Webbit
DPDP Act Compliance Checklist for Indian Businesses
What India's DPDP Rules mean for your business, the timeline, the penalty tiers and a practical checklist to finish well before the deadline.
If your business collects customer, employee or lead information in India, the Digital Personal Data Protection Act applies to you. The Rules that bring it to life were notified in November 2025, and most obligations switch on after an 18-month window. That points to about mid-May 2027. Reports have mentioned discussions about shortening the timeline, so check official government notices before you rely on a date.
This guide explains what the law asks for in plain language and which parts are technical. It isn't legal advice. Use it to start the conversation with your lawyer and your IT provider.
The basics
- You are a "data fiduciary" if you decide why and how personal data is processed. Most businesses are.
- You need a clear notice and valid consent for most uses of personal data, and a way for people to withdraw it.
- You may use data only for the purpose you stated, and keep it only as long as needed.
- You must protect it with reasonable security safeguards.
- If there's a breach, you must report it to the Data Protection Board of India and tell the people affected.
- People can ask to see, correct and erase their data, and you need a channel to handle complaints.
The penalties
The Act sets penalty tiers by type of failure. Failing to take reasonable security safeguards to prevent a breach sits at the top, with fines of up to ₹250 crore. Failing to notify a breach and breaches involving children's data carry lower, but still large, maximums. Commentary from several advisory firms, such as Business Today's report on the final Rules, describes the penalty structure. The amount is set by the Board according to the nature, gravity and duration of the failure, so these are ceilings, not automatic fines.
The checklist
1. Map the personal data you hold
- List every place personal data enters your business: website forms, chat, voice calls, WhatsApp, CRM, HR and finance.
- Note what you collect, why, where it's stored and who can see it.
- Mark data about children, and anything especially sensitive.
2. Notice and consent
- Write a plain-language notice that says what you collect, why and how someone can withdraw consent.
- Record consent in a way you can prove, with the date, the version and the purpose.
- Don't bundle consent. Separate unrelated purposes.
3. Security safeguards
- Use multi-factor sign-in, encryption and role-based access for systems that hold personal data.
- Log who accesses what, and review the logs.
- Patch internet-facing systems quickly, and test your backups.
- Remove access when people leave.
4. Retention and deletion
- Decide how long you keep each kind of data, and delete it on schedule.
- Make sure deletion reaches backups and suppliers, not only the main system.
5. Breach response
- Write a response plan that names who decides, who investigates and who speaks to the Board and affected people.
- The Rules set tight reporting timelines. A window of 72 hours for the detailed report to the Board is widely cited, so confirm the exact requirement with your adviser.
- Run a practice drill so people know their part.
6. Vendors and processors
- List every supplier that handles personal data for you: hosting, email, CRM, payroll, marketing and AI tools.
- Put data-protection duties into contracts, and ask suppliers about their security.
- Remember that you remain responsible for data your processors handle.
7. People's rights and complaints
- Set up a route for access, correction, erasure and grievance requests, and a named contact.
- Decide how quickly you respond, and track every request.
Where AI tools fit. Chatbots, voice agents and automations often collect names, phone numbers and requests. Treat them as part of your data map. Check where transcripts are stored, who can read them and how long they're kept.
A realistic timeline
| When | What to finish |
|---|
| Now to January 2027 | Data map, vendor list, gap review against the Rules |
| February to March 2027 | Notice and consent updates, access controls, logging |
| April 2027 | Breach response plan and a practice drill |
| Before mid-May 2027 | Final review, staff briefing, evidence file for your records |
Pair this with our small business cybersecurity checklist for the technical side, and read the 2027 trends guide to see how privacy rules fit alongside other changes. If your business uses AI agents, our guide to AI agent security covers how to limit what they can see.
An example data map (illustrative)
A small data map beats a long policy. This made-up example shows the level of detail that helps.
| Data | Where it enters | Where it lives | Who can see it | Keep for |
|---|
| Name, phone, enquiry | Website form and WhatsApp | CRM and chat tool | Sales team, two managers | Until the enquiry is closed, plus a set period |
| Call recordings and transcripts | Voice agent | Voice platform and cloud storage | Support lead | A set number of days, then deleted |
| Employee ID and bank details | HR onboarding | Payroll system | HR and finance | As required for payroll and law |
| Customer invoices | Billing | Accounting software | Finance team and accountant | As required for tax and law |
Who counts as a significant data fiduciary?
The government can designate some organisations as significant data fiduciaries, based on factors such as the volume and sensitivity of the data they handle. Those organisations face extra duties, including appointing a data protection officer and commissioning independent audits. Most small businesses won't be designated, but a firm that holds large amounts of sensitive data should ask its adviser.
Mistakes to avoid
- Copying a generic privacy policy that doesn't match what you actually collect.
- Collecting more data than the purpose needs, because it might be useful later.
- Forgetting data in chat tools, call recordings, spreadsheets and email inboxes.
- Leaving deletion to chance. If nobody owns it, it won't happen.
- Assuming a supplier's promise covers you. You remain responsible for data your processors handle.
What to keep as evidence
- Your data map and the date it was last reviewed.
- Copies of each notice and consent wording, with version dates.
- Access reviews, security tests and fix records.
- Vendor contracts and any security evidence they provided.
- Your breach plan and the record of any drill.
- A log of rights requests and how you handled them.
Get your security safeguards ready
The security part of the DPDP Rules is where Webbit can help most: reviewing access, encryption, logging and backups across your websites, cloud tools and automations, and giving you a ranked fix list. We don't replace your lawyer. We make sure the technical controls are in place so that the legal answers are true. Book a free consultation and we'll suggest where to start, or see our cybersecurity services.
Frequently asked questions
When does the DPDP Act apply to my business?
The Rules were notified in November 2025 with most duties following an 18-month phase-in, which points to around mid-May 2027. Check official government notices, because the timeline has been discussed for change.
What is the maximum penalty under the DPDP Act?
Up to ₹250 crore for failing to take reasonable security safeguards to prevent a breach. Other failures, such as not notifying a breach, carry lower maximums. The Board sets the actual amount case by case.
Does a small business have to comply?
The Act applies to any entity processing digital personal data in India, with some exemptions for certain classes of startup and for specific uses. Take advice to confirm how it applies to you.
Does this apply if we use AI chatbots or voice agents?
Yes, if they collect or process personal data. Include them in your data map, check where transcripts are stored and who can read them, and make sure consent and retention rules cover them.
Home · Blog · Book a Free Consultation