The DPDP Shield: 47 Points to Readiness

Have you identified all personal data processing activities?

Have you appointed a Data Protection Officer (DPO) or designated grievance officer?

Is your DPO contact information publicly available?

Have you documented your data retention schedule?

Have you established a grievance redressal mechanism?

Is your grievance response timeline defined (target: within 90 days)?

Have you conducted a Data Protection Impact Assessment (DPIA) for high-risk processing?

Have you registered as a Significant Data Fiduciary (if applicable)?

Is consent obtained through clear affirmative action (no pre-ticked boxes)?

Is consent granular (separate consent for each processing purpose)?

Is your privacy notice available before consent is requested?

Does your privacy notice specify: what data, why, how long, and with whom?

Is the privacy notice available in English and relevant regional languages?

Can users withdraw consent as easily as they gave it?

Do you maintain a tamper-evident consent audit trail?

Have you implemented parental consent mechanisms for children’s data?

Do you re-notify users when processing purposes change?

Have you reviewed retrospective notices for pre-Act data?

Can users access their personal data within a defined timeframe?

Can users request correction of inaccurate data?

Can users request erasure (right to be forgotten)?

Can users nominate another person to exercise rights on their behalf?

Is there a simple, public mechanism for rights requests?

Are rights requests tracked and responded to within statutory timelines?

Is there a process for handling frivolous or vexatious requests?

Are data principal rights communicated clearly in your privacy notice?

Have you implemented “reasonable security safeguards” for personal data?

Is personal data encrypted at rest and in transit?

Do you have access controls based on the principle of least privilege?

Is there a personal data breach notification protocol?

Can you notify the Data Protection Board within prescribed timelines?

Do you have business continuity and disaster recovery plans for personal data?

Have you conducted penetration testing on systems processing personal data?

Have you identified all third-party processors (cloud, analytics, payments)?

Do you have Data Processing Agreements (DPAs) with all processors?

Are cross-border data transfers limited to approved jurisdictions?

Have you notified users of international transfers?

Do you conduct due diligence on processor security practices?

Is there a processor termination and data return/deletion protocol?

Are employees informed about workplace data processing?

Is employee consent obtained for non-essential processing (e.g., monitoring)?

Are ex-employee data retention and deletion policies defined?

Is HR data subject to the same security controls as customer data?

Is your privacy notice dated and version-controlled?

Do you maintain records of processing activities (ROPA)?

Can you demonstrate compliance to the Data Protection Board?

Have you scheduled annual privacy compliance reviews?