DPDP Act 2023: a Practical Checklist for Indian Businesses

Published by Anvexa Security Solutions.

The Digital Personal Data Protection Act, 2023 addresses digital personal data processed in India and certain overseas processing connected with offering goods or services to people in India, subject to its scope and exemptions. The Act and the notified 2025 Rules have phased commencement, so check which provisions apply before treating a duty as already enforceable.

Start with a data inventory. Record what personal data you hold, where it is stored, who can access it and why you collected it. A spreadsheet is enough. Nearly every other obligation depends on this map.

Next, review consent. Check your sign-up forms, cookie banners and privacy notices. Do they state the purpose clearly? Can a customer withdraw consent as easily as they gave it? If not, that is your first fix.

Then look at retention and third parties. Many companies keep data indefinitely because nobody set a deletion rule. Your processors, such as payment gateways, CRMs and cloud hosts, often hold your customers' data too, so check what your contracts say about security safeguards and breach notification.

Finally, document your breach-response process: who detects, who decides, who notifies the Board and affected individuals, and how quickly. Run it once as a tabletop exercise and the weak points show up fast.

Use the notified Act, Rules and commencement notifications to confirm the current position with qualified counsel. A technical assessment can support security safeguards and evidence, but it does not by itself establish compliance with every legal duty.