DPDP compliance checklist for startups

A startup can organise this work as a sequence before deciding where specialist support is needed.

Generate your company plan to turn the sequence into an organisation level action list with owners, dependencies and official sources.

First, settle scope and role for each data flow

Test whether each processing activity is inside the Act's application section. Then ask whether your startup determines the purpose and means of the processing, the Data Fiduciary test in section 2(i), or processes personal data on behalf of another Data Fiduciary, the Data Processor test in section 2(k). Does the DPDP Act apply to startups works the application question through in full. Run the applicability check and the role checker; each result traces its conclusion to the provisions and can return a legal review outcome when the facts do not support a firm answer.

Second, map the data

Start with 1 working page: what personal data, from whom, for what purpose, in which systems, processed by which vendors and owned by whom. This site's recommended sequence uses that map to draft the notice, choose safeguards, plan breach response and decide erasure and retention.

Then work 5 clusters in dependency order

The provisions in these 5 clusters are not yet in force on 26 October 2026. G.S.R. 843(E) places the cited Act provisions in an 18 month group, and Rule 1(4), as corrected by G.S.R. 892(E), places Rules 3 and 5 to 16 in the corresponding Rules group. This site computes both groups to 13 May 2027, interpretation until officially confirmed. The order below is practical preparation advice, not an order prescribed by the Act.

1. Notice and consent

Prepare the notice required by section 5 and Rule 3, including the itemised personal data and specified purpose. Design withdrawal so its ease is comparable to giving consent, as section 6(4) requires.

2. Security safeguards

Map the minimums in Rule 6 to your systems and processors. The list includes appropriate data security measures such as encryption or similar measures; appropriate access control wherever applicable; appropriate logs, monitoring and review; reasonable continuity measures such as backups; appropriate processor contract terms wherever applicable; and appropriate technical and organisational measures.

3. Breach readiness

Prepare a runbook for the section 8(6) and Rule 7 intimations, with owners for detection, assessment, communication and filing. Rule 7 starts both routes when the Data Fiduciary becomes aware of a personal data breach and states no smaller company threshold. A section 17 exemption can change whether section 8(6) applies, so check scope before treating the workflow as a legal duty.

4. Erasure and retention

Start with the section 8(7) trigger, withdrawal of consent or the specified purpose no longer being served, unless retention is necessary for compliance with law.

The fixed 3 year periods in Rule 8(1) apply only to the classes, purposes and registered user thresholds in the Third Schedule; they are not universal startup deadlines.

This site reads the 48 hour warning in Rule 8(2) as following those fixed periods, but Rule 8(3) also ends in erasure, so the text leaves a wider reading open.

Rule 8(3) separately states a minimum 1 year retention period for personal data, associated traffic data and processing logs for the purposes in the Seventh Schedule. This site reads its reference to a Data Fiduciary as carrying no size threshold, but the text does not resolve in terms how that floor applies where a startup's processing serves none of the Seventh Schedule purposes. Both readings are interpretation.

5. Rights and grievance machinery

Prepare the request channels for section 11, section 12, section 13 and section 14, publish the Rule 9 contact who can answer Data Principal questions, and publish the rights and grievance details required by Rule 14.

Diagram headed Startup DPDP checklist: duties are not in force. It shows 3 preparation steps: test scope and role; map data and purposes; and prepare 5 control clusters of notice, safeguards, breach, retention and rights. The status panel reads 28 October 2026 and says the duties shown are not in force. Their computed date is 13 May 2027, interpretation until officially confirmed.

Open the startup checklist diagram at full size.

Spend the runway deliberately

G.S.R. 843(E) gives the principal Act group 18 months from Gazette publication. Rule 1(4), with its closing words corrected by G.S.R. 892(E), gives the principal Rules group the same period. This site computes both dates as 13 May 2027, interpretation until officially confirmed. Use the period to prepare and test controls before the provisions commence.

What to do

Generate the company plan with the founder lens: it holds the full picture with owners and dependencies even when several owners are the same person. The startup guide covers where the framework usually bites first.

If your business is small but does not build software, the 10 step small business checklist sets out the duties as a printable list with the provision behind each step. If you lead engineering, the CTO checklist breaks out the slice your team usually builds.