DPDP Act 2023: A Compliance Checklist for Indian Companies

By LegalInk Editorial ·

DPDP Act 2023: A Compliance Checklist for Indian Companies

The Digital Personal Data Protection Act, 2023 received Presidential assent on 11 August 2023, and the Central Government has been phasing in its operative provisions through subordinate rule-making. The draft DPDP Rules circulated in early 2025 have sharpened the picture considerably, yet most in-house teams are still working from incomplete internal frameworks — uncertain about sequencing, documentation, and how much to lock in before final notification. This post sets out a structured compliance checklist for corporate counsel, covering classification, consent architecture, data principal rights, key documents, Significant Data Fiduciary obligations, Data Protection Board exposure, and the children's data and cross-border transfer regimes, with practical notes on what to action now versus what to defer.

1. Classify Your Organisation Under the Act

Before documentation or process work begins, counsel must determine where the organisation sits in the Act's regulatory hierarchy. The DPDP Act creates three operative categories of regulated participants, and the obligations attach asymmetrically.

Data Fiduciary

Under Section 2(i), a Data Fiduciary is any person who alone or in conjunction with others determines the purpose and means of processing personal data. If the organisation collects, stores, or processes any personal data of identifiable individuals — employees, customers, website visitors, vendors, or job applicants — it is a Data Fiduciary and must comply with the full suite of obligations under the Act. There is no de minimis carve-out by size.

Significant Data Fiduciary

Section 10 empowers the Central Government to notify certain Data Fiduciaries as Significant Data Fiduciaries (SDFs) based on the volume and sensitivity of data processed, risk to electoral democracy, sovereignty and integrity of India, security of the State, and public order. SDFs face additional obligations: appointment of a Data Protection Officer (DPO) based in India who reports to the board or a designated officer, engagement of an independent data auditor, and periodic Data Protection Impact Assessments and audits.

Organisations operating at scale in fintech, healthtech, e-commerce, telecom, or social media should begin preparing for SDF designation before the notification list is published. The DPO role, in particular, cannot be filled overnight — the incumbent needs both technical depth and the seniority to escalate non-compliance internally.

Data Processor

Where the organisation processes personal data strictly on behalf of a Data Fiduciary under a valid contract, it qualifies as a Data Processor under Section 2(k). Processors are not directly obligated under most provisions, but they remain bound by the Fiduciary's contractual instructions and by the security and confidentiality obligations passed through in the underlying agreement. Reviewing and updating data processing agreements is therefore a compliance step for Processors too — particularly Indian IT and BPO service providers handling foreign-controller data who must reconcile DPDP obligations with GDPR-flowed terms.

Consent is the primary, though not exclusive, lawful basis for processing under the Act. Section 4 permits processing only for a lawful purpose, and Section 6 sets out the requirements for valid consent.

Under Section 6(1), consent must be free, specific, informed, unconditional, and unambiguous, signified through a clear affirmative action. Pre-ticked boxes, bundled consents, and consent obtained as a precondition to services unrelated to the data processing in question do not satisfy this standard. The consent notice required under Section 5 must be provided in clear and plain language and, where requested by the Data Principal, in any of the twenty-two languages listed in the Eighth Schedule to the Constitution.

In practice, this means a customer-onboarding flow that collected name, PAN, address, and contact details under a single tick-box "I agree to the Privacy Policy" is no longer defensible. Each distinct processing purpose — KYC, marketing, analytics, third-party sharing — should be presented as a granular, separately revocable choice. The draft Rules contemplate itemised disclosures covering data categories, processing purposes, retention periods, and the identity of third-party recipients; counsel should monitor the final notification closely and design notice templates that can be updated without re-papering the entire consent estate.

Section 6(7) and (9) introduce a new intermediary: the Consent Manager, a registered entity through which Data Principals can grant, manage, review, and withdraw consent across multiple Data Fiduciaries via an interoperable platform. The Data Protection Board is expected to maintain the register of accredited Consent Managers. For organisations processing data across multiple touchpoints — particularly financial services and telecom — integration with an accredited Consent Manager may become operationally necessary once the ecosystem matures.

Legitimate Uses (Section 7)

Section 7 lists categories of processing that do not require explicit consent — termed "legitimate uses" — including processing where the Data Principal has voluntarily provided data for a specified purpose, compliance with a legal obligation, response to a medical emergency, employment-related processing, and processing for certain functions of the State. Counsel should map existing processing activities to these categories carefully. Over-reliance on legitimate uses without contemporaneous documentation of how each activity fits within a Section 7 limb creates enforcement risk, since the burden of demonstrating lawful basis sits with the Fiduciary.

3. Operationalise Data Principal Rights

The Act confers a suite of enforceable rights on individuals — referred to throughout as Data Principals — and imposes corresponding obligations on Data Fiduciaries to fulfil those rights within prescribed timeframes. This is the area where most organisations currently have the widest operational gap, because rights fulfilment is a cross-functional workflow rather than a legal-team deliverable.

Right to Access and Correction (Sections 11 and 12)

Under Section 11, a Data Principal may request a summary of personal data being processed and the identities of other Data Fiduciaries and Processors with whom the data has been shared. Under Section 12, the Principal may request correction, completion, updating, or erasure of personal data. Organisations must build a grievance and request management workflow capable of receiving, authenticating, logging, and responding to these requests. The draft Rules propose defined response windows; counsel should design systems to a 30-day outer limit as a conservative benchmark and route requests through a single intake channel rather than scattered inbox addresses.

Right to Grievance Redressal and Nomination (Sections 13 and 14)

Every Data Fiduciary must establish a grievance redressal mechanism with a published contact point. Section 13 requires grievances to be addressed within a period to be prescribed. Section 14 additionally allows Data Principals to nominate another individual to exercise rights on their behalf in the event of death or incapacity — an operationally novel requirement that customer and personnel management systems will need to accommodate, including succession-style flagging at the account level.

Right to Erasure

The right to erasure under Section 12 is subject to legal retention obligations. Counsel should audit existing retention schedules against sector-specific statutory requirements — the Companies Act, 2013, the SEBI (LODR) Regulations, applicable RBI Master Directions, the Prevention of Money Laundering Act, 2002, and the Information Technology Act, 2000 — to identify which data categories can be erased on request and which must be retained despite a Principal's objection. A documented retention and erasure matrix, with the statutory basis cited for each retained field, is essential when defending a refusal before the Data Protection Board.

Organisations can begin mapping these obligations using the LegalInk compliance framework for technology companies, which cross-references DPDP 2023 obligations with sector-specific retention requirements.

4. Prepare the Core Compliance Documents

DPDP compliance is not only a process question — it requires a defined set of external-facing and internal governance documents that must be drafted, reviewed, and kept current.

Privacy Notice and Privacy Policy

The consent notice required under Section 5 is a pre-collection disclosure; the privacy policy is a broader governance document describing the organisation's data practices. Both need to be aligned to the Act. Privacy policies should now clearly describe the purpose of processing, the categories of data collected, the lawful basis being relied on, Data Principal rights and the channels to exercise them, the contact details of the DPO or grievance officer, the mechanism for withdrawing consent, and the procedure for nomination under Section 14.

The LegalInk privacy policy drafting tool provides a structured template aligned with the Section 5 and Section 6 disclosure requirements, which counsel can adapt to sector-specific needs.

Data Processing Agreements

Any organisation that engages third-party vendors, cloud providers, payment processors, or analytics platforms to process personal data on its behalf must execute a Data Processing Agreement (DPA) with each such processor. A DPDP-aligned DPA should specify the permitted scope of processing, security obligations, sub-processor restrictions and notification, breach assistance timelines, audit and inspection rights, return or deletion of data on termination, and indemnification for processor-side non-compliance. Existing vendor estates rarely meet this standard end-to-end; a contract triage — starting with high-risk processors handling sensitive data or large volumes — is a near-term priority.

Records of Processing Activities

While the Act does not use the phrase "Records of Processing Activities," the combined effect of Section 5 (purpose limitation), Section 8 (general obligations), and the audit and DPIA requirements for SDFs makes a structured data inventory essential. A processing register mapping data categories, collection sources, processing purposes, lawful basis, retention periods, and third-party disclosures forms the documentary backbone of any defensible compliance programme — and is the first document the Data Protection Board will look for in an inquiry.

5. Penalty Exposure and the Data Protection Board

The Act's enforcement architecture centres on the Data Protection Board of India (DPB) established under Chapter V. Understanding how the DPB operates and the penalty schedule is critical for in-house counsel advising boards on risk.

Data Protection Board of India

The DPB functions as an adjudicatory body rather than a conventional regulator with rule-making powers. Under Section 27, the Board may receive complaints, conduct inquiries, and issue directions. Proceedings are intended to be conducted digitally, and parties may engage legal representation. Under Section 29, the Board's orders are appealable to the Telecom Disputes Settlement and Appellate Tribunal (TDSAT).

Penalty Structure (Section 33 and the Schedule)

The Schedule to the Act prescribes the following maximum financial penalties:

  • Failure to take reasonable security safeguards under Section 8(5), resulting in a personal data breach: up to ₹250 crore.
  • Failure to notify the DPB and affected Data Principals of a breach under Section 8(6): up to ₹200 crore.
  • Non-fulfilment of obligations in relation to children's personal data under Section 9: up to ₹200 crore.
  • Failure to fulfil additional obligations as a Significant Data Fiduciary under Section 10: up to ₹150 crore.
  • Breach of any other provision of the Act or rules: up to ₹50 crore.

Penalties are not automatic. The DPB must follow a prescribed inquiry procedure and weigh the factors in Section 33(2): the nature, gravity, and duration of the breach, the type and volume of personal data affected, whether the breach was repetitive, gains realised or losses avoided, mitigation steps taken, and the proportionality of the penalty. The quantum is nonetheless significant enough that boards and audit committees will require formal DPDP risk assessments alongside existing IT and operational risk reporting.

Breach Notification Obligations

Section 8(6) requires Data Fiduciaries to notify the DPB and each affected Data Principal in the event of a personal data breach. The draft Rules are expected to prescribe the format, content, and timeline for such notification. Counsel should build the incident response protocol now — including internal escalation paths, a forensic preservation playbook, a breach assessment template scoring affected volume and sensitivity, draft notification language for both regulator and individual recipients, and a board-reporting checklist — rather than constructing one under the pressure of a live incident. The 2024 wave of credential-stuffing attacks on Indian consumer platforms is a useful stress-test scenario for tabletop exercises.

6. Children's Data and Cross-Border Transfers

Two further areas warrant specific preparation even while rule-making is in progress, because design changes here are slow and customer-facing.

Children's Data (Section 9)

Section 9 prohibits processing the personal data of children (defined as individuals under 18 years) without verifiable parental consent, and prohibits tracking, behavioural monitoring, or targeted advertising directed at children. For consumer-facing platforms, gaming operators, ed-tech providers, and healthcare apps, the parental verification requirement is both technically and operationally demanding — particularly given the absence of a national-scale parental identity infrastructure. The draft Rules contemplate that certain classes of Fiduciaries (such as healthcare providers and educational institutions) may be exempted from the targeted advertising and behavioural monitoring restrictions for limited purposes, but the consent rule itself is not relaxed. Age-gating mechanisms, school-account onboarding flows, and ed-tech progress-tracking features will all need review.

Cross-Border Data Transfers (Section 16)

Section 16 adopts a "negative list" model. The Central Government may, by notification, restrict the transfer of personal data to specified countries or territories outside India. Until any such notification is issued, cross-border transfers remain broadly permissible — subject, importantly, to sectoral restrictions under the RBI's storage-of-payment-system-data directions, the IRDAI's data localisation expectations, and similar regulator-specific mandates that continue to apply independently of the DPDP Act. Counsel should inventory existing cross-border data flows — group-company HR systems, offshore data centres, international SaaS vendors, and analytics tooling — and confirm that intra-group transfer agreements and standard contractual clauses are in place and aligned to DPDP terminology.

Why This Matters

The DPDP Act 2023 represents the most consequential shift in Indian data governance in over two decades, and the window between Presidential assent and full enforcement is narrower than many organisations have assumed. For corporate counsel, the practical imperative is to move now on the items that do not depend on the final Rules — data mapping, consent architecture, DPA refresh, grievance workflow, and breach response — while tracking rule-making for the specifications that remain outstanding. Organisations that treat DPDP compliance as a documentation exercise rather than an operational programme will find themselves exposed once the Data Protection Board becomes fully active, particularly given the Schedule's headline penalty figures and the inquiry-led adjudication model. A structured programme built on the Act's current text is both defensible and adaptable as the framework matures. Explore the compliance and drafting workflows at legalink.co.in to begin building that programme systematically.

Related posts

← Back to all posts