The working checklist
Data inventory — know what personal data your organisation actually processes.
Purpose mapping — document why each category of data is processed.
Consent — review how it's obtained, recorded, and withdrawn.
Privacy notices — make sure they clearly communicate what's required.
Data processors — identify every third party processing data on your behalf.
Contracts — review the agreements and safeguards you have with them.
Security — review your technical and organisational safeguards.
Retention — know how long you keep each category of data, and why.
Data subject requests — have a process for access, correction, updating, and erasure requests.
Grievances — establish a way to handle privacy-related complaints.
Breach response — have a process for identifying, containing, and responding to breaches. See Data Breaches.
Children's data — determine whether you process any, and what that means. See Children's Data.
Governance — assign clear responsibility for privacy inside your organisation.
Start with a snapshot
Not sure where your organisation actually stands against this list? The DPDP Audit walks through it in a few minutes and flags where you may have gaps.