Question · Checklist
DPDP Act compliance checklist, the honest one
By Suryansh Sagar, founder of Gevox. Last updated 3 October 2026.
A checklist asks whether things exist. The Act asks whether they do what the section requires. This list is the second kind: each item is a duty, the provision, and the test that a checklist misses. On the Readiness Index, most advisor sites passed the existence test and failed the second.
From the Gevox Readiness Index: Nineteen of twenty websites of firms that sell DPDP advice load tracking or set cookies before consent.
How to use it
Run the free scan first: it answers items 2, 3, 4, 5 and 8 for your public website in under a minute. Then work down the list in order; the first three are where the sector fails and where the largest penalties sit. Gevox generates the notice, the processor agreements, the registers and the procedures cited to the section, in each client’s own workspace.
The checklist
- 01Map the data and the purposesEvery personal data item, the purpose it serves, the ground (consent or Section 7), where it goes, how long it stays. The test: can you produce it today?Sections 4, 5, 8(7)
- 02Notice that itemisesA Rule 3 notice: data itemised, purpose specified, withdrawal, rights and Board routes given. The test: does it name what you collect, or say "information you provide"?Section 5, Rule 3
- 03Consent before anything loadsNo non-essential script fires before the choice; Reject is as easy as Accept; a record is kept. The test: watch the network tab before you click.Section 6, 6(10)
- 04Contracts with every processorEach vendor that touches personal data under a contract that carries Rule 6 safeguards, breach notice and erasure. The test: list the vendors, then list the contracts.Section 8(2), Rule 6(1)(f)
- 05Security safeguardsEncryption or masking, access control, one-year logs, backups. The test: the visible edge is the header set; the scanner reads it.Section 8(5), Rule 6
- 06A breach procedure with namesWho decides, who writes, who sends, inside seventy-two hours. The test: run it as a drill.Section 8(6), Rule 7
- 07Erasure that actually runsA period per purpose and a job that erases, including at processors. The test: pick a record past its period and check it is gone.Section 8(7), Rule 8
- 08A published contact and a working routeSection 8(9) contact on the site; a mechanism; a response period under ninety days. The test: send yourself a grievance.Sections 8(9), 8(10), 13, Rules 9, 14
- 09Rights you can answerAccess, correction, erasure, nomination, with a published route and every processor listed in the response. The test: answer a mock request in full.Sections 11 to 14, Rule 14
- 10Children, if anyAge assurance, verifiable parental consent, no tracking or targeting. The test: can a sixteen-year-old sign up unnoticed?Section 9, Rule 10
Questions people ask
- Is there an official government checklist?
- No. The Act and the Rules set the obligations; this list restates them with the test each one actually imposes.
- How long does compliance take?
- The documents take days once the data map exists. The load-order and processor fixes take a developer a day or two. The data map is the part businesses underestimate.
- Do we need a lawyer?
- The obligations are deterministic and cited. Judgment is needed on your specific processing; a CA, a lawyer or a consultant who knows your business can supply it.
Read next
The DPDP brief
One email a month. What moved in the Act, and what our scans found.
Every claim cited to its section, the same way these pages are. No product news, no roundups of other people’s blogs.