DPDP Compliance Checklist for Indian Startups (2026)

A practical, itemized DPDP compliance checklist for Indian product companies: notice, consent, data inventory, deletion workflows, evidence, and security safeguards.

The DPDP Act, 2023 is in force and the Rules were notified on November 13, 2025. Penalty enforcement is expected from around May 2027. If you run an Indian product company, the question is no longer whether the law applies to you, it is what to actually do this quarter.

This checklist turns the Act and Rules into engineering work. It is not legal advice and it does not replace counsel. It is the operational list we would hand any founder who asks "where do we start." Each item is something a product team can build, verify, or ship.

1. Notice and purpose structure

[ ] You have a published notice that states who you are, what personal data you collect, why, and how to exercise rights
[ ] The notice is served in English and the relevant Eighth Schedule Indian languages
[ ] Notice is versioned: you can show what a user saw at any point in time
[ ] Purposes are separated, not bundled into one wall of text
[ ] You can prove which notice version a given user was shown

The notice requirement under the DPDP Act applies when consent is your basis of processing, which for most consumer products is the primary basis. Versioning matters more than people expect, because the question "what did the user consent to in March" is a reconstruction problem without it.

2. Consent collection and withdrawal

[ ] Consent is obtained through a clear affirmative action (no pre-ticked boxes)
[ ] Each purpose has its own consent option
[ ] Consent meets the Section 6 conditions: free, specific, informed, unconditional, unambiguous
[ ] Withdrawal is as easy as giving consent, and it works
[ ] Your product stops processing for a purpose when consent is withdrawn
[ ] Your backend systems are told about consent changes (webhooks, not vibes)

The withdrawal parity requirement is the one most products fail. If consent takes two taps, withdrawal that takes a support email is not parity, and it is not defensible.

3. Consent records and receipts

[ ] You store what the user saw, what they chose, and when
[ ] Receipts are immutable and survive configuration changes
[ ] You can export a consent record when challenged
[ ] Receipts do not store unnecessary personal data (they should be privacy-preserving themselves)

This is the difference between a banner and a consent system. A banner collects a choice. A consent system can reconstruct it a year later, with proof.

4. Know where personal data lives

[ ] You have an inventory of every system that stores personal data
[ ] You know which identifiers map to a person in each system
[ ] You have a data map for your databases: which tables hold personal data, what the deletion keys are
[ ] The inventory includes SaaS tools and third parties, not just your primary database

"Data lives in Postgres and also that old CRM and maybe Stripe" is not an inventory. It is the exact state that turns a deletion request into a week of archaeology.

5. Deletion and rights request workflow

[ ] There is a way for users to make deletion requests (not just a support email)
[ ] You verify the identity of the requester before acting
[ ] You have a documented fulfilment path across every system holding the data
[ ] Requests are tracked with status: received, verified, in progress, completed
[ ] You have a defined timeline and a way to stay inside it
[ ] Deletion is real: rows removed or anonymized per policy, not soft-deleted and forgotten

The right to erasure under Section 12 of the Act is the operational heart of the law. A deletion request in 2026 is a legal event with a clock on it. Treat it like one.

6. Evidence and audit trail

[ ] You can export evidence of what was done for a request
[ ] You have an activity trail: who acted, when, on what
[ ] Evidence is honest: completed, failed, or partial are recorded as such
[ ] You retain logs per Rule 6 (one year floor for systems processing personal data)

Evidence is what separates "we handled it" from "we can show we handled it." Under a regulator's inquiry, those are different conversations.

7. Security safeguards

[ ] Encryption in transit and at rest
[ ] Access controls on systems that hold personal data (RBAC, least privilege)
[ ] Secrets are managed, not committed to repos or scattered in env files
[ ] Logs for personal-data-processing systems retained at least one year
[ ] A breach runbook exists, covering both the Data Protection Board 72-hour notification and CERT-In reporting requirements

8. If you might be a Significant Data Fiduciary

[ ] You have a data inventory at the level of detail an SDF audit would need
[ ] You have a plan (or a draft) for a Data Protection Impact Assessment
[ ] You know who your Data Protection Officer would be
[ ] You track your data volumes so you know when SDF designation becomes likely

How to sequence this without a compliance team

Most startups do not have a DPO, a legal team, or a compliance budget. Sequence the work by risk:

Consent with proof (items 1-3): highest everyday risk, most fixable
Deletion workflow (items 5-6): the part with a legal clock and real engineering
Data inventory (item 4): the prerequisite for deletion done right
Security and logs (item 7): mostly good hygiene you can finish in a sprint
SDF readiness (item 8): only if volume or sector demands it now

That is the order Erasure is built in, because it is the order the risk lands. Accord covers notice and consent with versioned configuration and immutable receipts. Rights covers deletion requests with OTP verification and durable jobs. Data Maps and Systems cover inventory and fulfilment across Postgres, MySQL, HTTP, and Webhook. Evidence packages it all into exportable form.

The product docs walk through each piece, and pricing starts free with paid tiers at ₹999 and ₹9,999 per month. The DPDP timeline post has every date, and the Rules explainer goes deeper on what each Rule requires.

Start with item 1. Most of the value, and most of the risk reduction, is in the first three sections, and they are the ones you can ship fastest.

About this post

Written by the Erasure product and engineering team

Published 27 July 2026

Part of Privacy operations

This article is grounded in Erasure's product documentation and explains engineering and operational implications. Where it discusses regulation, it is not legal advice. See our editorial policy.