Loading…
Loading…
Get audit-ready for India's data protection law before May 2027
DPDPA enforcement deadline: May 2027 — Penalties up to ₹250 crore per violation. Full enforcement begins once the government notifies the Data Protection Board and Rules come into force.
Based on annual turnover — determines your compliance tier.
Do you process personal data of users under 18?
Triggers verifiable parental consent requirements (Section 9)
Do you process health, financial, or government ID data?
May trigger Significant Data Fiduciary obligations (Section 10)
Is your organisation a government entity or instrumentality?
Certain exemptions and obligations differ for government bodies
Do you use automated decision-making that affects individuals?
Algorithmic transparency obligations may apply (SDF)
Do you transfer personal data outside India?
Cross-border transfer restrictions apply (Section 16)
Generated at wowhow.cloud/tools/dpdpa-compliance-checklist — For reference only. Not legal advice.
Need production-ready finance templates?
Invoice generators, GST calculators, and accounting spreadsheets built for Indian businesses. Starting at $4.
Browse Finance TemplatesRecommended partners
India's Digital Personal Data Protection Act 2023 — with Rules notified in November 2025 — creates a comprehensive compliance framework for every business that processes personal data of Indian residents. Unlike earlier IT Act data protection rules, DPDPA introduces structured consent requirements, individual rights enforcement, breach notification timelines, and penalties up to ₹250 crore per violation. This checklist generator tailors the compliance requirements to your specific business profile so you can prioritise the highest-risk gaps before the May 2027 enforcement deadline.
Answer six classification questions about your business — size (turnover-based), whether you process children's data, health/financial/government ID data, and whether you transfer data outside India. The tool maps your answers to the applicable compliance tier: all entities must address Consent & Notice (Section 6), Data Principal Rights (Sections 11-14), and Data Security (Section 8). Entities processing children's data must add parental consent verification (Section 9). Large enterprises or those processing sensitive categories may be designated Significant Data Fiduciaries, triggering additional obligations including a DPO appointment, DPIAs, and annual audits.
Each checklist item shows the relevant DPDPA section reference and a plain-English explanation of what compliance looks like in practice. The RAG (Red/Amber/Green) status per section lets you quickly identify which areas need the most urgent attention. The penalty exposure estimate provides a directional sense of regulatory risk based on your current completion ratio — not a legal assessment.
A Series A fintech startup building a lending app for Indian consumers — needs consent flows, data principal rights portal, security controls, and processor agreements with cloud providers before launch.
A SaaS company based in the US that processes personal data of Indian users — DPDPA applies extraterritorially; cross-border transfer restrictions and DPB notification requirements must be assessed.
An e-commerce platform with a kids' shopping category — must implement verifiable parental consent and remove any behavioral advertising targeting minors.
An HR tech platform processing employee health and biometric data — likely to be notified as an SDF; must prepare for DPO appointment, DPIA, and annual audit cycle.
A D2C brand doing quarterly compliance audits — uses the checklist as a structured self-assessment framework before engaging legal counsel for formal verification.
Scope note: This tool reflects DPDPA 2023 and Rules 2025 as publicly available. Specific SDF threshold notifications, whitelist of approved cross-border transfer countries, and DPB enforcement procedures are pending government notification as of April 2026. This checklist does not substitute for legal advice. Consult a qualified data protection attorney for formal compliance assessment, especially for SDF classification, DPIA scope, and cross-border transfer approvals.
Disclaimer: This calculator is for informational and educational purposes only and does not constitute financial, tax, or legal advice. Results are estimates based on publicly available tax slabs and formulas. Consult a qualified Chartered Accountant, tax professional, or financial advisor for guidance specific to your situation. Built and maintained by the WOWHOW Team with 14+ years of software development experience.
Answer 6 classification questions — business size, data types, children's data, cross-border transfers
Get a tailored checklist covering Consent & Notice, Data Principal Rights, Security, and more
Check off completed items to track your compliance progress in real time
Download or print your checklist as a PDF for team review or legal counsel
About the DPDPA Compliance Checklist Generator
The Digital Personal Data Protection Act 2023 (DPDPA) is India's comprehensive data protection law, passed in August 2023. The accompanying Rules were notified on 13 November 2025 with a phased timeline: consent-manager provisions take effect 13 November 2026 (12 months), and full enforcement — including consent compliance deadlines — begins 13 May 2027 (18 months). All entities processing personal data of Indian residents, including foreign companies, must comply.
The Central Government will designate certain entities as Significant Data Fiduciaries (SDFs) based on volume of data processed, sensitivity, potential risk, national security impact, or public order. SDFs face additional obligations: appointing a Data Protection Officer (DPO), conducting Data Protection Impact Assessments (DPIAs), annual audits, and algorithmic transparency. Large enterprises and those processing health/financial data are most likely to be notified as SDFs.
The DPDPA prescribes penalties up to ₹250 crore per violation. The Schedule to the Act lists specific amounts: failure to implement security safeguards = up to ₹250 crore; breach notification failure = up to ₹200 crore; children's data violations = up to ₹200 crore; non-compliance with DPB directions = up to ₹150 crore. Penalties are imposed by the Data Protection Board after adjudication.
Yes. Section 3 gives DPDPA extraterritorial application — it applies to processing of personal data of Indian data principals regardless of where the processing entity is located. Foreign companies offering goods or services to Indian residents or profiling them must comply.
A Data Fiduciary is an entity that determines the purpose and means of processing personal data — equivalent to a "data controller" under GDPR. A Data Processor processes data on behalf of a fiduciary under a contractual arrangement, without independently determining purpose. Most businesses are Data Fiduciaries. Cloud providers, payment processors, and analytics vendors are typically Data Processors.
No. Section 7 lists "Certain Legitimate Uses" as an alternative to consent — these include processing necessary for state functions, compliance with legal obligations, responding to medical emergencies, employment-related processing, and public interest activities. However, for most commercial data processing, consent remains the primary lawful basis.
How many hours of work does GTA 6, an iPhone or a PS5 cost you?
Open →Finance & Businessupi:// link + QR + GPay/PhonePe/Paytm buttons
Open →Finance & BusinessGST-compliant PDF invoice in 60 seconds — no signup
Open →Finance & BusinessFind exact take-home from CTC — FY 2026-27, no signup
Open →