Readiness checklist
Tick off what your app already does. Each item links to the obligation behind it.
Notice
Consent
Children
Rights and grievances
Security and breaches
Vendors and SDKs
Retention
Common questions
Is the readiness checklist saved?
Your ticks are saved in this browser only, so you can come back to them. Nothing is sent to any server.
Does a full checklist mean my app is compliant?
No. It covers the main obligations for apps as a starting point. Have a qualified lawyer review your setup before 13 May 2027.
When does the DPDP Act apply to apps?
Most obligations for apps, including notice, consent, security, breach notification, children's data and user rights, take effect on 13 May 2027. The Rules were notified on 13 November 2025 with an 18-month phase-in.
What is a Data Fiduciary?
A Data Fiduciary is any person or company that decides the purpose and means of processing personal data. An app that decides what user data to collect and why is a Data Fiduciary.
What is the maximum penalty under the DPDP Act?
The highest penalty in the Schedule is up to ₹250 crore, for failing to take reasonable security safeguards to prevent a personal data breach.
Does the DPDP Act cover data collected before it took effect?
Yes. Where consent was given before commencement, the Act requires a notice to be given as soon as reasonably practicable, and processing can continue until the user withdraws consent.