DPDP compliance checklist: 8 pillars for IT & security

The Digital Personal Data Protection (DPDP) Act, 2023, establishes a legal framework for protecting digital personal data in India, with certain provisions also applying to processing outside the country. It requires organizations within its scope to meet applicable obligations concerning lawful processing, privacy notices, individual rights, and data security.

With hybrid work and bring your own device (BYOD) environments, personal data may be accessed, stored, or processed across laptops, smartphones, tablets, and other devices. For IT and security teams, securing these endpoints is an important part of DPDP readiness.

This guide provides an eight-pillar DPDP compliance checklist focused on the responsibilities of IT admins. It also includes an illustrative endpoint security maturity assessment to help organizations evaluate technical safeguards, identify gaps, and prioritize improvements.

Note: The DPDP Act and Rules are being implemented in phases. As of October 2026, several substantive obligations are scheduled to take effect on May 13, 2027.

DPDP compliance checklist: 8 pillars every IT admin must secure

To bridge the gap between legal obligations and IT execution, this DPDP compliance checklist is organized into eight pillars, adapted from DPDPA.com’s 2026 business assessment framework. Each pillar outlines statutory obligations where applicable, recommended governance and security practices, supporting evidence to maintain, and common IT mistakes to avoid.

The following eight pillars cover applicable statutory requirements and recommended readiness practices, including additional obligations for Significant Data Fiduciaries (SDFs). For each checklist item, record whether the control is implemented, partially implemented, or not implemented, along with its owner and supporting evidence.

1. Governance & leadership

Checklist:

✅ DPO appointment: If designated as an SDF, appoint an India-based Data Protection Officer (DPO) who reports to the board of directors or equivalent governing body.

✅ Leadership oversight: Establish board or senior leadership oversight of DPDP readiness, with periodic reviews of privacy risks, security measures, and compliance progress.

✅ Policy communication: Document and communicate data protection policies, procedures, and responsibilities across the organization.

✅ Compliance committee: Establish a cross-functional privacy committee involving legal, IT, HR, operations, and relevant business teams.

✅ Data Protection Impact Assessment (DPIA): If designated as an SDF, conduct a DPIA and audit every 12 months, as required under Rule 13.

✅ Independent data auditor: If designated as an SDF, appoint an independent data auditor to assess compliance with the DPDP Act.

✅ Data Protection by Design (DPbD): Integrate privacy and security safeguards into device provisioning, application development, and other relevant workflows.

✅ Accountability framework: Maintain centralized records of privacy policies, processing decisions, security assessments, and compliance activities.

✅ Staff training: Conduct role-specific data protection training for IT, HR, customer service, and other teams handling personal data.

Suggested compliance evidence to maintain:

• DPO appointment records, contact details, and reporting structure (for SDFs)
• Leadership meeting minutes, approved privacy roadmaps, and progress reports
• Data protection policies, communication logs, and acknowledgments
• Committee charter, responsibilities, and meeting records
• Completed DPIAs, audit reports, and applicable reporting records (for SDFs)
• Independent data auditor appointment records and findings (for SDFs)
• Privacy-by-design checklists and relevant technical documentation
• Processing decision logs, risk assessments, and compliance records
• Training materials, attendance records, and refresher schedules

IT blind spot to avoid:

Treating data protection governance as documentation alone. Written policies should be supported by practical security controls, clear ownership, and periodic verification.

2. Data inventory & mapping

Checklist:

✅ Complete inventory: Maintain a centralized inventory of personal data processed across the organization, including relevant data sources, systems, applications, and responsible teams.

✅ Data mapping: Document the purpose, applicable processing ground (consent or certain legitimate uses), recipients, and retention periods for personal data accessed or processed through corporate endpoints.

✅ Risk-based data classification: Identify higher-risk personal data, such as health, financial, or biometric information, and apply appropriate privacy and security controls.

✅ Retention schedules: Define and implement data retention and erasure procedures based on processing purposes, applicable DPDP requirements, and other legal obligations.

✅ Cross-border data transfers: Track where personal data is stored and processed, and assess transfers against applicable government restrictions and other legal requirements.

✅ Legacy data assessment: Review outdated devices and datasets, securely deleting personal data that is no longer required, subject to applicable retention obligations.

✅ Data flows: Document internal and external personal data flows, third-party recipients, and integrations involving corporate and managed personal devices.

✅ Automated processing: Identify automated processing activities involving personal data and assess associated privacy risks, particularly where decisions affect individuals.

Suggested compliance evidence to maintain:

• Personal data inventory, ownership records, and periodic review logs
• Data mapping documents, processing grounds, and retention schedules
• Data classification records and corresponding security controls
• Retention policies, deletion procedures, and erasure verification records
• Data transfer maps, processing locations, and applicable legal assessments
• Legacy data reviews, deletion records, and remediation documentation
• Data flow diagrams, third-party recipient lists, and integration records
• Automated processing inventories, privacy risk assessments, and relevant audit trails

IT blind spot to avoid:

Overlooking unmanaged devices and employee-owned endpoints accessing corporate data. These devices can create visibility gaps in personal data processing and increase the risk of unauthorized access.

3. Legal basis & consent

Checklist:

✅ Document processing grounds: Identify and document the applicable ground for processing personal data: valid consent or certain legitimate uses under Sections 4 and 7 of the DPDP Act.

✅ Consent mechanism: Where consent is required, obtain free, specific, informed, unconditional, and unambiguous consent through clear affirmative action.

✅ DPDP-compliant notices: Provide clear, plain-language notices specifying the personal data collected, processing purposes, and how Data Principals can exercise their rights.

✅ Withdrawal mechanism: Provide an accessible method for Data Principals to withdraw consent as easily as it was given, with appropriate procedures to stop consent-based processing.

✅ Marketing consent: Obtain consent for marketing where required, clearly distinguish marketing purposes, and provide applicable withdrawal or unsubscribe mechanisms.

✅ Children’s data: Establish verifiable parental consent procedures before processing children’s personal data (under 18), subject to applicable exemptions.

✅ Automated processing: Document automated processing involving personal data, communicate relevant processing purposes, and assess associated privacy risks.

✅ Cross-border data transfers: Document international personal data transfers and monitor applicable government restrictions and other legal requirements.

✅ Consent records: Maintain records of consent notices, affirmative actions, withdrawals, and applicable processing grounds to demonstrate compliance.

Suggested compliance evidence to maintain:

• Processing records documenting applicable legal grounds and purposes
• Consent forms, affirmative action records, and consent management logs
• Privacy notices, legal reviews, and documentation of notice delivery
• Consent withdrawal procedures, request logs, and processing cessation records
• Marketing consent records, preference settings, and unsubscribe logs
• Age verification procedures and verifiable parental consent records
• Automated processing inventories, privacy assessments, and relevant documentation
• Cross-border transfer records, destination maps, and legal assessments
• Consent records, notice versions, timestamps, and withdrawal histories

IT blind spot to avoid:

Assuming consent is required for every processing activity or that unenrolling a device automatically fulfills consent withdrawal obligations. IT teams should work with legal and privacy teams to apply the appropriate processing grounds and support consent withdrawal where applicable.

4. Data Principal rights

Checklist:

✅ Right to Access Information: Establish a process for Data Principals to request a summary of their personal data being processed, related processing activities, and prescribed data sharing information.

✅ Right to Correction: Provide a mechanism for individuals to request correction, completion, or updating of inaccurate, incomplete, or outdated personal data.

✅ Right to Erasure: Establish procedures to erase personal data upon valid requests, unless continued processing is necessary for the specified purpose or retention is required by law. 

✅ Right to Nominate: Enable Data Principals to nominate another individual to exercise their rights in the event of death or incapacity, as applicable.

✅ Grievance redressal: Establish an accessible mechanism to receive and address grievances within a published, reasonable response period not exceeding 90 days.

✅ Request handling: Maintain a system to track, verify, respond to, and escalate Data Principal rights requests within applicable timelines.

Suggested compliance evidence to maintain:

• Rights request records, response logs, and information sharing documentation
• Correction, completion, and updating procedures with fulfillment records
• Erasure procedures, deletion records, and documented retention exceptions
• Nomination procedures and relevant nomination records
• Published grievance procedures, response timelines, and resolution logs
• Rights request tracking records, escalation procedures, and audit trails

IT blind spot to avoid:

Using a full factory reset to remove corporate data from an employee-owned device can also erase personal files. Where supported, use selective removal of managed work data to protect employee privacy.

5. Technical & organizational measures

Checklist:

✅ Encryption: Protect personal data in transit and at rest using appropriate encryption and other security measures, such as masking or tokenization, based on risk.

✅ Access controls: Apply least-privilege access and role-based access control (RBAC) to restrict unauthorized access to personal data and management systems.

✅ Audit logging: Maintain appropriate logs and monitoring to detect unauthorized activity. Retain relevant security logs and personal data for at least one year as specified under Rule 6, subject to applicable legal requirements. 

✅ Data minimization: Review endpoint telemetry and data collection practices to limit personal data to what is necessary for the specified processing purpose.

✅ Anonymization: Use anonymization or pseudonymization where appropriate to reduce privacy risks, with safeguards for any re-identification information.

✅ System segmentation: Apply network and database segmentation where appropriate to restrict unnecessary access to systems processing personal data.

✅ Backups: Maintain secure backups and regularly test recovery procedures to support data availability and continued processing.

✅ Data loss prevention (DLP): Apply appropriate controls to reduce unauthorized data transfers through removable storage, clipboard sharing, and cloud applications.

✅ Security assessments: Conduct periodic vulnerability assessments, penetration testing, and security reviews based on system risks and applicable regulatory requirements.

Suggested compliance evidence to maintain:

• Encryption configurations, key management records, and security assessments
• RBAC policies, access reviews, and privilege management records
• Audit logs, monitoring reports, and applicable retention records
• Data minimization reviews and documented collection purposes
• Anonymization or pseudonymization procedures and relevant safeguards
• Network architecture diagrams, segmentation policies, and access tests
• Backup policies, restoration test results, and recovery procedures
• DLP policies, incident records, and control effectiveness tests
• Vulnerability assessment reports, penetration test findings, and remediation logs

IT blind spot to avoid:

Treating security controls as a one-time configuration. Without regular monitoring and security assessments, configuration changes and unpatched vulnerabilities can weaken endpoint protection over time.

6. Third-party & vendor management

Checklist:

✅ Vendor assessment: Assess third-party applications and service providers based on the personal data they process, their security practices, and associated risks.

✅ Data Processing Agreements (DPA): Ensure valid contracts are in place with Data Processors handling personal data on the organization’s behalf, as required under Section 8.

✅ DPA adequacy: Review contracts for processing responsibilities, reasonable security safeguards, breach reporting, and applicable data sharing and subprocessing conditions.

✅ Breach notification: Establish contractual procedures requiring Data Processors to promptly report personal data breaches so the organization can meet applicable notification obligations.

✅ Subprocessor monitoring: Maintain visibility into relevant subprocessors and establish procedures to review changes in processing arrangements and associated risks.

✅ Regular vendor audits: Conduct periodic, risk-based vendor assessments and security reviews, tracking identified issues and remediation progress.

Suggested compliance evidence to maintain:

• Vendor assessment questionnaires, security certifications, and risk reports
• Executed processor contracts, approved templates, and legal review records
• Contract clauses covering security, processing responsibilities, and applicable subprocessing requirements
• Breach notification procedures, contractual escalation timelines, and incident records
• Subprocessor inventories, change notifications, and risk assessments
• Vendor review schedules, audit findings, and remediation records

IT blind spot to avoid:

Overlooking third-party applications installed on corporate endpoints. Unapproved tools may collect, access, or share personal data without adequate security assessments or organizational oversight.

7. Incident response (IR) & breach management

Checklist:

✅ IR plan: Document an incident response plan defining responsibilities, escalation procedures, communication channels, and recovery actions.

✅ Detection capabilities: Implement appropriate monitoring and threat detection controls, such as SIEM tools and SOC oversight, to identify potential security incidents.

✅ Breach notification: Notify the Data Protection Board (DPB) without delay upon becoming aware of a personal data breach, and provide the prescribed additional information within 72 hours, unless an extension is permitted.

✅ Data Principal notification: Prepare communication channels to notify affected Data Principals without delay upon becoming aware of a personal data breach, as required under Rule 7.

✅ Post-incident remediation: Document root cause analyses, corrective actions, and measures to prevent similar incidents from recurring.

✅ Testing and drills: Conduct periodic incident response exercises, including simulated endpoint breaches, to identify and address response gaps.

Suggested compliance evidence to maintain:

• IR plans, assigned responsibilities, and escalation procedures
• Security monitoring configurations, detection alerts, and incident records
• DPB notification procedures, reporting templates, submission records, and timelines
• Data Principal communication templates, notification records, and delivery logs
• Incident investigation reports, root cause analyses, and remediation records
• Incident response exercise reports, identified gaps, and corrective action plans

IT blind spot to avoid:

Relying solely on employees to report compromised devices. Without effective monitoring and escalation procedures, delayed detection can increase breach impact and make timely regulatory notification difficult.

8. Accountability & documentation

Checklist:

✅ Privacy notice adequacy: Ensure privacy notices clearly describe personal data processing purposes, required information, and ways to exercise Data Principal rights, in accordance with Section 5 and Rule 3.

✅ Notice communication: Provide accessible privacy notices through appropriate channels, such as websites, applications, or other methods used when requesting consent.

✅ Record of Processing Activities (RoPA): Maintain records of personal data processing activities, purposes, recipients, and retention periods, updating them when processing practices change.

✅ Compliance archive: Centralize relevant compliance records in a secure, searchable repository, applying retention periods based on applicable legal requirements.

✅ Regular compliance audits: Conduct periodic privacy and security reviews, including statutory DPIAs and audits for SDFs, where applicable.

✅ DPB readiness: Establish procedures for responding to DPB inquiries, including retrieving relevant records and coordinating responses.

Suggested compliance evidence to maintain:

• Privacy notices, legal review records, and applicable language versions
• Notice communication records, website or app screenshots, and consent-related documentation
• Processing activity records, data flow maps, and periodic updates
• Secure compliance archives, access controls, and retention schedules
• Privacy audit reports, DPIAs (for SDFs), findings, and remediation records
• Regulatory response procedures, relevant correspondence, and leadership briefings

IT blind spot to avoid:

Scattered documentation and incomplete audit trails can delay regulatory responses. Maintain organized, accessible records of relevant security controls, processing activities, and compliance decisions.

Endpoint security maturity assessment for DPDP readiness

Endpoint security is an important part of DPDP readiness, but it does not determine overall legal compliance. This assessment helps IT teams evaluate technical safeguards across their device fleets, identify security gaps, and prioritize improvements.

Note: This is an illustrative endpoint security maturity assessment, not an official DPDP compliance scoring system.

Part 1: Assess your endpoint security controls

Evaluate your device fleet against the following 10 controls. Award 0 points if a control is absent, 5 if partially implemented, and 10 if implemented and verified across applicable devices. Mark controls that do not apply to your environment as N/A and exclude them from the total possible score.

Calculate your maturity percentage by dividing the points earned by the maximum points for applicable controls and multiplying by 100. Consider the following example,

Applicable controls: 8/10

Points earned: 60/80

Maturity score: 75%

Note: Mark a control as N/A only if it does not apply to your environment, not because it is unimplemented or unsupported by your management solution.

10-point endpoint security health check

1. Fleet visibility: Maintain an updated inventory of managed devices and identify unmanaged endpoints accessing corporate resources.
2. Storage encryption: Enforce supported device encryption controls, such as BitLocker, FileVault, and platform-native mobile encryption.
3. Work data separation: Apply supported BYOD management configurations to separate organizational data from personal data.
4. DLP: Restrict unauthorized data sharing through supported clipboard, screen capture, and application controls.
5. Peripheral control: Restrict unauthorized removable storage and peripheral access on supported endpoints.
6. Remote data erasure: Configure selective work data removal for supported BYOD deployments and full-device wipe for applicable corporate devices.
7. Application governance: Manage approved applications and restrict unauthorized installations through supported application policies.
8. OS patch management: Centrally monitor and deploy supported OS updates to reduce exposure to known vulnerabilities.
9. Conditional access: Apply device compliance and access policies to supported corporate applications and resources.
10. Audit logging: Collect and review relevant device, security, and policy activity logs to support investigations and compliance assessments.

Part 2: Interpret your endpoint security maturity score

Calculate your maturity percentage based on applicable controls to assess how effectively your organization implements and maintains endpoint security safeguards.

4-Tier endpoint security maturity matrix

Important: A higher maturity score reflects stronger implementation of the assessed endpoint security controls. It does not indicate DPDP compliance or eliminate the risk of personal data breaches.

DPDP Act penalties for non-compliance

The DPDP Act, 2023 prescribes monetary penalties for violations of its provisions. These penalties become applicable as the relevant provisions come into force. The DPB may impose penalties following an inquiry, depending on the nature and severity of the violation.

• Up to ₹250 crore for failure to implement reasonable security safeguards to prevent personal data breaches
• Up to ₹200 crore for failure to notify the DPB or affected Data Principals of a personal data breach
• Up to ₹200 crore for violating additional obligations relating to children’s personal data
• Up to ₹150 crore for violating additional obligations applicable to SDFs
• Up to ₹50 crore for violating other provisions of the DPDP Act or Rules
• Up to ₹10,000 for Data Principals who breach their statutory duties under Section 15

Penalties are not automatic. Following an inquiry, the DPB may impose a monetary penalty for a significant breach, considering the factors specified in Section 33 of the Act.

How Scalefusion supports continuous DPDP readiness

Meeting DPDP Act requirements involves more than documenting privacy policies. Organizations also need appropriate technical and organizational safeguards to protect personal data.

Scalefusion DPDP compliance software helps IT and security teams address endpoint-related readiness requirements through device visibility, access controls, application management, vulnerability management, and security monitoring. These capabilities support selected technical safeguards within the broader DPDP compliance framework.

1. Strengthen endpoint governance

Manage enrolled devices through a centralized dashboard and use RBAC to define administrator permissions and responsibilities. Review administrative access and available activity logs to support accountability and oversight of device management operations.

2. Improve device inventory and visibility

Track enrolled corporate and employee-owned devices, review available device and application information, and generate inventory reports. These records can support asset management and broader personal data mapping efforts.

3. Support privacy-conscious BYOD management

Use Android Enterprise Work Profiles and Apple User Enrollment, where supported, to separate managed work data from personal data. These configurations help organizations manage corporate resources while limiting administrative access to personal content.

4. Support secure device offboarding

Remove managed work data from supported employee-owned devices or initiate remote wipes for applicable corporate-owned devices. These capabilities help IT teams securely offboard devices, remove organizational data, and reduce the risk of unauthorized access after a device is retired or reassigned.

5. Strengthen endpoint security controls

Configure supported BitLocker and FileVault encryption policies, application restrictions, and device security settings. Scalefusion OneIdP supports configurable access policies for compatible SSO-integrated applications, helping IT teams manage application access based on supported device and security conditions.

6. Identify and remediate endpoint vulnerabilities

Veltar vulnerability management software helps identify known vulnerabilities in OS and applications across managed Windows and macOS devices. Using indicators such as CVSS, EPSS, and KEV, IT admins can prioritize remediation, initiate supported OS and application patching workflows, and track vulnerability exposure.

7. Manage third-party application risks

Use application management policies to deploy approved business applications and restrict unauthorized applications on supported devices, helping reduce exposure to unmanaged software. Regularly review installed applications and update application policies to address emerging security risks.

8. Improve incident detection and response

Monitor supported device security and compliance signals, review alerts, and apply configured responses to identified violations. These controls can support incident investigation and containment. Maintain records of security events and response actions to support incident reviews and identify areas for improvement.

9. Maintain continuous endpoint compliance monitoring

Scalefusion Veltar helps IT teams assess supported endpoint security configurations and monitor compliance-related signals. IT admins can review identified policy deviations, take supported corrective actions, and use available reports to support internal security assessments.

All these capabilities together help organizations solidify endpoint security and maintain evidence of selected technical safeguards. However, overall DPDP compliance still requires appropriate legal, privacy, governance, and organizational processes.

Improve DPDP readiness with endpoint security

DPDP readiness requires organizations to turn privacy policies into practical security measures. Unmanaged devices, outdated software, and inadequate access controls can increase the risk of personal data breaches and make regulatory compliance more challenging.

As device fleets grow, centralized endpoint management can help IT teams implement and monitor security safeguards consistently. Scalefusion supports this effort through device visibility, encryption policies, application management, and supported BYOD data separation controls. With OneIdP and Veltar, it also helps strengthen access security, vulnerability management, and endpoint compliance monitoring.

While endpoint management alone cannot establish DPDP compliance, Scalefusion helps organizations address important technical safeguards and maintain stronger oversight of their managed devices.