DPDP Act 2023: compliance guide and checklist

Key terms

The Act defines a small set of roles you need to know:

• Data Principal: the individual whose personal data is processed.
• Data Fiduciary: the organisation that decides why and how data is processed.
• Data Processor: a party that processes data on a fiduciary's behalf.
• Significant Data Fiduciary: a fiduciary handling higher-volume or higher-risk data, with extra duties such as a Data Protection Officer, data protection impact assessments, and audits.

Core obligations

At a minimum, a data fiduciary must:

• Obtain valid, informed consent and give clear notice of purpose.
• Limit use to the stated purpose and retain data only as needed.
• Implement reasonable security safeguards to protect personal data.
• Enable data principal rights: access, correction, erasure, and grievance redressal.
• Report personal data breaches as required, and support the Data Protection Board.

A practical starting checklist

Turning the Act into action usually starts with knowing what data you hold and where it is exposed:

• Map the personal data you collect, where it lives, and who it is shared with.
• Fix consent and notice flows so they are clear and specific.
• Assess and reduce your external exposure, since a breach is both a security and a DPDP event.
• Extend the same scrutiny to vendors that process data on your behalf.
• Keep evidence of controls and incidents so you can demonstrate compliance.

Frequently asked questions