Running an internal DPDP readiness audit helps you identify compliance gaps before the Data Protection Board of India begins enforcement. This checklist covers the six key domains of DPDP compliance — use it quarterly or before any significant business change that affects personal data processing.
Domain 1: Data Discovery & Inventory
We have a complete inventory of all personal data collected across all business functions.
We have documented the purpose, legal basis, and retention period for each data category.
All personal data storage locations (databases, cloud systems, paper records) are identified and logged.
Data flows between internal systems and to third-party processors are mapped and documented.
Data retention schedules are defined. Personal data is deleted or anonymised when no longer needed.
Domain 2: Consent Management
DPDP-compliant consent notices are in place for each data collection touchpoint (website, onboarding forms, contracts).
Consent is freely given, specific, informed, unconditional, and unambiguous — with no pre-ticked boxes.
A consent management system records the date, mechanism, and version of consent obtained for each Data Principal.
Data Principals can withdraw consent easily, and withdrawal results in data processing being stopped.
Consent is obtained separately for each distinct purpose — bundled consent for multiple purposes is not used.
Domain 3: Data Principal Rights
A defined process exists for Data Principals to submit access, correction, and erasure requests.
Requests are acknowledged, verified, and fulfilled within the required timeframe (target: 30 days).
All Data Principal requests and responses are logged with timestamps for audit purposes.
A grievance officer or contact mechanism is publicly available for Data Principals to raise complaints.
The nomination process (allowing a nominee to exercise rights on behalf of a deceased/incapacitated principal) is implemented.
Domain 4: Data Processor Management
All third-party vendors that process personal data on our behalf are identified and registered.
Data Processing Agreements (DPAs) are in place with every data processor.
DPAs specify the purpose of processing, security requirements, and breach notification obligations.
Periodic reviews of processor security practices and compliance are conducted.
Cross-border data transfers are only made to approved countries or with appropriate safeguards.
Domain 5: Security Controls
Personal data is encrypted in transit and at rest.
Access to personal data is restricted to authorised personnel with role-based access controls.
A vulnerability management programme is in place — VAPT conducted at least annually.
Security logs and audit trails are maintained and regularly reviewed.
Employees handling personal data have received DPDP awareness training in the last 12 months.
Domain 6: Breach Detection & Response
A data breach incident response plan is documented and has been tested.
Breach notification procedures specify roles, timelines, and escalation paths.
A process exists to notify affected Data Principals in the event of a breach that poses significant risk.
The Data Protection Board notification procedure is documented and ownership is assigned.
A post-incident review process is in place to analyse root causes and improve controls.
Automate this checklist with NeevCore
The NeevCore DPDP Compliance Platform tracks all 30+ controls in a live compliance dashboard, automates consent workflows, and generates audit-ready reports at any time.
Explore the platform