DPDP Compliance Checklist (2026): 12 Steps Every Indian Startup Must Complete

The DPDP Act compliance checklist consists of 12 operational requirements every Indian startup should implement before the November 2026 soft-enforcement deadline: consent management, retention schedules, breach response, grievance handling, and Data Principal rights.

Most Indian startups will not miss that deadline because they ignored it. They will miss it because nobody turned the Act into a task list their team could actually execute. This checklist does that, ordered the way an audit would probe it rather than the way the statute happens to be numbered.

Who must comply with the DPDP Act?

Every entity that determines the purpose and means of processing digital personal data of individuals in India, called a Data Fiduciary, must comply, regardless of company size. This includes SaaS products, mobile apps, and B2B software, not only consumer-facing platforms. A narrower set of extra obligations, including an annual Data Protection Impact Assessment, applies only to companies designated as Significant Data Fiduciaries [Rule 13]. For a fuller walkthrough of who counts and why, see what the DPDP Act actually is.

The DPDP enforcement timeline you are working against

The Digital Personal Data Protection Rules were notified on 13 November 2025, and compliance obligations arrive in phases:

The DPDP compliance checklist: 12 steps

1. 1.Map every place personal data lives. Databases, logs, analytics tools, spreadsheets, and vendor systems. You cannot protect (or delete) data you have not found. Shadow PII in logs is the most common gap we see in scans.
2. 2.Rewrite your privacy notice for the DPDP Act, not the IT Act. If your policy cites the IT Act 2000 and never mentions the DPDP Act, it announces its own non-compliance. Notices must be clear, itemised by purpose, and available in the 22 Eighth Schedule languages [§5(3)].
3. 3.Make consent specific, informed, and separate per purpose [§6]. One checkbox per purpose. Marketing consent is not analytics consent, and neither covers data sharing. "By using this app you agree" is usage, not consent, and it will not survive an audit. A Record of Processing Activities makes this easier to get right; see our RoPA template for the DPDP Act.
4. 4.Record consent with timestamp, purpose, and the text shown. When the Board asks how a specific user consented in 2026, you need the exact answer, not the current version of your banner.
5. 5.Set a retention period for every data category [Rule 8]. A number, a date, or a trigger; "as long as necessary" is a deferred decision, not a policy. Then automate the deletion, because a schedule nobody executes is worse than no schedule. Retention floors differ by sector; see our breakdowns for fintech and healthtech.
6. 6.Build the erasure path. When consent is withdrawn or the purpose is served, personal data must actually be erased from primaries, replicas, backup policies, and processors. Test it end-to-end with a real record.
7. 7.Name a Grievance Officer with a working contact [Rule 9, Rule 14]. A named human, a reachable email, and a grievance redressal system that responds within 90 days [Rule 14(3)]. A contact form does not count.
8. 8.Stand up a Data Principal rights workflow [§11 to §14]. Access, correction, erasure, and nomination. You have defined timelines to respond, and manual email threads will not scale past your first dozen requests.
9. 9.Write the 72-hour breach playbook before you need it [§8(6), Rule 7]. Define "aware", name an incident owner, and pre-draft the DPB and Data Principal notifications. The clock starts when you become aware, not when you finish investigating.
10. 10.Verify parental consent for children's data [§9]. If any users are under 18, you need verifiable parental consent and zero tracking or targeted advertising directed at them. Penalties here are among the steepest.
11. 11.Put contracts and purpose limits around every processor. Your analytics, support, and AI vendors process personal data on your behalf. Their gap is your liability, because the Act holds the Data Fiduciary responsible, not the vendor. See our vendor management and Data Processing Agreement guide for the specific clauses to add.
12. 12.Keep audit-ready evidence of all of the above. Immutable logs of consent, deletion, and breach handling. Under the DPDP Act the operating assumption is that you can prove compliance on request. Claims without records are just claims. A DPIA is the fastest way to surface what evidence you are still missing.

For the order to actually build these in, and why sequence matters more than the list itself, see our step-by-step DPDP implementation guide.

DPDP Act penalties and fines

These are per-violation ceilings, and the Board weighs the nature, gravity, and duration of the breach. For a funded startup, the realistic risk is not only the fine. It is failing enterprise vendor due diligence, investor data-room questions, and B2B audits that now routinely ask "are you DPDP-compliant?" (see why this matters beyond the penalty). The Rules themselves are published on MeitY's official Digital Personal Data Protection Rules 2025 page.

How to get through this list in weeks, not quarters

Items 1, 4, 5, 6, 8, and 12 are engineering problems: data discovery, consent records, retention automation, erasure, rights workflows, and audit logs. That is exactly the surface Privacy Labs automates. Run a discovery scan, deploy layered consent, and export audit-ready proof, with setup measured in about 60 minutes rather than months. For the realistic manual-vs-automated breakdown, see how long DPDP compliance actually takes.

Start with the free Compliance Score. It checks your privacy policy, cookie consent, and retention posture against this checklist and shows you exactly which items you are missing, in 60 seconds and with no signup.