The Clock Is Ticking
The Digital Personal Data Protection Act 2023 is in full enforcement as of January 2026. The Data Protection Board has already issued compliance notices, and penalties can reach ₹250 crore for significant violations.
₹250 CrMaximum penalty for significant data breach (DPDP Act, Section 33)
₹50 CrMaximum penalty for failure to notify breach (DPDP Act, Section 33)
₹10,000Penalty per individual for frivolous complaints (DPDP Act, Section 33)
6 hrsCERT-In breach notification deadline (CERT-In Direction 2022)
DANGER
"We're too small to be noticed" is the most dangerous assumption a business can make. The Data Protection Board has begun with mid-market companies precisely because they handle significant data with weaker controls.
Your 25-Point DPDP Compliance Checklist
Part A: Consent Management (5 items)
graph TD
A[User Visits Your Site] --> B{Collecting
Personal Data?} B -->|Yes| C[Show Clear
Consent Notice] C --> D[Get Explicit
Opt-In Consent] D --> E[Log Consent
with Timestamp] E --> F[Allow Easy
Withdrawal] B -->|No| G[No Action
Required] style C fill:#1e3a5f,stroke:#F97316,color:#e2e8f0 style D fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0 style E fill:#1e5f3a,stroke:#10B981,color:#e2e8f0
Personal Data?} B -->|Yes| C[Show Clear
Consent Notice] C --> D[Get Explicit
Opt-In Consent] D --> E[Log Consent
with Timestamp] E --> F[Allow Easy
Withdrawal] B -->|No| G[No Action
Required] style C fill:#1e3a5f,stroke:#F97316,color:#e2e8f0 style D fill:#1e3a5f,stroke:#3B82F6,color:#e2e8f0 style E fill:#1e5f3a,stroke:#10B981,color:#e2e8f0
| # | Requirement | Status | Priority |
|---|---|---|---|
| 1 | Consent notice in clear, plain language (not legal jargon) | ☐ | Critical |
| 2 | Separate consent for each purpose of data collection | ☐ | Critical |
| 3 | No pre-ticked consent boxes or bundled consent | ☐ | High |
| 4 | Consent withdrawal mechanism as easy as giving consent | ☐ | High |
| 5 | Consent records stored with timestamps and IP addresses | ☐ | High |
Part B: Data Processing (5 items)
| # | Requirement | Status | Priority |
|---|---|---|---|
| 6 | Data used only for the stated purpose (purpose limitation) | ☐ | Critical |
| 7 | Data minimization — collect only what you need | ☐ | High |
| 8 | Accurate and up-to-date data maintained | ☐ | Medium |
| 9 | Third-party data processors have written agreements | ☐ | High |
| 10 | Cross-border data transfers only to non-restricted countries | ☐ | High |
Part C: Security Safeguards (5 items)
| # | Requirement | Status | Priority |
|---|---|---|---|
| 11 | Encryption at rest and in transit for personal data | ☐ | Critical |
| 12 | Access controls — role-based, principle of least privilege | ☐ | Critical |
| 13 | Regular VAPT scans on all data-handling systems | ☐ | Critical |
| 14 | Security incident logging and monitoring | ☐ | High |
| 15 | Employee security awareness training | ☐ | Medium |
TIP
Item 13 is where Bachao.AI can help directly. A VAPT scan documents your security posture and produces evidence that you've implemented "reasonable security safeguards" as required by the Act. Book a free scan to get started.
Part D: Data Subject Rights (5 items)
| # | Requirement | Status | Priority |
|---|---|---|---|
| 16 | Right to access — users can request their data | ☐ | High |
| 17 | Right to correction — users can fix inaccurate data | ☐ | High |
| 18 | Right to erasure — users can request data deletion | ☐ | Critical |
| 19 | Grievance redressal mechanism with officer contact | ☐ | High |
| 20 | Respond to requests within 30 days | ☐ | High |
Part E: Organizational Measures (5 items)
| # | Requirement | Status | Priority |
|---|---|---|---|
| 21 | Appoint a Data Protection Officer (if Significant Data Fiduciary) | ☐ | High |
| 22 | Maintain a record of processing activities | ☐ | Medium |
| 23 | Breach notification process documented and tested | ☐ | Critical |
| 24 | Privacy policy published and accessible | ☐ | Critical |
| 25 | Annual compliance review process established | ☐ | Medium |
Penalty Structure Explained
The DPDP Act has a tiered penalty structure:
| Violation | Maximum Penalty | Who Decides |
|---|---|---|
| Failure to take reasonable security safeguards | ₹250 Cr | Data Protection Board |
| Failure to notify Board of data breach | ₹200 Cr | Data Protection Board |
| Non-compliance with obligations regarding children's data | ₹200 Cr | Data Protection Board |
| Failure to comply with Board directions | ₹50 Cr | Data Protection Board |
| Breach of other provisions | ₹50 Cr | Data Protection Board |
| Repeated offences | Higher penalties | Data Protection Board |
WARNING
These are maximum penalties. The Board considers factors like the nature of the violation, the number of affected individuals, and whether the organisation took steps to mitigate damage. Having a recent VAPT report significantly demonstrates good faith.
Know your vulnerabilities before attackers do
Run a free VAPT scan — takes 5 minutes, no signup required.
Book Your Free ScanStep-by-Step Implementation Timeline
Week 1-2Audit all personal data you collect, store, and process
Week 3-4Update consent mechanisms and privacy policies
Week 5-6Implement technical security safeguards (encryption, access controls)
Week 7-8Run VAPT scan and fix identified vulnerabilities
Week 9-10Set up data subject rights workflows
Week 11-12Document processes, train team, establish review cadence
Common Mistakes Indian Businesses Make
- Using Google Forms for sensitive data — No encryption, no access controls, no audit trail
- Sharing customer data on WhatsApp — Violates purpose limitation and security requirements
- No consent records — "We have a checkbox" isn't enough; you need timestamped logs
- Relying on hosting provider security — AWS/Azure security doesn't cover application-level vulnerabilities
- No breach response plan — The 6-hour CERT-In deadline means you need a pre-planned process
Key Takeaway
DPDP compliance is not a one-time project. Build it into your operations — quarterly VAPT scans, annual policy reviews, and ongoing consent management. Start with the Critical items in the checklist above and work your way down.
Get Compliant Faster
Your first step should be understanding your current security posture. A VAPT scan identifies the technical gaps that regulators will look for.
INFO
Start with a free VAPT scan. Visit bachao.ai, enter your domain, and get a risk score in minutes. The report maps findings to DPDP Act requirements, so you know exactly what to fix.
Written by Shouvik Mukherjee, Founder of Bachao.AI. Follow me on LinkedIn for DPDP compliance updates and cybersecurity insights.
