How to use the checklist
Each row is one duty, in the words of the Act or the Rules, with the section or rule it comes from and the date from which it applies. The Rules were notified as G.S.R. 846(E) in a Gazette dated 13 November 2025. Rules 1, 2 and 17 to 21 applied on publication, rule 4 applies one year after it, and rules 3 and 5 to 16 apply eighteen months after it, which is counted from 13 November 2025. When a section of the Act is in force depends on the notification that brings it into force. The full text of the Rules is summarised on the page on the DPDP Rules 2025 and the Act on the page on the DPDP Act 2023.
A row tells a business what the law says. It does not tell it whether it is covered or how to do the thing in its own case, and it is not legal advice.
Before you collect personal data: notice and consent
| Duty | Source | Applies from |
|---|---|---|
| Give a notice that can be understood on its own, in clear and plain language, with an itemised description of the personal data and the specified purposes | Section 5; rule 3 | Rule 3: eighteen months after publication of the Rules |
| Put in the notice the link to the website or app and how to withdraw consent, exercise rights and complain to the Board | Rule 3 | Eighteen months after publication |
| Obtain consent that is free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and limited to the data necessary for the specified purpose | Section 6(1) | When the section is in force |
| Offer the request for consent in clear and plain language, in English or a language of the Eighth Schedule, with the contact details of the Data Protection Officer or another authorised person | Section 6(3) | When the section is in force |
| Let the Data Principal withdraw consent at any time, with an ease comparable to that of giving it | Section 6(4); rule 3 | When the section is in force; eighteen months for rule 3 |
While you hold personal data: processors, security and breaches
| Duty | Source | Applies from |
|---|---|---|
| Remain responsible for compliance, including for processing done by a Data Processor on your behalf, whatever any agreement says | Section 8(1) | When the section is in force |
| Engage a Data Processor only under a valid contract, with provision for reasonable security safeguards | Section 8(2); rule 6(1)(f) | When the section is in force; eighteen months for rule 6 |
| Ensure completeness, accuracy and consistency of data that is used to decide something about a Data Principal or disclosed to another Data Fiduciary | Section 8(3) | When the section is in force |
| Take reasonable security safeguards: encryption, obfuscation, masking or virtual tokens, access control, logs and monitoring, backups, and retention of logs and data for one year for detecting and investigating unauthorised access | Section 8(5); rule 6 | Eighteen months after publication |
| On a personal data breach, tell each affected Data Principal without delay, and the Board without delay and again in detail within seventy-two hours | Section 8(6); rule 7 | Eighteen months after publication |
When the data is no longer needed: erasure and retention
| Duty | Source | Applies from |
|---|---|---|
| Erase personal data when consent is withdrawn or the specified purpose is no longer being served, unless law requires retention, and cause the Data Processor to erase it | Section 8(7) | When the section is in force |
| For an e-commerce entity or social media intermediary with at least two crore users, or an online gaming intermediary with at least fifty lakh users: erase after three years from the Data Principal’s last approach, with at least forty-eight hours’ warning | Rule 8; Third Schedule | Eighteen months after publication |
| Keep personal data, associated traffic data and logs of processing for a minimum of one year for the purposes in the Seventh Schedule, then erase them unless another law requires longer | Rule 8(3) | Eighteen months after publication |
Special cases: children, guardians, large platforms and transfers abroad
| Duty | Source | Applies from |
|---|---|---|
| Obtain verifiable consent of the parent before processing a child’s data, and check that the parent is an identifiable adult | Section 9(1); rule 10 | Eighteen months after publication for rule 10 |
| Do not track or behaviourally monitor children or direct targeted advertising at them, except as the Fourth Schedule allows for stated classes and purposes | Section 9(3); rule 12 | Eighteen months after publication for rule 12 |
| For a person with disability who has a lawful guardian, check that the guardian is appointed by a court, a designated authority or a local level committee | Section 9(1); rule 11 | Eighteen months after publication |
| If notified as a Significant Data Fiduciary: appoint a Data Protection Officer based in India, an independent data auditor, and carry out a Data Protection Impact Assessment and an audit every twelve months, with a report to the Board | Section 10(2); rule 13 | Eighteen months after publication for rule 13 |
| Meet any requirements the Central Government specifies for making personal data available abroad | Section 16; rule 15 | Eighteen months after publication for rule 15 |
Rights and grievances: what to publish and how fast to answer
| Duty | Source | Applies from |
|---|---|---|
| Publish the business contact information of the Data Protection Officer, or a person who can answer questions about the processing | Rule 9 | Eighteen months after publication |
| Publish the means for a Data Principal to exercise her rights and the particulars needed to identify her | Rule 14(1) | Eighteen months after publication |
| Publish a grievance redressal system and respond within a reasonable period not exceeding ninety days | Rule 14(3) | Eighteen months after publication |
| Allow a Data Principal to nominate one or more individuals to exercise her rights | Rule 14(4) | Eighteen months after publication |
What follows a failure
The Schedule to the Act sets the penalties, which the Data Protection Board imposes after an inquiry: up to Rs 250 crore for failing to take reasonable security safeguards, up to Rs 200 crore for failing to notify a breach or breaching the duties on children, up to Rs 150 crore for a Significant Data Fiduciary that breaches its additional duties, and up to Rs 50 crore for any other breach. The figures are maximums. The table of penalties is on the page on the DPDP Act 2023, and the words used in the checklist are defined in the cyber law glossary.
Frequently asked questions
Who has to comply with the DPDP Act?
The Act applies to the processing of digital personal data within India, where the data is collected in digital form or in non-digital form and digitised afterwards. It binds a Data Fiduciary, which is any person who alone or with others determines the purpose and means of processing of personal data. It does not apply to personal data processed by an individual for a personal or domestic purpose.
When do the obligations in the Rules start?
Rules 3 and 5 to 16, which hold the main duties of organisations, come into force eighteen months after publication of the Gazette dated 13 November 2025. Rule 4, on Consent Managers, comes into force one year after publication. When each section of the Act itself is in force depends on the notifications that bring it into force.
Is there a penalty for not following the checklist?
The Schedule to the Act sets penalties imposed by the Data Protection Board after an inquiry, up to Rs 250 crore for failing to take reasonable security safeguards and up to Rs 200 crore for failing to give notice of a breach or to meet the obligations on children’s data.
Is this checklist legal advice?
No. It lists the duties in the words of the Act and the Rules, with the section or rule for each. Whether a business is covered, and how to meet a duty in its own case, depends on the facts.