Minimum Viable DPDP Compliance Checklist for Small Businesses

When to Use This Checklist

This checklist is for founders of small or bootstrapped businesses looking for the cheapest defensible setup to comply with the Digital Personal Data Protection Act, 2023. If you run lean operations and are wondering if this legislation applies to you, the answer is yes. The Act covers digital personal data processed within India, as well as processing outside India connected to offering goods or services to Data Principals in India. With 308 days remaining until the hard compliance deadline of 13 May 2027, this guide helps you build a minimum viable compliance program to keep the lights on without overengineering.

Prerequisites for Getting Started

Before starting the checklist, you need a basic understanding of your current data flows. Create a simple inventory of what digital personal data you collect and list the third-party vendors who process it for you. You also need to designate a point of contact to handle Data Principal queries, as Section 13 requires a readily available means of grievance redressal before users can approach the Data Protection Board.

Step-by-Step Execution Plan

1. Map data collection. Owner: Founder. Action: Document every form where you collect user data and the exact fields captured. Evidence: A simple spreadsheet. 2. Update privacy notices. Owner: Legal or Founder. Action: Ensure requests for consent are accompanied by an itemised notice detailing the data collected, the purpose, and user rights, per Section 5 and the Rules, 2025. Evidence: Version-controlled notice documents.

3. Upgrade consent capture. Owner: IT or Product. Action: Log an affirmative action when users agree. Consent is the primary basis for processing, except where Section 7 legitimate uses apply. Evidence: Database logs with timestamps. 4. Build a grievance channel. Owner: Operations. Action: Set up a dedicated email or form for users to withdraw consent or complain. Evidence: Ticket resolution logs showing responses within prescribed timelines.

5. Audit vendor contracts. Owner: Founder. Action: Ensure you have data processing agreements with your cloud and marketing tools. Evidence: Signed contracts. 6. Map cross-border transfers. Owner: IT. Action: Identify where your servers and vendors store data. Transfers are generally permitted unless the Central Government restricts transfer to notified countries or territories. Evidence: Infrastructure architecture diagram.

DPBI Breach Intimation Workflows

You cannot afford to improvise during a security incident with a one-person operations team. The Rules, 2025 strictly mandate that in the event of a personal data breach, you must provide intimation to affected Data Principals without delay. Simultaneously, you must submit a detailed report to the Data Protection Board within 72 hours. Your setup must include a basic incident response template capturing the date, time, fields exposed, and mitigation steps to meet this tight window.

Effort and Budget Reality

Founders often object that the Data Protection Board will not target small companies first. While initial enforcement may focus on large entities, an angry user filing a Section 13 grievance can trigger an audit you cannot ignore. Manually executing this checklist takes about 20 to 30 hours of founder time upfront, plus a few hours monthly for ongoing logging. Automated tooling absorbs this recurring effort, turning manual spreadsheets into a continuous, set-and-forget audit trail.

Documentation Pack and Audit Red Flags

Your baseline documentation pack must include an updated external privacy notice, an internal breach response plan, and vendor agreement addendums. You are not ready for an audit if you exhibit specific red flags. First, you rely on pre-ticked boxes for consent. Second, you have no timestamped records of when a user agreed to data processing. Third, you lack a workflow to respond to Section 13 grievances before users approach the Board.

Next Steps

Stop guessing about your audit readiness and budget requirements. Run the free scan at freescan.complydp.com to baseline which steps are already covered and which gaps remain before the deadline.