DPDP readiness checklist

Use this as a starting list. Tick an item only when you can show evidence for it.

1. Know your data

• Inventory of personal data, systems, owners and purposes.
• Lawful ground recorded for each activity (consent or a specific legitimate use).

2. Notice and consent

• Itemised notice at each collection point, in plain language.
• Unticked, purpose-specific consent boxes where consent is the ground.
• Consent records: who, when, how, for what, which notice version.
• Withdrawal as easy as giving consent.

3. Rights and grievances

• Intake, identity verification and response process for access, correction, erasure and nomination.
• Published grievance and data-protection contact with response commitments.

4. Retention and erasure

• Retention schedule with legal holds identified.
• Process to erase (and cause processors to erase) when the purpose is served or consent is withdrawn.

5. Security and breaches

• Access control, encryption, logging, backups.
• Written breach plan, roles, notification approval path, rehearsal.

6. Vendors

• Register of processors and contracts covering security and deletion.

7. Special cases

• Children: age check, verifiable parental consent, no tracking or targeted ads.
• Cross-border flows mapped.
• Significant Data Fiduciary duties if notified.