets three years from the user's last contact (or from the Rules' commencement, if later), with a warning at least 48 hours before erasure (Rule 8).

  Official source

• Write retention and deletion text for the country the product actually serves.

  Users read the retention promise in your deletion screen; quoting the wrong country's law is both wrong and a review finding waiting to happen.

7 Stakes

• Brief your board on the penalties once they apply.

  The Act's Schedule allows penalties of up to ₹250 crore for failing to take reasonable security safeguards, up to ₹200 crore each for failing to notify a breach and for breaching the children's provisions, and up to ₹50 crore for other breaches.

  Official source

What did these checks catch in our own builds?

Questions about this checklist