Businesses & Professionals
DPDP Compliance Operations
The practical, how-to layer of DPDP compliance — the guides HR, founders and tech leads use to put the Act into practice: breach response, DPIAs, consent records, retention, vendor contracts and the day-to-day operations of staying compliant.
DPDP compliance checklist 2026: steps every Indian business must take nowA practical DPDP compliance checklist for Indian businesses — notice, consent, minimisation, security, retention, rights and grievance handling. What to put in place now.Does your startup need a mandatory Data Protection Officer (DPO)?A statutory DPO is mandatory only for Significant Data Fiduciaries under India's DPDP Act — not every startup. What you do need instead: a published contact and grievance route.Building a DPDP-compliant breach response plan (the 72-hour rule in practice)A personal data breach starts a clock under India's DPDP Act — intimate the Board immediately, a detailed report within 72 hours, notify affected people. How to build the plan.A guide to third-party Data Processor Agreements (DPAs) for Indian agenciesUnder India's DPDP Act you can engage a processor only under a valid contract. What a Data Processor Agreement must cover — for agencies, SaaS and vendors — in plain English.How to run a Data Protection Impact Assessment (DPIA) without expensive lawyersA DPIA is mandatory for Significant Data Fiduciaries and smart practice for others. How to run one yourself under India's DPDP Act — a practical, plain-English walkthrough.What records must a business keep to prove consent under DPDP?Under India's DPDP Act the burden of proving valid consent is on you. What records to keep — notice shown, purpose, the opt-in, timing, withdrawals — so you can demonstrate it.Secure client document collection for professionals: email vs secure portalsCAs, lawyers, brokers and consultants collect sensitive client documents daily. Why email and chat fall short under DPDP, and what secure collection looks like at onboarding.The 1-year rule: configuring log retention under DPDP (for tech leads)India's DPDP Rules require keeping processing logs for at least a year to detect unauthorised access. What the 1-year rule covers, how it differs from data erasure, and how to set it up.Privacy-by-design checklist for freelance developersBuilding an app for a client? A privacy-by-design checklist that bakes DPDP into the build — minimise, consent, secure, log, and delete — before the data starts flowing.How to encrypt customer lists in Excel to reduce your breach riskThat unprotected customer spreadsheet is a breach waiting to happen. How to encrypt an Excel customer list — and the wider habits that keep it from becoming a DPDP liability.The 48-hour pre-deletion notice: which platforms must warn users before wiping dataThe DPDP 48-hour pre-deletion notice and 3-year erasure apply only to large e-commerce, social media and gaming platforms — not every app. Who's in scope, and what it requires.The Grievance Redressal Officer requirement: what every app's help section must haveUnder India's DPDP Act every business handling personal data must publish a contact and offer a grievance-redressal route, with a response window. What you must have, explained.You already have a customer database — do you need fresh consent under DPDP?Do you have to re-take consent for customer data you collected before the DPDP Act? Usually no — but you must send a one-time notice. What the transition rule actually requires.Can you put customer data into ChatGPT and other AI tools under DPDP?Pasting customer data into ChatGPT is a use of that data. Under India's DPDP Act you need a lawful basis, purpose limits, and to treat the AI provider as a third party. Explained.