DPDP Act Compliance Checklist 2026-27: 136 Controls

Consent is one lawful ground, not the only one. Section 4 allows processing for a lawful purpose either on consent or for certain legitimate uses, and Section 7 lists those uses in nine closed clauses (a) to (i): voluntary provision of data for a specified purpose, State benefits and services, State functions, disclosure obligations under law, judgments and orders, medical emergencies, public-health measures, disasters and breakdowns of public order, and employment. Do not treat consent as the default for every activity, and do not stretch a Section 7 use beyond its words.

Breach reporting has two steps. Rule 7(1) requires each affected Data Principal to be told without delay. Rule 7(2) requires the Board to be told without delay, and then to receive detailed information within 72 hours of the Data Fiduciary becoming aware, or within a longer period the Board allows on a written request. The 72-hour figure is real, but it is the deadline for the detailed Board report, not for the first intimation. Rule 7 commences on 13 May 2027 (Section 8(6)).

Not every Data Fiduciary needs a DPO. A Significant Data Fiduciary must appoint a Data Protection Officer based in India, responsible to its board or similar governing body (Section 10(2)(a)). Every Data Fiduciary must publish the business contact details of a DPO, if applicable, or of another person who can answer Data Principals’ questions (Section 8(9), Rule 9). Treat a DPO as mandatory only once you are notified as a Significant Data Fiduciary; elsewhere it is a design choice.

The Act does not impose blanket localisation. Section 16(1) lets the Central Government restrict transfers to countries or territories it notifies, and Rule 15 makes transfers subject to any requirements the Government specifies for making data available to a foreign State or its agencies. Section 16(2) preserves stricter sector laws, such as RBI localisation directions. A Significant Data Fiduciary may also have to keep specified personal data and its traffic data in India if the Government so specifies (Rule 13(4)).

A DPIA is not a general duty for every Data Fiduciary. The Act requires periodic Data Protection Impact Assessments and audits from Significant Data Fiduciaries (Section 10(2)(c)), and Rule 13(1) sets a cycle of once in every twelve months from notification, with a report of significant observations sent to the Board (Rule 13(2)). Elsewhere a DPIA is good practice or a contractual requirement.

GDPR Article 30 requires records of processing. The DPDP Act has no equivalent general provision. Significant Data Fiduciaries must run an annual DPIA and audit (Rule 13), and a Consent Manager must keep consent records (First Schedule, Part B, item 3), but an ordinary Data Fiduciary has no statutory ROPA duty. Many still keep one, because a data map supports notices, erasure and breach response. That is practice, not law.

The Act defines a child as an individual who has not completed eighteen years (Section 2(f)), not 13. Section 9 requires verifiable parental consent, bars tracking, behavioural monitoring and targeted advertising directed at children (Section 9(3)), and bars processing likely to harm a child’s well-being (Section 9(2)). Rule 12 and the Fourth Schedule exempt only specified classes and purposes, and only from Section 9(1) and (3).

Under Section 12(3) a Data Principal may ask for erasure, but the Data Fiduciary may keep the data if retention is necessary for the specified purpose or to comply with law. Section 8(7) separately requires erasure when consent is withdrawn or the purpose is no longer served, again unless law requires retention. Tax, financial and court-mandated retention can therefore override an erasure request. This is not the same position as under the GDPR.

The Schedule sets a maximum for each category of breach, up to Rs 250 crore for failing to take reasonable security safeguards (Section 8(5)). The Board must weigh the factors in Section 33(2), including gravity, duration, repetition and mitigation. The Act does not say that penalties multiply per affected Data Principal. These are ceilings after a Board inquiry, not fixed fines, and the penalty provisions commence on 13 May 2027.

The Board inquires into complaints and breaches, can issue directions, and can impose penalties (Sections 27, 28 and 33). The Act gives it no pre-approval or certification role, so there is no clearance step to plan around. Its Chairperson and Members are appointed by the Central Government (Section 19(2), Rule 17).

Section 5(2) deals with consent given before the Act commenced. The Data Fiduciary must give a notice as soon as reasonably practicable, and may continue processing until the Data Principal withdraws consent. That is not silent grandfathering. Whether an old omnibus or bundled consent meets the Section 6(1) standard is untested, so treat it as a risk and consider fresh consent where the original was bundled. The last point is practice, not statute.