DPDP Checklist for Founders and Developers: From Data Map to Device Disposal

Founders and developers usually meet the DPDP Act through a privacy policy template. The Act asks for more than that, and the 13 May 2027 deadline for most obligations is closer than a typical product roadmap. This checklist is ordered the way a small team can work through it.

Know what you hold

• List every place personal data lives: production databases, analytics, CRM, support tools, spreadsheets, backups, logs and laptops.
• Note why you collect each field and whether you need it. Data you do not collect cannot leak.
• Mark anything about children. Under the Act, anyone under 18 is a child and needs verifiable parental consent.

Build it in

• Encrypt data at rest and in transit, and turn on full-disk encryption on every laptop.
• Restrict access by role, and log access to personal data.
• Keep logs and personal data for at least one year, as Rule 8(3) requires, then erase what you no longer need.
• Build deletion that actually deletes, including from backups on a defined schedule.
• Keep test and staging environments free of real personal data.

People, vendors and contracts

• Every SaaS tool or contractor that touches personal data for you is a Data Processor. Put security terms in the contract, as Rule 6 expects.
• Publish the business contact of a person who can answer privacy questions, as Rule 9 requires.
• Publish your grievance process and a response time of no more than 90 days, as Rule 14 requires.
• Offboard leavers the same day: accounts, tokens, devices.

When something goes wrong

• Write down who decides a breach has happened, who informs affected users, and who informs the Data Protection Board.
• Rule 7 expects notice without delay and a fuller report to the Board within 72 hours of becoming aware.
• Practise it once. A lost laptop is a good scenario.

Retiring devices and systems

• Keep a simple register of laptops, phones and servers, with who holds them.
• When a device leaves, check retention first, then wipe with verification or destroy the drive.
• Get a report per drive from whoever does it, and keep it with the register.
• Do not sell company laptops to employees or buyers without a verified wipe.
• When you shut down a cloud system, export what you must keep, then delete the rest and keep the deletion record.

If you need the last step done for you, certified data wiping gives you a report per drive, and small lots are fine.