India’s Digital Personal Data Protection Act, 2023 (DPDP Act) applies to any organisation that processes digital personal data in India, and to processing outside India connected with offering goods or services to people in India. If your SaaS product has Indian users or customers, it almost certainly applies to you.
This checklist turns the Act into engineering and operational tasks. It is general information, not legal advice. Confirm interpretation with your counsel.
1. Know what personal data you hold
You cannot protect, explain or delete data you have not mapped.
- List every place personal data lives: production database, analytics, logs, backups, support tools, spreadsheets, email
- Record for each: what data, why you collect it, who can access it, where it is stored, how long you keep it
- List every vendor (processor) that touches the data, and confirm you have a contract with each
2. Notice and consent
- Show a clear notice at the point of collection: what you collect, why, and how to withdraw consent or complain
- Make withdrawing consent as easy as giving it, and make sure your systems actually stop processing when it is withdrawn
- Where you rely on a “legitimate use” instead of consent, document which one and why
3. Reasonable security safeguards
The Act requires data fiduciaries to take reasonable security safeguards to prevent personal data breaches. The DPDP Rules describe what that includes. In engineering terms:
- Encryption, obfuscation or masking of personal data, at rest and in transit
- Access control: least privilege, multi-factor authentication for admin and production access
- Logging and monitoring of access to personal data, with logs retained so incidents can be investigated
- Backups that are tested, so data can be restored after an incident
- Contracts with processors that require the same safeguards
Failing to take reasonable security safeguards carries the Act’s highest penalty, up to ₹250 crore.
4. Breach response
- Write a breach runbook: who decides, who investigates, who notifies
- Prepare templates for intimation to the Data Protection Board of India and to affected users
- Rehearse it once. The first time you run the process should not be during a real breach
5. Retention and erasure
- Set a retention period for each data category, tied to its purpose
- Build deletion jobs (including in backups and logs where practical) and a way to handle erasure requests
- Erase data once the purpose is served, unless another law requires you to keep it
6. Rights and grievances
- Publish a contact for questions and grievances
- Build an internal process to handle access, correction and erasure requests within the required timelines
7. Timelines
The Digital Personal Data Protection Rules, 2025 were notified in November 2025, with most obligations phased in over the following 18 months. That is less time than it sounds if your data is spread across many systems.
Where to start
Start with the data map (step 1) and a security risk assessment of the systems on it. Every other step depends on knowing where the data is and how well it is protected.
If you want help, our DPDP Act readiness work does exactly this: map the data, assess the safeguards and implement the fixes.
General information, not legal advice.