Guides

DPDP Compliance Checklist 2026: Act, Rules & Fines

Written by

Alefiyah Bhatia

Growth Marketing Specialist

Reviewed by

Vinay Goel

CEO & Co-founder

Last updated

October 30, 2026

Mins Read

Table of Contents

Still relying on traditional DLP for AI?

There's a better way.

Semantic Understanding

Real Time Inline Action

Dynamic Policy Engine

Get A Free POC

Trusted by 55+ regulated organizations

What it is: India's Digital Personal Data Protection Act, 2023, made operational by the DPDP Rules, 2025, notified on 13 November 2025.
Who must comply: Any organisation processing digital personal data of people in India, including foreign companies serving Indian customers.
What is enforceable now: The Data Protection Board is established. Core duties on notice, consent, security and breach reporting apply from 13 May 2027.
Fines: Set per instance in the Schedule to the Act, with the highest cap reserved for security failures that lead to a breach.
Biggest blind spot: Employees pasting customer or employee personal data into ChatGPT, Gemini or Copilot, often through shadow AI tools IT never approved.
How Wald helps: Wald AI DLP detects personal data on the device before it reaches any AI tool, applies allow, warn or block policies, and logs AI usage for audits.

‍

AI-Native DLP and the Future of Enterprise AI Security

An executive whitepaper on how AI-Native DLP differs from legacy DLP, and what it means for enterprise security strategy.

Download Whitepaper

What DPDP compliance means

DPDP compliance means processing the digital personal data of people in India lawfully, for a stated purpose, with valid consent or a recognised legitimate use, and with reasonable security safeguards in place. The Digital Personal Data Protection Act, 2023 set the principles. The DPDP Rules, 2025 supplied the mechanics: what a notice must say, how consent is recorded, how fast a breach must be reported, and what logs you must keep.

For most of the last two years, DPDP was a "wait and see" law. That ended when the Ministry of Electronics and Information Technology (MeitY) notified the Rules in November 2025. If your company handles personal data of customers or employees in India, the clock is already ticking, and that data now flows through more places than most data maps show, including AI tools covered by no prompt security controls.

This guide covers who the law applies to, what is enforceable today, the fines, a practical DPDP compliance checklist, and the risk most compliance programmes still miss: employees pasting personal data into generative AI tools, the pattern behind a growing record of ChatGPT data leaks and security incidents.

Who the DPDP Act applies to

The Act applies to any organisation that processes digital personal data in India, whether the data was collected digitally or digitised later. Start by mapping your business against the four roles the law defines.

Role	Who it is	What the law expects
Data Principal	The individual the data is about; a parent or lawful guardian for anyone under 18	Can exercise rights to access, correction, erasure, grievance redress and nomination
Data Fiduciary	The organisation that decides why and how personal data is processed	Accountable for compliance, including the work of its processors
Data Processor	A party processing data on a fiduciary's behalf, such as a cloud host, CRM or contracted AI provider	Acts only under a valid contract with the fiduciary
Significant Data Fiduciary (SDF)	A fiduciary notified by the government based on data volume, sensitivity and risk	India-based Data Protection Officer, independent data auditor, periodic DPIAs and audits

DPDP enforcement status and fines

The DPDP Act is in force and the Data Protection Board of India now exists, but most obligations on businesses apply from 13 May 2027. Here is where each part of the law stands as of October 2026.

Provision	What it covers	Status
Data Protection Board of India	Constitution, functioning and digital office of the regulator (Rules 1, 2, 17–21)	In force since 13 November 2025; members being appointed
Consent Managers (Rule 4)	Registration and duties of platforms that let individuals manage consent	Applies from 13 November 2026
Core fiduciary duties (Rules 3, 5–16, 22, 23)	Notice, consent, security safeguards, breach reporting, retention, children's data, SDF duties, data principal rights	Applies from 13 May 2027
IT Act SPDI Rules, 2011	India's earlier sensitive personal data rules	Still apply until the DPDP duties take over

Fines are set in the Schedule to the Act and imposed by the Board, per instance of non-compliance.

Failure	Maximum fine
Not taking reasonable security safeguards to prevent a personal data breach	₹250 crore
Not notifying the Board or affected individuals of a breach	₹200 crore
Not meeting obligations for children's data	₹200 crore
Not meeting additional SDF obligations	₹150 crore
Breaching any other provision of the Act or Rules	₹50 crore
Breach of duties by a Data Principal	₹10,000

When setting a fine, the Board weighs the nature, gravity and duration of the breach, any gain or loss caused, and the steps taken to mitigate it. Documented controls are the strongest mitigation you can bring. Source: KS&K, August 2026.

The DPDP compliance checklist

Use these ten steps to move from "aware of DPDP" to "ready to be audited." They are ordered by dependency: you cannot write a valid notice for data you have not found.

#	Step	What to do
1	Map your personal data	List every category you collect, why, where it is stored, who can access it, and which systems and vendors touch it. Include support tickets, spreadsheets and AI chat histories.
2	Confirm the lawful basis	Tie each purpose to consent or one of the Act's limited legitimate uses, such as employment or a legal obligation. There is no broad "legitimate interest" basis.
3	Rewrite your notices	Make each notice standalone and in plain language. Itemise the data and purpose, and explain how to withdraw consent and complain to the Board. Offer English or any of the 22 Eighth Schedule languages.
4	Rebuild consent	Consent must be free, specific, informed, unconditional and unambiguous, given by a clear affirmative action. Withdrawal must be as easy as giving it. Keep records you can produce on demand.
5	Plan for Consent Managers	If users manage consent through a registered Consent Manager, your systems must receive and honour those signals, including withdrawals.
6	Apply reasonable security safeguards	Use encryption, masking or obfuscation, access controls and access monitoring. Retain logs for at least one year. AI security controls belong here too.
7	Build a 72-hour breach process	Notify affected individuals and the Board without delay. File a detailed report with the Board within 72 hours of becoming aware. Rehearse it.
8	Set retention and deletion rules	Erase personal data once the purpose is served or consent is withdrawn, and require processors to do the same.
9	Update processor contracts	Every vendor handling personal data for you needs DPDP-aligned terms on security, breach reporting and deletion. That includes AI providers, where even enterprise accounts can leave compliance gaps.
10	Handle rights and grievances	Publish a contact point and a process for access, correction, erasure and nomination requests. Possible SDFs should start hiring an India-based DPO.

Where generative AI creates DPDP exposure

Every prompt that contains personal data is processing under DPDP, and most compliance programmes have no record of it. A support agent pastes a customer complaint into ChatGPT to draft a reply. A recruiter uploads a CV to Gemini to summarise it. An analyst drops a customer export into Copilot to find churn patterns. Each one moves an Indian Data Principal's personal data to a third party.

Risk	What happens	DPDP obligation at stake
Purpose drift	A customer consented to support, and their data is now with an AI provider you never assessed	Purpose limitation and consent
Unmanaged processors	A consumer AI account has no contract covering security, retention or deletion	Processor contracts and accountability
Silent breaches	Personal data sent to an unsanctioned AI tool can be an unauthorised disclosure, which counts as a personal data breach	72-hour breach reporting and security safeguards

Banning AI tools outright does not fix this. Employees move to personal devices and accounts, and the risk becomes invisible. Legacy DLP does not fix it either, because pattern matching misses personal data written in natural language, like "the patient in bed 4 is Ravi's mother." That is the gap context-aware DLP is built to close.

How Wald AI DLP helps

Wald AI DLP is a data loss prevention layer built for employee use of generative AI. It runs as an on-device agent and maps directly to the safeguards DPDP expects.

Wald AI DLP capability	What it does	DPDP requirement it supports
Real-time detection on the endpoint	Inspects prompts and file uploads for PII, PHI, customer data and financial records before they reach ChatGPT, Claude, Gemini or Microsoft Copilot	Reasonable security safeguards
Context-aware engine	Understands what an employee is trying to share, so it catches personal data that regex rules miss while keeping false positives low	Reasonable security safeguards
Allow, warn or block policies	Applies the action your policy sets for each AI interaction: allow it, warn the employee in the moment, or block it before it leaves the device	Security safeguards; purpose limitation
Zero data retention (ZDR)	Detection runs on the device, and Wald operates under a zero data retention policy, so it never becomes another store of your business data	Data minimisation; retention limits
AI usage visibility	Shows which AI tools are in use, including shadow AI, and which policies fired	Access monitoring, log retention, breach investigation
Single policy layer	Works alongside existing DLP and security tools across multiple AI providers	Consistent controls over third-party processing

For teams that would rather give employees a sanctioned AI workspace than govern the tools they already use, Wald also offers the Wald LLM Pack. It brings ChatGPT, Claude, Gemini and other leading models into one interface, sanitises sensitive values in prompts before they reach the model provider, and runs under the same zero data retention policy.

No single tool makes an organisation DPDP compliant. Wald closes the AI gap in checklist steps 1, 6, 7 and 9: knowing where personal data flows, protecting it, detecting leaks and controlling third-party AI processing. See how Wald AI DLP works.

DPDP vs GDPR

DPDP is narrower than GDPR in scope but stricter on consent and children's data. Indian companies with EU customers can reuse much of their GDPR programme. For how GDPR treats personal data in AI prompts, see Is generative AI compliant with GDPR?

Area	India DPDP	EU GDPR
Scope	Digital personal data only	All personal data
Lawful bases	Consent + limited legitimate uses	Six bases, including legitimate interest
Sensitive data category	None defined	Special categories with extra rules
Children	Under 18; verifiable parental consent	Under 16 (member states may lower to 13)
Breach reporting	Board within 72 hours; individuals without delay	Authority within 72 hours; individuals if high risk
Fine model	Fixed cap per instance, set in the Schedule to the Act	Percentage of global annual turnover

If you already run a GDPR programme, reuse your data map, DPIAs and breach playbook. Rework consent (there is no legitimate-interest basis), notices (language options) and children's data (the age is 18).

‍

Frequently Asked Questions

What is DPDP compliance?

DPDP compliance means meeting the obligations of India's Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025. The core duties are lawful processing based on consent or a legitimate use, clear notices, reasonable security safeguards, breach reporting, and honouring data principal rights.

Is the DPDP Act in force?

Yes, in phases. The Act and the first Rules took effect on 13 November 2025. Consent Manager provisions start on 13 November 2026. Most operational obligations start on 13 May 2027.

Does the DPDP Act apply to companies outside India?

Yes, if they process personal data of people in India in connection with offering goods or services to them. A foreign company does not need an Indian office to be a Data Fiduciary under the Act.

What is a Data Fiduciary under the DPDP Act?

A Data Fiduciary is any person or organisation that decides the purpose and means of processing personal data. It is accountable for compliance, including for the work of its Data Processors.

What is a Consent Manager under the DPDP Act?

A Consent Manager is an India-incorporated entity registered with the Data Protection Board. It runs an interoperable platform where individuals give, review and withdraw consent across fiduciaries. Most businesses will integrate with Consent Managers, not become one.

What is the penalty for violating the DPDP Act?

Penalties go up to ₹250 crore per instance for failing to prevent a personal data breach, and ₹200 crore for failing to report one. Other breaches carry up to ₹50 crore.

How is DPDP different from GDPR?

DPDP covers only digital personal data, has no legitimate-interest basis, does not define a sensitive data category, and treats everyone under 18 as a child. GDPR's fine is turnover-based, while DPDP sets fixed caps per instance.

Does using ChatGPT or other AI tools create DPDP risk?

Yes. Personal data entered into an AI tool is processed by that provider. Without contracts, controls and logs, it can amount to unauthorised disclosure. AI DLP tools such as Wald detect personal data in prompts and apply allow, warn or block policies before it leaves the employee's device.‍