DPDP-ready in four steps: a checklist that avoids panic
You do not have to rebuild your business to prepare for the DPDP Act. Four practical steps, in order, will cut most of your exposure before 13 May 2027.
Getting ready for the DPDP Act does not mean rewriting your business overnight. The main duties start on 13 May 2027, so there is time to do it in a sensible order. These four steps cover most of the ground.
Step 1: find where your data lives
Make a simple list of where customer information enters your business: website forms, spreadsheets, billing software, email folders. For each, note what you collect and why. If you hold records of customers you have not dealt with in years and have no reason to keep, delete them safely.
Step 2: clean up your consent notices
Rewrite your forms in plain language. Say exactly why you need each item, and make marketing permissions optional and unticked. Add how to withdraw consent, how to use their rights and how to complain to the Data Protection Board.
Step 3: lock down your tools
Turn on two-factor authentication on your email, accounting and banking accounts. Stop sharing passwords on notes or chat. Make sure only the people who need customer lists can open them, and keep backups.
Step 4: set up a contact point
Publish a clear contact (for example an email address on your website and receipts) for questions about data. When someone asks to see, correct or delete their records, answer promptly and keep a note of what you did.
Why this matters
These steps do not guarantee compliance, but they show that you took reasonable care, which helps if questions are ever raised. They also give your clients and customers a reason to trust you.
Simple rule: find your data, delete old clutter, turn on two-factor authentication, and give people a quick way to reach you.
Take the free DPDP check to see which of these gaps matter most to you, and what to do about them first.
General information, not legal advice. Check the Act and Rules before relying on it.