Getting ready for the DPDP Act: a working order

Most duties apply from 13 May 2027. This is the order in which most organisations find it practical to work, and what each step produces. It is a sequence, not a legal checklist; your own assessment says which steps matter most for you.

Draft awaiting review by a qualified data-protection lawyer. Not legal advice.

1. Name an owner

One person, with the authority to change how the business works, owns the programme. In a small business that is often a director; in a society, the secretary on behalf of the committee.

Produces: a named owner and a short note of who helps them (IT, HR, operations, the accountant).

2. Map the data and the roles

List the personal data you hold, whose it is, why you hold it, where it sits and who else receives it. Then mark, for each dataset, whether you decide its use (you are the Data Fiduciary) or handle it for someone else (you are a Data Processor). Everything later depends on this list.

Start with the systems you pay for, the spreadsheets people actually use, and the WhatsApp groups that carry customer details. Old data counts: archived mailboxes, retired software and former staff members’ drives.

Produces: a data inventory and a role map (DPDP Act, 2023, ss. 2 and 8(1)).

3. Fix notices and consent

Where consent is the basis, people must be told what you collect and why before or when you ask (s. 5), and consent must be specific, given by a clear action and as easy to withdraw as to give (s. 6). Check each point where data comes in: forms, apps, the front desk, the billing counter.

Not everything needs consent. Some uses are allowed without it, such as data a person gives you for a specific purpose, employment, and medical emergencies (s. 7). Marketing almost always needs its own consent.

Produces: notices at each collection point, separate consent where it is the basis, and a record of who agreed to what.

4. Put vendors under contract

You answer for what your processors do (s. 8(1)) and need a valid contract with each (s. 8(2)). From the inventory, list every vendor that touches personal data: software, hosting, payroll, couriers, messaging, agencies. Each needs written terms on purpose, security, breach notice and deletion.

Produces: a vendor register and signed data terms.

5. Secure it and plan for a breach

The Rules set a floor for reasonable security safeguards: encryption or masking where appropriate, access control, logs kept for at least a year, backups, and the same safeguards in processor contracts. Breaches are reported to each affected person and to the Board, with a detailed report within 72 hours of becoming aware. Write down who does what before you need it.

Produces: an access list per system, two-step sign-in where it matters, a breach plan with named people, and one rehearsal.

6. Answer requests and grievances

For data processed on their consent, people can ask for a summary of it and for correction, completion, updating or erasure (ss. 11 and 12). Anyone can nominate someone to act for them (s. 14) and must be able to complain to you first (s. 13). Publish how to make a request, a contact for data questions, and the period within which you answer grievances, which the Rules cap at 90 days.

Produces: a published contact and request route, and a log of requests and answers.

7. Decide how long to keep it

Erase personal data once its purpose is served, unless another law requires you to keep it (s. 8(7)). Set a period for each kind of record, matched to the tax, professional or sector rule that applies, and a routine that actually deletes, including copies in backups and old tools.

Produces: a retention schedule and a record of the last deletion run.

8. Children and guardians, where they apply

If you hold data about anyone under 18, you need verifiable consent from a parent or lawful guardian, and you must not track children, monitor their behaviour or direct targeted advertising at them (s. 9). Some institutions are exempt for specific purposes. If you do not deal with children, this step is short.

9. Keep the evidence

If challenged, you must be able to show that notice was given and consent taken (s. 6(10)), and more generally that each control works. Keep the policy, the screenshot, the signed contract and the test record against the control it supports. The evidence guide explains what is good enough.

10. Keep it current

Staff change, vendors change, apps are added and evidence goes out of date. Review access every quarter, re-check vendors yearly, rehearse the breach plan yearly, and re-run the assessment after a significant change to how you handle data.