DPDP compliance readiness checklist for Indian enterprises

1. Personal data processing inventory

• Identify the systems and journeys where personal data is collected or received.
• Document the processing purpose, accountable owner and downstream systems.
• Map processors, recipients and external integrations.

2. Privacy notices and purpose clarity

• Review whether notices describe processing purposes clearly and in an understandable form.
• Maintain version history and relevant language variants.
• Keep notice content connected to the journeys where it is shown.

3. Consent capture and evidence

• Define where consent is relied upon and how purpose-specific choices are presented.
• Record what notice, purpose and choices were shown when consent was captured.
• Maintain traceable consent event history for later review.

4. Consent withdrawal

• Provide a clear withdrawal pathway where consent is used.
• Propagate withdrawal signals to connected business and third-party systems.
• Record downstream acknowledgement and exceptions.

5. Data Principal requests and grievances

• Define intake, identity verification, assignment, due dates, decisions and closure evidence.
• Make status and ownership measurable.

6. Retention and deletion

• Connect retention rules to processing purposes and systems.
• Track deletion or archival action and evidence.
• Define escalation where deletion is blocked or delayed.

7. Processor and third-party governance

• Maintain a usable processor/recipient register.
• Link processors to relevant purposes, data and operational obligations.

8. Evidence and continuous monitoring

• Centralise the evidence needed to reconstruct consent and privacy actions.
• Define control owners, exceptions and review cadence.
• Use dashboards and reports to surface gaps before an audit or grievance.

Next step

Turn the checklist into a measurable operating model using the ConsentKosha DPDP readiness assessment.