DPDP in practice
Thirty-two questions a reviewer can answer yes or no.
A checklist that repeats the Act's headings tells you nothing. Each item below is a test: a question with a yes or no answer, and the evidence you should be able to put on the table if the answer is yes.
Back to DPDP services01 · How to use it
Three rules for answering
A yes without evidence is a no for review purposes.
- Answer yes only when you can name the evidence and where it lives.
- Date every answer. A yes from last year is a question this year.
- Give every no an owner and a ticket, not a comment.
Some items test rules that start eighteen months after the Rules were published. Answer them anyway: the work has to be running before that date.
02 · Notice and consent
Notice and consent: items 1 to 8
Section 5, section 6 and rule 3.
- 1. Is there a notice for every purpose that relies on consent?. Evidence: notice register mapped to the processing record.
- 2. Does each notice list the personal data item by item?. Evidence: the notice text beside the data map rows it covers.
- 3. Does each notice make sense without reading any other document?. Evidence: the notice as shown in product, captured with date.
- 4. Can a person read the notice in English or a language in the Eighth Schedule?. Evidence: language versions and the selector in the flow.
- 5. Does the notice give the link to withdraw consent, use rights and complain to the Board?. Evidence: the three links, tested live.
- 6. Is each consent stored with time, purpose and notice version?. Evidence: a sample of consent records.
- 7. Is withdrawal as easy as giving consent, and does processing stop after it?. Evidence: a test withdrawal and the downstream stop, including processors.
- 8. Have people who consented before the Act been sent a notice?. Evidence: send log, template and coverage count.
03 · Rights
Rights and grievances: items 9 to 14
Sections 11 to 14 and rules 9 and 14.
- 9. Is the way to make a rights request published on the website or app?. Evidence: the page, with the identifier a person must give.
- 10. Can you produce a summary of a person's data and the list of recipients?. Evidence: a completed access response from a test request.
- 11. Do correction and erasure requests reach every system on the map?. Evidence: a traced request with tickets per system.
- 12. Is a grievance response period published, and is it 90 days or less?. Evidence: the published period and the request log showing it met.
- 13. Is the contact for privacy questions prominent and in every rights reply?. Evidence: website capture and three sample replies.
- 14. Can a person nominate someone to act for them?. Evidence: the nomination form and how it is verified.
04 · Processors
Processors: items 15 to 18
Section 8(1), 8(2) and rule 6(1)(f).
| Check | Yes means | Evidence to name |
|---|---|---|
| 15. Is every processor on a valid contract? | No processor handles data on terms you have not signed | Processor register with contract references |
| 16. Do contracts require reasonable security safeguards? | A clause names the safeguards or a standard | Clause text per processor |
| 17. Must processors tell you of a breach fast enough for you to report? | Their notice time leaves room for the Board's 72-hour report | Clause text and the contact route |
| 18. Must processors erase on your instruction and confirm it? | Erasure and confirmation are contractual duties | Clause text and one past confirmation |
05 · Safeguards and breach
Safeguards and breach: items 19 to 26
Section 8(5), 8(6) and rules 6 and 7.
- 19. Is personal data encrypted, masked or tokenised where stored and sent?. Evidence: configuration exports for the main data stores.
- 20. Is access to systems holding personal data granted by role and reviewed?. Evidence: the last access review with removals.
- 21. Are access logs kept for at least one year and reviewed?. Evidence: retention settings and a review record.
- 22. Can processing continue after loss of data, from backups?. Evidence: the last restore test.
- 23. Is there a written breach procedure with named roles?. Evidence: the procedure, approved and dated.
- 24. Are templates ready for both the Board and affected people?. Evidence: the two templates, matching rule 7's content.
- 25. Has the procedure been exercised in the last year?. Evidence: exercise record with lessons and actions.
- 26. Is every suspected breach logged, even when not reported?. Evidence: the incident log with the reporting decision.
06 · Retention and governance
Retention and governance: items 27 to 32
Section 8(7), 8(10), section 10 and rule 8.
| Check | Yes means | Evidence to name |
|---|---|---|
| 27. Is there a retention period for each purpose? | No data set is kept without a stated end | Retention schedule |
| 28. Does erasure actually run, in systems and at processors? | Jobs or tasks execute and leave a record | Erasure logs and processor confirmations |
| 29. Are legal holds recorded with the law that requires them? | Data kept beyond purpose cites a specific duty | Hold register |
| 30. Is there a named owner for the privacy programme with authority? | One person answers for it to leadership | Appointment note and RACI |
| 31. Has the significant data fiduciary question been assessed? | A dated view, revisited when notifications issue | Assessment memo |
| 32. Do leadership review privacy metrics on a schedule? | Requests, breaches and erasures are reported | Minutes or reports |
07 · Reading the result
What the answers tell you
Look at which items fail, not only how many.
Fix first
Items 7, 11, 17, 21, 24 and 28. Each one is a duty that fails silently: nobody notices until a person complains or a breach happens.
Fix next
Items about wording and publication, such as 2, 4, 9 and 13. They are visible and quick, and they matter, but they rarely hide a running failure.
Security safeguards and breach notice carry the Act's highest penalty ceilings, so items 19 to 26 deserve attention even when the count looks good.
Sources: the Digital Personal Data Protection Act, 2023 (sections 5, 6, 8, 10 to 14, and the Schedule); the Digital Personal Data Protection Rules, 2025, G.S.R. 846(E), rules 3, 6 to 9 and 14.
Questions about the checklist
Does passing every item mean we comply with the Act?
No. It means you can show evidence for the core duties.
The list covers duties most businesses share. Your sector, children's data, cross-border transfers or a significant data fiduciary notice can add more. Treat a full set of yeses as a strong position, not a verdict.
Who should answer the questions?
The owner of each area, with someone else checking.
Have the owner answer and a second person look at the evidence. A self-marked checklist tends to read better than the systems behind it.
How often should we run it?
At least yearly, and after big changes.
Run it on a set cycle and after a new product, a new major vendor, an incident, or a change in the Rules or notifications.
Can we use it for vendors?
Parts of it, for vendors who process your data.
Items 16 to 22 and 28 translate well into vendor questions. The notice and consent items are yours, not your processor's.
Get the checklist answered with evidence.
A DPDP readiness assessment tests each item against your systems and records. Counsel should confirm how the Act and the Rules apply to your contracts and sector.