DPDP compliance checklist: 12 steps to get ready

The checklist

Work through these in order. Most organisations need three to six months.

• Map your personal data: what you collect, from whom, why, where it is stored and who receives it.
• Assign a legal basis to every processing activity: consent or a specific legitimate use.
• Rewrite your notices: itemised data and purposes, in plain language, in English and the languages your users speak.
• Capture consent purpose by purpose, with no pre-ticked boxes, and keep a tamper-evident record.
• Make withdrawal one step, and make sure it reaches your processors.
• Set up rights handling: access, correction, completion, update, erasure and nomination, on a clock.
• Publish a contact for data questions and run a grievance process with defined response times.
• Sign data processing contracts with every processor and review their safeguards.
• Prepare your breach response: who decides, how the Board is told within 72 hours, how people are informed.
• Handle children's data: age signals, verifiable parental consent, and no tracking or targeted ads.
• Set retention periods and automate erasure, with 48-hour notice where the Rules require it.
• Keep evidence of every step, so you can demonstrate compliance on request.

Doing it with software

Spreadsheets break down once requests, consents and deadlines pile up. ConsentLo runs each item on this list as a workflow with its statutory clock, and records every action in an evidence vault you can export for an audit.