DPDP Act compliance review — know what your business does with personal data before anyone asks

Why review now

For most Indian businesses, personal data grew by accident. A customer list started in a notebook moved to a spreadsheet, then to a CRM; a WhatsApp group became the main channel for client documents; a marketing agency added a few tracking tags; a payroll vendor was engaged by email. Nobody decided, at any point, how the business as a whole should handle personal data. The Digital Personal Data Protection Act, 2023 now requires that decision to be made and written down.

The law itself — what it requires of a data fiduciary, the rights of individuals, the penalties — is set out in our DPDP privacy policy guide. This page is about the practical exercise that turns the law into a business’s own to-do list: the compliance review. Its value is that it replaces guesswork with facts. Before the review, the owner believes the data is “safe with us”; after it, the owner knows which systems hold it, which people and vendors can see it, what was promised to customers, and what must change first.

There are three good reasons to do it now rather than later. The main obligations have a fixed start date, and fixing systems takes months, not days. Larger clients, hospitals, banks and foreign customers are already asking their suppliers for evidence of compliance. And businesses that raise funds or sell themselves find that investors now ask about personal data in due diligence.

The timeline under the rules

The Act was passed in August 2023, and the Digital Personal Data Protection Rules were notified in November 2025. The rules did not take effect all at once. As notified, they provide broadly for three stages:

Businesses should check the notified text for the precise date on which each provision takes effect, and watch for amendments and clarifications. The practical lesson is simple: the months before the main obligations begin are the time for the review and the remediation, because after that date the Board can act on complaints and breaches.

Who needs a review

The Act applies to processing of digital personal data in India, and to processing outside India connected with offering goods or services to people in India, as our guide on whether the Act applies explains. There is no turnover or headcount threshold for ordinary data fiduciaries. In practice, a review is most urgent for businesses that:

• hold sensitive categories of data — health, financial, children’s, identity documents, location;
• hold data about many people — e-commerce, education, telecom, platforms, housing societies, large employers;
• share data with many vendors, partners or group companies;
• use data for marketing, profiling or AI;
• supply larger clients who ask for data protection terms;
• have had a past incident, a complaint or a data leak; or
• are preparing for investment, acquisition or listing.

Even a small professional office — a CA firm, a law office, a clinic, a coaching centre — benefits from a short review, because the fixes it identifies are usually simple and cheap if found early.

What a good review produces

A review should leave the business with things it can use, not only an opinion. At minimum:

• a data inventory that the business owns and can keep updated;
• a gap register: each finding, the obligation it relates to, the evidence, the risk score and the recommended fix;
• a written report summarising the position for the owner or board in plain language;
• a 30-60-90 day action plan with owners and dates;
• a vendor register showing which vendors process personal data and whether their contracts are adequate;
• draft procedures for the most important processes: breach response, rights requests, retention; and
• a list of documents to prepare or revise: notices, consent wording, contracts, internal policies.

The report should say plainly what was not reviewed, and why, so nobody later mistakes a partial review for a complete one.

The review, step by step

Most of the useful information comes from conversations with the people who do the work, not from policies. The receptionist who scans identity documents, the marketing executive who exports leads to a new tool, and the accountant who emails salary files know where the data goes.

Preparing for the review

A review goes faster, and costs less time for everyone, when the business gathers a few things in advance. None of them needs to be perfect; the point is to show the reviewer what exists.

The business should not send bulk copies of customer data to the reviewer. Screenshots, field lists and a handful of redacted samples are enough to understand how data is held, and avoid creating a new copy that itself needs protecting.

Setting the scope

A review that tries to cover everything at once usually covers nothing well. Scoping decides:

• Which legal entities: a single company, or a group with related firms and trusts.
• Which activities: customer-facing services, the website and apps, marketing, HR, vendors, physical records that are later digitised.
• Which people’s data: customers, patients, students, parents, employees, applicants, vendors’ staff, website visitors.
• Which systems: software, cloud storage, email, messaging apps, spreadsheets, laptops and phones.
• Which locations: offices, branches, remote staff, data stored or accessed abroad.

Where a business is large, the first review can focus on the highest-risk activities — usually the core customer database, the website and apps, and the vendors that hold the most data — with other areas in a second phase. The scope note should also name one person inside the business who coordinates the review and can open doors.

Building the data inventory

The inventory is the heart of the review. It records each processing activity — a distinct use of personal data — in a consistent form. A practical template:

A small business may have fifteen to forty activities; a larger one, hundreds. The inventory need not be perfect on day one, but it must be honest and kept up to date, because every other step depends on it. It also makes it possible to answer an individual who asks for a summary of the personal data held about them and the processing activities it is used for, which the Act allows them to request.

Purpose and legal basis for each use

For each activity in the inventory, the review asks two questions: what is the specific purpose, and what is the basis for processing? Under the Act, processing is lawful either with consent or for one of the legitimate uses the Act lists — for example, where an individual voluntarily provides data for a specified purpose and has not objected, for employment purposes, or to comply with law. Those bases are explained in our guide on legitimate uses.

Common findings at this stage are uses with no clear purpose (“we keep everything in case it is useful”), purposes that grew beyond what customers were told (booking data now used for marketing), and consent relied on where the business could not actually honour a withdrawal. Each such finding goes into the gap register with a recommended basis and any change needed to notices or systems.

Collecting less

The simplest way to reduce risk is to hold less. A review should look at every form, every document request and every export, and ask whether each field is needed for the stated purpose. Typical quick wins are removing date of birth from enquiry forms, masking all but the last digits of identity numbers, not storing copies of identity documents once verification is done, not exporting full customer lists to marketing tools, and deleting old files from shared drives and messaging groups.

Collecting less is also cheaper: fewer fields to secure, fewer records to delete later, fewer answers to give when someone asks what is held about them. The review report should list each field recommended for removal, with the reason.

Testing notices

A notice is only compliant if it matches what the business actually does and reaches people at the right moment. The review tests this in practice rather than by reading the privacy policy alone:

• fill in each form on the website and app, and check whether a notice appears before or with the request for consent;
• compare the notice with the inventory — every category of data, purpose and recipient should appear;
• check that the notice explains how to withdraw consent and how to complain, including to the Board;
• check that the notice is available in English and, where the business’s customers read another language listed in the Constitution, in that language;
• check phone and in-person collection — a clinic reception or a sales call also collects data and needs a way to give notice; and
• check older customers: data collected before the Act applies, for whom the rules require notice as soon as reasonably practicable.

The content of a good notice is set out in our guide on the notice; where it should appear on a website is covered in our website legal pack guide.

Testing consent and withdrawal

Consent under the Act must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action, and as easy to withdraw as to give; the requirements are explained in our consent guide and our note on withdrawal. The review tests the reality:

• Are tick boxes unticked by default, and separate for separate purposes, such as marketing?
• Is consent recorded — who, when, which version of the notice, for what?
• Can a customer withdraw from the same channel, as easily as they gave consent?
• When consent is withdrawn, does processing actually stop — in the CRM, the email tool, the SMS provider and the advertising platforms?
• Is any service made conditional on consent to things the service does not need?

A practical test is to sign up with a test identity, withdraw consent, and see whether messages stop. Businesses are often surprised to find that an unsubscribe removes a customer from one tool but not from the others to which the list was copied. The review should also note whether consent records could be shared with a registered consent manager if the business chooses to use one.

Children’s data

The Act treats anyone under eighteen as a child, requires verifiable consent of a parent or lawful guardian before processing a child’s data, and prohibits tracking, behavioural monitoring and targeted advertising directed at children, subject to exemptions in the rules for particular kinds of processing such as by educational institutions and health services in defined circumstances. The details are in our guide on children.

The review asks where children’s data might enter the business, including by accident: a coaching centre’s students, a clinic’s young patients, a game’s players, a toy shop’s loyalty programme. For each, it checks how age is established, how parental consent is obtained and verified, whether any exemption genuinely applies, and whether analytics or advertising tools run on pages children use. This is frequently the area with the largest gap between practice and law.

Paper files, phones and messaging groups

The Act applies to digital personal data, including data collected on paper and later digitised. In practice, the review cannot ignore paper files, because they are usually scanned, photographed or typed into systems at some point, and because the same staff handle both.

Messaging apps are the hidden database of many Indian businesses. Client documents are sent by customers on WhatsApp, forwarded between staff, saved to phone galleries and backed up to personal cloud accounts. The review should find out which groups and numbers are used for work, what is shared in them, who is in them — including former staff — and where the phones back up. Usual fixes are a business account for customer communication, a rule that documents are moved into the proper system and deleted from phones, removal of former staff from groups, and turning off personal cloud backup of work chats. Paper files need locked storage, a record of who takes them out, and proper shredding.

Security safeguards

The Act requires reasonable security safeguards to prevent personal data breaches, and the rules describe the kinds of measures expected, including encryption, masking or tokenisation where appropriate, access control, logging and monitoring, backups and contractual safeguards with processors. The review does not need to be a full technical audit, but it should check the basics with evidence:

Where the business holds a security certification or has a recent penetration test, those are good evidence. Where it has neither, the review identifies the few controls that give the most protection for the least cost.

Access and people

Most data incidents in small and mid-sized Indian businesses involve people rather than hackers: a shared password, a customer list forwarded to a personal email, a former employee who still has access, a phone with client documents lost in an auto-rickshaw. The review therefore looks at:

• who has access to each system, and whether that matches their role;
• whether staff use personal phones or messaging apps for customer data, and on what terms;
• confidentiality obligations in employment contracts and non-disclosure agreements for contractors;
• what happens on joining and leaving — accounts created, accounts removed, devices returned; and
• whether anyone is clearly responsible for data protection decisions.

The fixes are often organisational: a written rule on use of personal devices, an exit checklist, and removing shared logins. Our HR policy guide shows how these rules fit into the staff handbook.

Vendors and processors

The review builds a vendor register from the inventory: every outside party that receives personal data, what it receives, its role, where it stores the data, and whether the contract is adequate. The Act permits a data fiduciary to engage a processor only under a valid contract and keeps the fiduciary responsible for the processor’s processing, as explained in our data processing agreement guide.

For each significant vendor, the review checks the contract against the points in that guide’s addendum checklist, notes gaps, and recommends either a new agreement, an amendment, or — where a global vendor will not negotiate — compensating steps. It also identifies vendors that act as independent fiduciaries, such as payment gateways and couriers, whose role should be reflected in the notice rather than in a processing contract.

Breach readiness — the drill

The Act requires a data fiduciary to intimate a personal data breach to the Board and to each affected person, and the rules set out the content and a fixed period for the detailed report to the Board; many cyber incidents must also be reported to CERT-In within a few hours. These duties are explained in our breach guide. A business cannot meet those timelines by improvising.

The most revealing part of a review is often a short tabletop exercise. The reviewer describes a realistic scenario — a receptionist’s laptop with patient files is stolen on Friday evening; a vendor reports that a database was exposed; a customer says their details appeared in a WhatsApp group — and the team talks through what they would do, hour by hour:

1. Who would hear about it first, and whom would they tell?
2. Who decides whether it is a personal data breach?
3. How would the business find out which data and which people were affected?
4. Who contacts the vendor, and what does the contract require of them?
5. Who drafts the intimation to the Board and to affected people, and from what template?
6. Who reports to CERT-In if required, and within what time?
7. Who talks to customers and the press?
8. How is the incident recorded, and what is changed afterwards?

Gaps revealed by the drill go straight into the action plan, usually as a one-page breach procedure, a contact list, templates, and changes to vendor contracts.

Requests from individuals — the test

Individuals have rights to a summary of their personal data and its processing, to correction, completion, updating and erasure, to grievance redressal and to nominate someone to act for them, as set out in our rights guide. The review tests whether the business can actually respond:

• Is there a published way to make a request, and does it reach a person who acts on it?
• Can the business find all the data about one person across its systems and vendors, using the inventory?
• How is identity confirmed, without asking for more data than necessary?
• Can a record be corrected or erased everywhere, including in backups and at vendors?
• Is there a log of requests, with dates, so that response times can be shown?
• Does the grievance mechanism respond within the period set by the rules?

A useful practical test is a “mystery request”: with the business’s agreement, a test request is sent through the published channel, and the reviewer observes what happens. The result usually shows in a day what a policy never would. The fix is a short procedure, a request log and, for businesses with many customers, a simple self-service page.

Retention and deletion

The Act requires erasure once the purpose is no longer served or consent is withdrawn, unless the law requires the data to be kept, and requires the fiduciary to cause its processors to erase too; our guide on retention explains the rule. The rules also set specific periods for certain large classes of platforms, and a minimum period for keeping logs.

In a review, retention is usually the largest gap, because almost no Indian small business deletes anything. The deliverable is a retention schedule: for each category in the inventory, how long it is kept, what event starts the period, what law requires retention (tax, company law, labour law, medical records rules, professional rules), and how deletion happens in each system and at each vendor. The plan then sets out a first clean-up — old enquiry lists, former employees’ files, closed customer records beyond their period — and a routine to repeat it.

Data leaving India

The Act permits transfer of personal data outside India except to countries the government notifies as restricted, while preserving stricter sectoral rules, as our transfer guide explains. The review’s job is factual: to find out where data actually goes. Cloud services, email platforms, analytics and advertising tools, customer support software and AI tools frequently store or process data abroad, and vendors’ support teams may access it from other countries.

The inventory should record the location of storage and access for each system, and the report should flag any sector rule requiring storage in India, any vendor whose location is unknown, and whether the business would be affected if a destination were restricted.

Employees and applicants

HR data is often the most sensitive data a business holds — salaries, bank details, identity numbers, health information for insurance, background checks, disciplinary records — and the least reviewed. The Act allows processing for employment purposes as a legitimate use, as our guide on employee data explains, but every other duty applies.

The review covers recruitment (what applicants are asked for and how long unsuccessful applications are kept), onboarding documents, payroll and attendance vendors, monitoring of email and devices, background verification, medical and insurance data, and exit records. Common recommendations are an employee privacy notice, processing terms with HR vendors, restricted access to salary and medical files, and a retention period for former employees’ records. Our HR policy and employment agreement services can carry these into staff documents.

Marketing, analytics and AI

Marketing is where data most often goes further than customers expect. The review traces how leads are captured, where lists are stored, which tools send messages, what tracking tags and pixels run on the website and app, whether customer lists are uploaded to advertising platforms, and whether any data is used to train or feed AI tools. For each, it checks the notice, the consent and the opt-out.

AI tools deserve a specific question: are staff pasting customer data, documents or conversations into public AI services? A short rule on approved tools and prohibited data, and a check of the terms of any AI vendor, are usually needed. For websites and apps, the review can use the tag and SDK checks described in our app compliance guide and the cookie approach in our website legal pack guide.

Checking new projects before launch

A review looks at what exists; the business also needs a habit for what is coming. Before launching a new product, app, form, marketing campaign or AI tool, a short check — a page or two — asks: what personal data will this collect, why, on what basis, who will receive it, where it will be stored, how long it will be kept, whether children could be affected, and what could go wrong. Only significant data fiduciaries are required by the Act to carry out formal impact assessments, but the same questions asked early save redesigns later.

The review can supply a simple template for this check and name who must complete it. Building the answer into the project plan — as a step before the developer is briefed — is what “privacy by design” means in a small business.

Significant data fiduciary watch

The government may notify a data fiduciary or class of fiduciaries as significant, considering the volume and sensitivity of data, risk to individuals and wider factors; such fiduciaries must appoint a Data Protection Officer based in India, an independent data auditor, and carry out periodic impact assessments and audits, as our guide on significant data fiduciaries explains.

Most businesses reading this will not be notified. A review should still record whether the business could plausibly be, given its volume and type of data, and whether large clients are asking it to meet similar standards by contract. Where either is likely, the review can be structured so that it later serves as the baseline for a formal data protection impact assessment.

Sector rules on top

The DPDP Act is general, and stricter sectoral rules continue to apply. The review should identify which apply to the business and check them alongside the Act:

Where a sector regulator’s rule is stricter than the Act, the stricter rule generally sets the standard for that activity.

Scoring the risks

Not every gap is equally urgent. A clear scoring method helps a busy owner decide what to fix first. A simple approach rates each finding for likelihood and impact on a three-point scale and combines them:

High-high findings — for example, patient records on staff phones with no lock, or a vendor holding sensitive data with no contract — go into the first thirty days. Documentation gaps with low impact can wait for the ninety-day stage. The score should be explained in words, so that it can be understood without the table.

The report

A useful report is short at the front and detailed at the back. A structure that works:

1. Summary for the owner or board: overall position in a paragraph, the five most important findings, and the headline plan.
2. Scope and method: what was covered, how, and what was not.
3. Findings by area: notices, consent, children, security, vendors, breach readiness, rights, retention, transfers, HR, marketing — each with evidence, risk rating and recommendation.
4. Action plan: 30-60-90 day tasks with owners.
5. Annexes: the data inventory, vendor register, draft procedures and document list.

The report is itself confidential and may contain sensitive findings. It should be shared only with those who need it, and marked accordingly. If the business intends to share a summary with clients or investors, a separate short statement of the steps taken is more appropriate than the full report.

The 30-60-90 day plan

Each task should have one named owner and a date. Tasks that depend on outside parties — a software vendor adding a deletion feature, a global provider’s contract — should have an interim measure, so the plan does not stall. Documents the plan calls for, such as a privacy policy, data processing agreements or a website legal pack, can be prepared in parallel.

Owners, board and evidence

Compliance lasts only if someone owns it. Even where the Act does not require a Data Protection Officer, the business should name a person responsible for data protection decisions, give that person time and authority, and publish a contact for questions and grievances. In a company, the board or partners should receive the review summary and a short progress update each quarter until the plan is complete.

The business should also keep an evidence file: the inventory, the notices and their versions, consent records, vendor contracts, training records, the request log, the breach log, and the review reports. If the Board ever inquires, the question will be what the business did and when; the evidence file is the answer.

Answering clients’ questionnaires

Businesses that supply larger companies increasingly receive data protection questionnaires: do you have a privacy policy, who is your data protection contact, where is data stored, do you encrypt it, which sub-processors do you use, how would you notify us of a breach, do you have a certification. A review produces most of the answers. Keeping a standard response pack — the inventory summary, security description, sub-processor list, breach commitment and contact — lets the business answer quickly and consistently, and avoids the temptation to tick “yes” to everything. Our guide for processors explains how to prepare it.

Every answer given to a client is a representation. If it is untrue, it can become a breach of contract, and possibly misrepresentation. It is better to answer “planned by March, in progress” than to claim a control that does not exist.

Complaints, the Board and what follows

An individual with a complaint must usually first use the business’s own grievance mechanism, and may then complain to the Data Protection Board. The Board can also act on a reference from the government or a court, or on a breach intimation. It is designed as a digital office, and it may inquire, direct urgent measures, and impose penalties after hearing the business. During proceedings the business may offer a voluntary undertaking — for example, to take specified steps within a time — which the Board may accept. Appeals from the Board’s orders go to the Appellate Tribunal within the time the Act allows.

A business that has done a review and followed its plan is in a far better position in any of these steps: it can show the inventory, the notices, the vendor contracts, the training and the steps taken after the incident. The Act itself directs the Board, when deciding a penalty, to consider matters such as the nature and gravity of the breach and the mitigating action taken. Representation before the Board or the Tribunal is for your advocate.

Training the team

Rules on paper change nothing until staff know them. Training should be short, practical and role-specific: reception and customer service on notices, identity checks and requests; sales and marketing on consent and opt-outs; HR on employee data; IT on access and incidents; everyone on spotting and reporting a breach, safe use of phones and messaging apps, and what never to paste into public tools. A one-page summary on the notice board and a ten-minute refresher each quarter work better than an annual lecture.

Keeping it current

A review is a snapshot. After the first review, a lighter annual review should update the inventory, check the plan’s results, test the breach and request procedures again, and pick up changes in law and in the business. A fresh review is also sensible whenever the business launches a new product or app, adopts a major new system or AI tool, expands abroad, acquires another business, or suffers an incident. Tying the annual review to an existing calendar event — the financial year end or the security review — makes it more likely to happen.

Groups, branches and franchises

Where a business operates through several companies, branches or franchisees, the review must decide who is the data fiduciary for each activity. A group company that runs a shared CRM for its sister companies may be a processor for them, or they may be joint fiduciaries; a franchisor that runs a central booking app may hold customers’ data for itself as well as for franchisees. The answers decide whose notice customers see, who handles their requests, and which contracts are needed between the entities.

A practical approach is to review the central systems once, then use a short checklist for each branch or franchisee covering local practices — paper files, phones, local vendors — and to put intra-group data sharing and processing on written terms.

A lean review for small businesses

A shop, clinic, coaching centre or professional office can do a useful review in a few days:

1. list every place personal data lives — software, spreadsheets, email, WhatsApp, paper files, phones;
2. for each, write down whose data, why, who can see it and when it can be deleted;
3. remove shared passwords and switch on phone and laptop locks;
4. check the website forms and notices;
5. list vendors and get processing terms from those that hold the most data;
6. write a one-page breach procedure and a one-page request procedure;
7. delete what is no longer needed; and
8. put a date in the calendar to repeat the exercise next year.

This does not remove any duty under the Act, but it covers the areas where small businesses are most exposed, and it is far better than nothing.

An example: a clinic chain

The West Delhi clinic chain from the top of this page asked for a review before signing the hospital group’s partnership agreement. The scope covered its four clinics, the website, the booking and records software, and HR. Interviews with the clinic manager, two receptionists, the IT freelancer and the accountant produced an inventory of twenty-three activities.

The high-risk findings were a shared login to the records software at every reception desk, prescriptions photographed on a receptionist’s personal phone and sent over a messaging app, no processing contract with the SMS provider, backups kept on an unencrypted external drive taken home by the freelancer, and no retention period for anything. The breach drill showed that nobody knew whom to call if a laptop was stolen. Medium findings included a privacy policy copied from a foreign template and booking forms asking for full date of birth. The thirty-day plan gave every receptionist a personal login with a second factor, replaced phone photographs with a scanner feeding the records system, encrypted the backup and moved it to the software provider’s India-hosted service, adopted a one-page breach procedure, and signed processing terms with the SMS and software providers. The owner then signed the hospital group’s confirmation, describing accurately what had been done and what was scheduled.

An example: a coaching institute

A coaching institute in Laxmi Nagar with three thousand students, most of them under eighteen, wanted to launch an app for recorded lectures and tests. Its review focused on children’s data, marketing and the new app.

The inventory showed that students’ phone numbers, parents’ numbers, test scores and photographs were held in a spreadsheet shared with six counsellors, uploaded to an advertising platform for “lookalike” campaigns, and posted in results announcements on social media. The app’s draft design included an analytics SDK with advertising features. The review recommended enrolment by parents with a consent step, ending the upload of student lists to advertising platforms, removing the advertising features from the SDK, limiting results announcements to students whose parents agreed, moving the spreadsheet into the student management system with role-based access, and a retention period for former students. The app’s privacy policy and store disclosures were prepared from the updated inventory, using the approach in our app compliance guide.

Where reviews go wrong

• Reviewing the privacy policy instead of the business.
• No data inventory, so findings cannot be checked or updated.
• Talking only to management, not to the people who handle the data.
• No practical tests of consent withdrawal, requests or breach response.
• A long report with no priorities or owners.
• Ignoring HR data and messaging apps.
• Treating a security certificate as DPDP compliance.
• Forgetting children in education, health and gaming.
• No follow-up, so the plan never finishes.
• Copying personal data to the reviewer in bulk, creating a new risk.

Our fee and what you get

Our DPDP Act compliance review costs ₹14,999 and takes 7 – 21 days, depending on the size of the business and how quickly information is available. The fee covers a business of ordinary size with one entity; for groups, multiple branches or complex systems, we agree the scope and tell you the total before we start.

Documents the review recommends — privacy policies, processing agreements, HR documents — are quoted separately. Technical security testing is for specialist security firms, whose reports we use as evidence. Representation before the Data Protection Board, an appellate tribunal or a court is for your advocate, whose fee is engaged and paid by you directly; we do not quote, collect or share it. You can find an advocate through our directory.