Describe your business, leave with a checklist you can assign

Processing digital personal data must rest on the Data Principal’s consent (or fall within a statutory legitimate use), with a notice given at or before the request for consent describing the personal data to be processed, the purpose, how to exercise rights and how to complain to the Board. Consent must be free, specific, informed, unconditional and unambiguous, signified by a clear affirmative action, and limited to the personal data necessary for the specified purpose. It may be withdrawn at any time with comparable ease.

Evidence: Consent notice text, including the option of the languages listed in the Act alongside English; Consent and withdrawal records; Mapping of purposes to the data items necessary for them; Records showing downstream processing stopped after withdrawal

A Data Fiduciary must take reasonable security safeguards to prevent a personal data breach, including in respect of data held by its Data Processors. This carries the highest penalty in the Schedule, up to ₹250 crore. In practice it must cover access control, encryption, logging, vendor management and incident exercises, with implementation evidence that can be shown to the Board.

Evidence: Inventory of security safeguards with implementation evidence; Data Processor contracts with the security requirements annex; Access control and log audit records; Incident exercise records

On a personal data breach, the Data Fiduciary must give notice to the Data Protection Board and to each affected Data Principal in the prescribed form and manner. A personal data breach is defined as any unauthorised processing of personal data, or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access, that compromises the confidentiality, integrity or availability of personal data. Failure to notify attracts up to ₹200 crore.

Evidence: Incident response plan including the Indian notification path; Record of the notice filed with the Board; Notice text to affected Data Principals and proof of dispatch; Assessment record characterising the incident as a breach

AI incident and serious incident reporting record (register plus report drafts)

Processing the personal data of a child, or of a person with disability whose lawful guardian acts on their behalf, is subject to the additional obligations in s.9. Breach attracts up to ₹200 crore, the same tier as the breach-notification duty, reflecting India’s emphasis on minors’ data. AI products for education, gaming, social or companionship use targeting India need age assurance and guardian-consent mechanisms.

Evidence: Description of the age-assurance mechanism with accuracy evaluation; Guardian consent records; Description of feature restrictions and default settings for children; Item-by-item compliance checklist for s.9

The Central Government may notify a Data Fiduciary or class of Fiduciaries as a Significant Data Fiduciary based on factors including the volume and sensitivity of personal data processed, risk to Data Principals’ rights, potential impact on the sovereignty and integrity of India, risk to electoral democracy, security of the State and public order. A Significant Data Fiduciary must: appoint a Data Protection Officer who is based in India, is responsible to the board of directors or similar governing body, represents the Fiduciary under the Act and is the point of contact for the grievance redressal mechanism; appoint an independent data auditor to evaluate compliance; and undertake other measures including periodic Data Protection Impact Assessments. Breach of s.10 attracts up to ₹150 crore.

Evidence: DPO appointment documents evidencing India-based status and reporting line; Independent data auditor engagement letter and audit report; Periodic Data Protection Impact Assessment reports; Records of the grievance redressal mechanism in operation

Section 16(1) empowers the Central Government to restrict, by notification, the transfer of personal data by a Data Fiduciary for processing to a country or territory outside India that it notifies. Section 16(2) preserves any Indian law providing a higher degree of protection or a stricter restriction on transfer — so sector rules such as financial and payments data-localisation requirements continue to prevail. Companies should monitor such notifications and keep the data architecture capable of switching the processing location away from a restricted country.

Evidence: Cross-border data flow inventory and processing-location register; Monitoring mechanism and review records for s.16 notifications; Applicability analysis of sectoral localisation rules in finance, payments and health; Processing-location switchover plan and rehearsal records

Open tool: Transfer Matrix

A Data Fiduciary must establish an effective grievance redressal mechanism and publish the means of contacting it so that Data Principals can complain about performance of the Act’s obligations, and must ensure that personal data is accurate, complete and consistent where it is used to make a decision affecting the Data Principal or is disclosed to another Data Fiduciary. In AI contexts, automated decisions based on inaccurate profiles are the paradigm risk under this duty.

Evidence: Published grievance channel and internal response-time rules; Grievance register with closure records; Data accuracy validation rules and execution logs; Inventory of data fields used in decisions and their refresh mechanism