DPDP implementation guide
Use this checklist to prepare a review of the personal data handled by your websites, apps and business systems. It shows what to inspect and what evidence to keep; your obligations still need a review of your specific activities.
Published 2 November 2026 · Based on the notified Act and Rules linked below
India's DPDP Act, 2023 and DPDP Rules, 2025 have phased commencement. Selected institutional provisions took effect on 13 November 2025. The notified one-year tranche is scheduled for 13 November 2026, and many core processing provisions and rules are scheduled for 13 May 2027. These are different sets of provisions, so a single “DPDP deadline” can be misleading.
Selected Act provisions and Rules 1, 2 and 17–21 took effect.
Act section 6(9), section 27(1)(d) and Rule 4 are scheduled to take effect.
The notified eighteen-month tranche includes many core processing provisions and Rules 3, 5–16, 22 and 23.
Check the official Act commencement notification and DPDP Rules, 2025 before making a legal decision. Government notices and your circumstances may change what applies.
This is a working checklist, not a pass/fail certification. Agree the systems and business processes in scope first.
List the forms, apps, customer processes, databases and third-party tools in the agreed review scope. Record what data is collected, where it goes and who can access it.
Evidence to prepare: Form inventory, system list, data-flow diagram and vendor list.
Compare each collection point with its notice and the actual processing purpose. Ask a qualified legal adviser to decide which legal basis and wording apply.
Evidence to prepare: Screenshots, notice versions, form fields and purpose-to-data mapping.
Check how consent is presented, recorded and withdrawn in the workflows where it is used. Identify product changes needed to make the chosen approach work.
Evidence to prepare: User-flow screenshots, event records and withdrawal test results.
Trace how an applicable request would reach the right team, how identity would be checked, and how connected systems would be updated after a decision.
Evidence to prepare: Request intake path, ownership matrix, system update checklist and response record.
Identify access controls, logging, retention, deletion and incident-handling steps in the selected systems. Include processors and integrations that handle the same data.
Evidence to prepare: Control configuration, retention settings, incident workflow and vendor register.
For each observed gap, record evidence, the affected workflow, recommended change, owner and a way to verify completion. Separate technical work from legal decisions.
Evidence to prepare: Findings register, prioritised remediation plan and verification record.
A useful report identifies the scope, methods, systems reviewed, evidence, observed gaps, recommended actions and limitations. It should distinguish a confirmed technical observation from a legal question that needs professional advice. After changes are made, a verification record should show what was retested and what remains open.
The DPDP Act, 2023 and the 2025 Rules are the primary sources for this guide. Have a qualified Indian legal professional review interpretations and legal documents for your organisation.
Kaivan Tech can assess selected data flows and digital systems, document findings and implement agreed technical changes.
Explore DPDP assessment servicesPrivate technical consulting. No government certification or guarantee of legal compliance.
