DPDP compliance checklist for startups

A startup does not need a privacy department to get this right. It needs sequence.

First, settle two questions once

Does the framework apply to you, and what role do you hold per data flow? Both have deterministic answers from the Act's application section and definitions. Run the applicability check and the role checker; each result traces to the exact provisions, and each takes minutes.

Second, map the data

One page is enough at startup scale: what personal data, from whom, for what purpose, in which systems, owned by whom. Every later duty consumes this map: the itemised notice, the retention timers, the breach blast radius.

Then work five clusters in dependency order

Notice and consent. The standalone plain language notice with an itemised data description, and withdrawal as easy as consent. Draft depends on the data map.

Security floor. The named safeguard minimums are mostly controls a small engineering team wants anyway: encryption, access control, logging, backups.

Breach readiness. A one page runbook naming who detects, drafts, approves and files, because the clocks start on awareness and do not scale down for headcount.

Retention timers. Design the schedule before building the timers and the forty eight hour warning; retrofitting retention is the expensive version.

Rights and grievance machinery. Published request channels, the grievance response period, and the contact who answers data questions.

Spend the runway deliberately

Rule 1(4) gives the main operational group eighteen months from publication; on the calendar that lands at 13 May 2027, a computed date treated as interpretation until confirmed. The cheapest compliance work you will ever do is the work built into systems while they are still small.

What to do

Generate the company plan with the founder lens: it holds the full picture with owners and dependencies even when several owners are the same person. The startup guide covers where the framework usually bites first.