DPDP Act checklist for developers, with code

1. Notice and consent (Act s.5–6, Rule 3)

• Show an itemised notice before collecting personal data: what you collect, why, and how to withdraw consent.
• Store consent as a record, not a boolean: user, notice version, purposes, timestamp, source, and withdrawal time.
• Make withdrawal as easy as giving consent, and stop the processing that depended on it.
• Don't send personal data to analytics, ads or LLM providers without a purpose the person agreed to.

create table consents (
  id uuid primary key default gen_random_uuid(),
  user_id uuid not null,
  notice_version text not null,
  purposes text[] not null,
  granted_at timestamptz not null default now(),
  withdrawn_at timestamptz
);

2. Security safeguards (Act s.8(5), Rule 6)

• Encrypt personal data at rest and in transit; never accept plain-HTTP endpoints for it.
• Keep secrets out of code and repositories.
• Mask identifiers such as Aadhaar, PAN and card numbers before they are stored or logged.
• Log access to personal data and keep those logs for at least a year — without logging the personal data itself.

// Bad: personal data in logs
logger.info("signup", { email: user.email, phone: user.phone });

// Good: log a pseudonymous id
logger.info("signup", { userId: user.id });

3. Breach notification (Act s.8(6), Rule 7)

• Detect: alert on unusual access to tables and buckets holding personal data.
• Notify affected people and the Data Protection Board without delay.
• Send the Board a detailed report within 72 hours: what happened, data affected, likely impact, what you did and will do.
• If CERT-In's directions also apply to you, its separate 6-hour cyber-incident reporting window still runs.

4. Retention and erasure (Act s.8(7), Rule 8)

• Give every personal data store a retention period tied to its purpose.
• Run scheduled erasure jobs, and include backups and analytics copies.
• Where a fixed retention period applies, tell the person at least 48 hours before erasing.

5. Data principal rights (Act s.11–14, Rule 14)

• Self-serve export of a person's data and account deletion.
• A published way to raise grievances, answered within at most 90 days.
• Correction of inaccurate data, and nomination of another person to exercise rights.

6. Children's data (Act s.9, Rule 10)

Get verifiable consent from a parent or guardian before processing data of anyone under 18, and don't track, behaviourally monitor or target advertising at children.

7. Enforce it in CI

Run the checks on every pull request so regressions never merge:

- run: npx -y @rulefix-ai/cli scan --framework dpdp --fail-on high --format sarif --output rulefix.sarif
- uses: github/codeql-action/upload-sarif@v3
  with:
    sarif_file: rulefix.sarif

This guide explains engineering work, not legal advice. Dates are counted from the Rules' notification on 13 November 2025; confirm them against the official Gazette text and your counsel, as MeitY may amend the timeline.

FAQ