DPDP Compliance Checklist Every IT Team Needs in 2026

Our earlier post explained the DPDP Act. This article focuses on the practical steps your IT team can take to prepare.

The 72-hour breach notification clock

Under the DPDP Rules, a personal data breach starts two parallel tracks. When a Data Fiduciary becomes aware of a breach, it must promptly notify every affected Data Principal. The Data Protection Board of India also has to be informed without delay. A detailed report must follow within 72 hours, covering the nature and extent of the breach, its likely impact, mitigation steps and remedial measures.

The organisation is the one that notifies, not the individual who discovered the breach. In practice, though, the IT and security team supplies everything the notice contains: when the breach started, which systems and records were touched, and what has been contained. If your logs, alerting and escalation paths can’t produce those facts within hours, you will miss
the 72-hour window.

What to set up: a written breach runbook with named owners, pre-approved notification templates, and a clear decision path from SOC alert to leadership to legal.

What the DPDP Act actually requires technically

The Rules describe “reasonable security safeguards” in specific terms. IT teams should plan for:

• Encryption, masking, obfuscation or tokenization of personal data, both at rest and in transit
• Access controls that limit who can reach personal data, and on which systems
• Visibility into access through logging, monitoring and periodic review
• Log retention for at least one year, so that unauthorised access can be detected and investigated
• Backups and continuity measures so that processing can continue after an incident
• Contractual safeguards with processors, because your vendors’ security gaps become your compliance gaps

None of this is new security practice. What is new is that it becomes a legal obligation, and you need evidence that it is in place.

DPO appointment: who needs one?

A Data Protection Officer is mandatory for Significant Data Fiduciaries (SDFs). These are organisations the government designates based on the volume and sensitivity of the data they process, the risk to individuals, or wider public-interest factors. An SDF’s DPO must be based in India and is accountable to the board of directors. The DPO is also the main point of contact for grievances. SDFs have further duties as well, including periodic Data Protection Impact Assessments and independent data audits.

Organisations that are not SDFs still have to publish contact details for someone who can answer people’s questions about how their data is processed.
Many mid-market companies will give this role to a privacy lead backed by IT. Either way, someone has to own it.

A practical DPDP compliance checklist IT teams can act on this quarter

1. Map your personal data. Record where it is collected, stored, processed and shared, including shadow IT and SaaS tools.
2. Classify and minimise. Delete data you no longer need. Reducing unnecessary data reduces the amount of personal information
   that could be exposed in a breach.
3. Encrypt and tokenize. Prioritise databases, endpoints, backups and file shares that hold customer or employee data.
4. Fix your logging. Centralise logs, protect them from tampering and keep them for at least a year.
5. Tighten access. Enforce MFA, apply least privilege and review access for privileged accounts quarterly.
6. Write and test the breach runbook. Run at least one tabletop exercise against the 72- hour clock.
7. Audit your vendors. Update processor contracts with security and breach-reporting clauses.
8. Build erasure workflows. Make sure data can be traced and deleted when consent is withdrawn or the purpose ends.
9. Assign ownership. Name a DPO if you are an SDF, or a privacy contact if you are not, and make sure IT can support them.
10. Document everything. Under DPDP, controls you cannot evidence are treated as controls you do not have.

DPDP Act penalties: what’s at stake

The DPDP Act sets penalties by category, and they are among the highest in Indian regulation:

• Up to ₹250 crore for failing to take reasonable security safeguards to prevent a breach
• Up to ₹200 crore for failing to notify the Board and affected individuals of a breach
• Up to ₹200 crore for breaching obligations related to children’s data
• Up to ₹150 crore for SDFs that fail their additional obligations
• Up to ₹50 crore for other breaches of the Act or Rules

These amounts apply per instance. A single incident can therefore lead to more than one penalty, for example both inadequate safeguards and late notification. Penalties are also only part of the cost. Reputational damage, lost customer trust and the cost of investigation can easily exceed the fine.

How fluidPro’s Managed Security Operations supports DPDP readiness

Most mid-market IT teams already know what DPDP requires. The harder part is running 24×7 monitoring, keeping a year of searchable logs, and responding to a breach within 72 hours while also running day-to-day IT.

fluidPro Managed Security Operations by Wepsol is built to close that gap:

• 24×7 monitoring and threat detection so breaches are spotted early, before the notification clock is already running short
• Centralised log management designed around retention and investigation requirements
• Incident response support that gathers the facts your Board notification needs
• Endpoint, identity and access hardening across devices, users and cloud workloads
• Compliance-ready reporting that gives your DPO, auditors and leadership evidence rather than assurances

You remain accountable for compliance. fluidPro gives your team the operational capability to meet those obligations.

Request a DPDP compliance gap check

The 13 May 2027 deadline is closer than it looks, and remediation takes time. Talk to the fluidPro team about a DPDP compliance gap check. The proposed gap check would review your logging, encryption, access controls and incident readiness against the applicable Rules, then identify prioritised next steps.

Request your DPDP compliance gap check →