DPDP Act 2023 Compliance Checklist for Indian MSMEs

India's Digital Personal Data Protection (DPDP) Act 2023 has completely shifted how businesses handle user data. Under the Act, any business that collects customer names, phone numbers, addresses, or billing records digitally is designated as a Data Fiduciary and is legally responsible for securing that data.

Unlike other global regulations that exempt smaller businesses, the DPDP Act applies directly to MSMEs, startups, clinics, and e-commerce brands in India. Non-compliance or failure to install reasonable security safeguards to prevent leaks carries direct statutory penalties of up to ₹250 Crore.

1. Implement Consent Architecture

Under Section 6 of the DPDP Act, data collection must be accompanied by an itemized, clear, and unambiguous notice. If your website collects contacts via enquiry forms, subscription boxes, or checkouts, you must display a consent notice explaining what data is being collected and the exact purpose (e.g., to send newsletter notifications or call back for audits).

2. Appoint Data Fiduciary Representatives

You must designate an internal representative or a grievance officer to handle queries from your users (designated as Data Principals). The contact details of this representative must be listed inside your Privacy Policy.

3. Establish Data Erasure Workflows

Users have the legal right to withdraw consent and demand that you erase all their stored personal data. Your IT systems must support complete database erasure workflows to delete customer profiles upon verification of withdrawal requests.

4. Install Technical Safeguards

Section 8 of the DPDP Act demands that you take necessary technical measures (like data encryption, secure databases, regular penetration testing, and access logs) to prevent data leaks. If a data breach occurs and audits reveal that you failed to perform standard security assessments (like VAPT), you face severe penalties.

Quick DPDP Compliance Checklist:

• Publish a comprehensive, DPDP-compliant Privacy Policy on your website.
• Add tickable consent checkboxes to all lead submission forms.
• Maintain an encrypted register of data collections and consents.
• Verify that third-party vendors (like cloud hosts or email tools) are compliant.
• Conduct a baseline web vulnerability check using the Securastra scanner.