India DPDP Compliance Checklist

Know the staged timeline

The DPDP Act and final Rules are on a phased commencement schedule. The practical implication is that enterprises can use the runway to establish discovery, ownership, workflow and evidence before the main operational tranche begins.

1.Build a defensible personal-data inventory

Map databases, warehouses, shared drives, documents, scanned files, application exports and archives. Record system owner, business owner, location, data type and lifecycle state.

Readiness question: Can you show where personal data is likely to exist across the enterprise?

2.Discover PII before relying on policy assumptions

Scan supported structured and unstructured sources so the inventory reflects what is actually present. Preserve the scan scope, finding and detector/rule used.

Readiness question: Can you reproduce what was scanned, what was found and why it was classified?

3.Map findings to purpose and ownership

Connect findings to source, owner, processing purpose, reviewer, decision, retention requirement and downstream system or processor where relevant.

Readiness question: For a given category of personal data, can you identify who owns the processing decision?

4.Prepare notice and consent evidence

Preserve evidence of the notice presented, consent request, decision, withdrawal/change and relevant timestamps when consent is relied upon.

Readiness question: Could you reconstruct the notice and consent evidence for a specific processing activity?

5.Establish access, logging and security evidence

Prepare evidence around access controls, logs, monitoring, review, resilience, processor safeguards and remediation.

Readiness question: Can you show that a security control operated, not just that a policy exists?

6.Prepare a breach-evidence workflow

Preserve affected systems, personal-data scope, timing, detection, review, mitigation, approvals and the response timeline.

Readiness question: If an incident occurred today, how quickly could you identify affected data and reconstruct the response?

7.Connect retention to erasure

Capture retention rules, legal holds, system owners, erasure actions, approvals and completion evidence.

Readiness question: Can you demonstrate why data was retained, when it became eligible for erasure and what happened next?

8.Operationalize rights-request evidence

Track the request, identity/authority checks, systems searched, findings, decisions, actions and completion evidence.

Readiness question: Can one team coordinate a request without manually rediscovering every system?

9.Identify higher-risk processing early

Flag child/guardian workflows, large-scale processing, processors, third parties and other situations needing additional review.

Readiness question: Do you know which systems and processes need added controls before the relevant obligations commence?

10.Build an evidence pack, not just a dashboard

Preserve what was scanned, found, reviewed, accepted/rejected, approved, remediated and when each step occurred.

Readiness question: Could an independent reviewer reconstruct the sequence without verbal explanation?

How Kestryl Cockpit supports readiness

Kestryl Cockpit supports the operational evidence journey around personal-data discovery. It can help teams discover and inventory personal data across supported sources, review findings, record owner attestations, coordinate governed actions and approvals, track retention/requests/erasure workflows, and preserve reviewable evidence.

Boundary: Kestryl does not provide legal advice, determine applicability, prove legal compliance by itself, determine the legal sufficiency of consent, or replace legal/regulatory judgment.