DPDP checklist for 13 May 2027

What comes into force on each date

Rule 1 brings the Rules into force in three steps. Most of the work you will be judged on starts on the last date.

Phase 1: now to 13 November 2026

This phase is about knowing what you hold and who owns it. If you are reading this after 13 November 2026, do these tasks first and compress the rest.

1. 01Name an accountable owner

   Pick one executive to own the DPDP programme, with a working group from legal, security, product and HR. Agree a budget and a weekly check-in.

2. 02Map your personal data

   List the systems, files and SaaS tools that hold digital personal data (s.3), including employee and candidate data. Note which entities and products are in scope.

3. 03List purposes and grounds

   For each use of personal data, record the purpose and whether it rests on consent (s.6) or a legitimate use (s.7). Section 4 allows no other ground.

4. 04List processors and transfers

   Record every vendor that processes personal data for you, and where it does so (s.8(2), s.16).

5. 05Plan for Consent Managers

   Rule 4 comes into force on 13 November 2026. Decide how consent given or withdrawn through a registered Consent Manager will reach your records once any are registered (s.6(7)).

Phase 2: 13 November 2026 to early 2027

Build the processes the May 2027 rules require. Draft first, then review with counsel.

1. 01Write notices

   Draft a privacy notice and consent notices that meet Rule 3 and can be read in English or any Eighth Schedule language (s.5(3)). Plan the notice to people whose data you collected before commencement (s.5(2)).

2. 02Fix consent flows

   Make consent free, specific, informed, unconditional and unambiguous, with a clear affirmative action (s.6). Make withdrawal as easy as giving consent (s.6(4), Rule 3).

3. 03Set up rights and grievances

   Publish how people make requests and the identifier you need, and a grievance response period of no more than 90 days (Rule 14). Publish the contact who answers questions about processing (Rule 9).

4. 04Write the breach playbook

   Plan how you will tell affected Data Principals and the Board without delay, and give the Board a detailed report within 72 hours (Rule 7).

5. 05Close security and retention gaps

   Check the Rule 6 safeguards, including access control, logs kept for one year and backups. Set retention rules so data is erased when its purpose is served (s.8(7), Rule 8).

6. 06Contract your processors

   Put contracts with security terms in place with every processor (s.8(2), Rule 6).

7. 07Handle children's data

   Where under-18s use your service, build verifiable parental consent (s.9(1), Rule 10) and switch off tracking and targeted advertising aimed at them (s.9(3)).

Phase 3: before 13 May 2027

1. 01Publish

   Put the privacy notice, the Rule 9 contact, the request method and the grievance period live on your website and app.

2. 02Send the existing-user notice

   Send notices to people whose data you already hold (s.5(2)) and record who received them.

3. 03Rehearse a breach

   Run a tabletop exercise against the Rule 7 timeline, including who drafts and files the detailed report.

4. 04Test rights requests

   Submit test access, correction, erasure and nomination requests, and check they close well inside your published period.

5. 05Train staff

   Brief customer support, HR and engineering on how to spot a request, a grievance or a breach.

6. 06Assemble the evidence pack

   Collect the artefacts listed below in one place, each with an owner and a date.

Owners by task

Evidence to keep

• Data inventory and records of processing, with the date of the last review
• Purpose register showing consent (s.6) or a legitimate use (s.7) for each purpose
• Every version of your privacy notice and consent notices, with the dates each was live
• Consent and withdrawal logs per person and purpose (s.6(10))
• Proof of the s.5(2) notices sent to existing users
• Published request method, identifier, grievance period and Rule 9 contact
• Request and grievance logs with response dates
• Breach playbook, tabletop records and a detailed-report template (Rule 7)
• Security safeguard records and logs kept for one year (Rule 6)
• Retention rules and erasure logs (s.8(7))
• Signed processor contracts and vendor assessments (s.8(2))

How TruePrivacy helps

TruePrivacy gives you one place to run this checklist. Data discovery finds personal data across databases, cloud storage and SaaS tools and feeds records of processing. The DPDP checklist marks each control compliant, partial or non-compliant from live records, as a readiness view rather than a certification.

Consent management, notices, rights requests and breach management each keep their own records, and the audit trail exports as CSV. Related tools: the readiness quiz and the consent checklist.