DPDP Act Compliance Checklist for Indian Businesses: What to Do Before May 2027

The DPDP timeline at a glance

The minimum security safeguards (Rule 6)

The Rules list the safeguards every data fiduciary must have at a minimum, covering processing done by its data processors too:

• Data security measures such as encryption, obfuscation, masking or tokenisation.
• Access control over the computer resources used to process personal data.
• Visibility: logs, monitoring and review that let you detect, investigate and remediate unauthorised access.
• Continuity: measures such as backups so processing can continue after a compromise or loss of access.
• Log retention of relevant logs and personal data for one year, unless another law requires otherwise.
• Contract clauses requiring data processors to take reasonable security safeguards.
• Technical and organisational measures that make sure the safeguards are actually followed.

What to do when there's a breach (Rule 7)

1. Tell affected individuals without delay, in plain language: what happened, likely consequences, what you're doing, what they can do, and who to contact.
2. Tell the Data Protection Board without delay with an initial description of the breach: its nature, extent, timing, location and likely impact.
3. Within 72 hours, send the Board detailed information: the facts and causes, mitigation, any findings about who caused it, remedial measures, and a report on the notifications given to individuals.

This sits alongside, not instead of, CERT-In's direction to report covered cyber security incidents within six hours. Sector regulators such as RBI, SEBI and IRDAI may add their own reporting requirements.

Extra obligations for significant data fiduciaries

If the government notifies you as a significant data fiduciary, you must also run a Data Protection Impact Assessment and an audit every 12 months, report significant observations to the Board, check that your algorithmic software doesn't put data principals' rights at risk, and follow any restrictions on transferring specified personal data outside India.

A practical 10-step readiness checklist

1. Inventory the personal data you hold, where it lives and which processors touch it.
2. Map each processing activity to a lawful basis and a specified purpose.
3. Rewrite privacy notices and consent flows in clear, itemised language.
4. Encrypt or tokenise personal data at rest and in transit.
5. Tighten access control with MFA and least privilege for systems holding personal data.
6. Centralise logging and keep logs for at least one year (and 180 days in India for CERT-In).
7. Test backups and restoration for systems holding personal data.
8. Write a breach response runbook covering the six-hour CERT-In and 72-hour Board timelines.
9. Add security and breach-notification clauses to every data processor contract.
10. Set retention periods and automate erasure when a purpose is no longer served.

Where cloud architecture helps

Most of the technical safeguards map directly onto good cloud design: key management for encryption, identity and access management, centralised logging with retention policies, and automated backups. Running in Indian regions (AWS Mumbai or Hyderabad, Azure Central or South India, Google Cloud Mumbai or Delhi) also keeps data and logs local where customers or regulators expect it. See our services for Indian businesses.

Sources

• MeitY – Digital Personal Data Protection Rules, 2025
• MeitY – Lok Sabha answer on DPDP implementation timeline (August 2026)
• DLA Piper – Data protection laws in India
• Chambers – Cybersecurity 2026: India (CERT-In reporting)