The DPDP Act compliance checklist for engineering teams

Most DPDP write-ups are written for lawyers. This one is for the people who have to ship the code. India's Digital Personal Data Protection Act, 2023 turns into real engineering work in six areas. Here's what each one means and what you actually have to build.

Present a clear notice at the point of collection - itemised, purpose by purpose, available in English and the 22 Eighth-Schedule languages.
Capture purpose-level consent (not one blanket checkbox), with a timestamp and the version of the notice shown.
Make withdrawal as easy as giving consent, and stop the relevant processing when it's withdrawn.
Keep an immutable consent receipt for every grant and withdrawal.

More on this in Consent management under the DPDP Act.

2. Data-principal rights

Users (Data Principals) can ask to access, correct, erase, and nominate, and can raise grievances. You need an endpoint and an SLA for each:

a way to receive the request and verify identity,
a workflow that fulfils it within your stated timeline,
and a record that you did.

The hard one is erasure - see Right to erasure: a developer's guide.

3. Retention & purpose limitation

Don't keep personal data longer than the purpose needs. In practice that means a retention policy per data category and a job that actually enforces it - including the cases where another law (RBI, PMLA, CERT-In) overrides "delete" with "retain". See Erasure when RBI says retain.

4. Deletion that actually completes

A delete isn't done when it leaves your primary database. It has to fan out to analytics, your CRM, search indexes, and backups - and you need confirmation from each. Most teams underestimate this; it's the part that turns a one-line API call into a quarter of work.

5. Security safeguards

The Act requires "reasonable security safeguards," and the penalty for failing to take them is steep (up to ₹250 crore). Encryption, access control, and - critically - a tamper-evident audit trail so you can show what happened to whose data and when. A hash-chained log makes that trail something you can't quietly edit after the fact. See Tamper-evident audit.

6. Breach response

You need to detect a personal-data breach and notify the Data Protection Board and affected users. That's only possible if #5 is in place - you can't report what you can't see.

Where to start

You don't need a platform to begin - the open-source engine runs in your code and handles the deletion, retention and audit pieces locally and free. Start with the Quickstart, then read how Certificates of Erasure turn "we deleted it" into something you can prove.