DPDP compliance for customer data: a practical checklist for Indian businesses

India's Digital Personal Data Protection (DPDP) Act is now the law every business handling customer data has to answer to. If you run sales, marketing or support, you are a Data Fiduciary — responsible for how personal data is collected, stored, used and deleted. The penalties are real (up to ₹250 crore), but the good news is this: compliance is far less about lawyers and far more about operational discipline you can build into your tools.

Here is a plain-English checklist we walk customers through — the controls that turn “are we compliant?” from an annual panic into a routine part of how your teams already work.

1. Know exactly what personal data you hold

You cannot protect what you cannot see. Start with a data map: every place a name, phone number, email, location or ID lives — your CRM, call recordings, WhatsApp threads, spreadsheets, that one marketing tool nobody owns. Most leaks hide in the shadow stack of disconnected tools. The fewer systems personal data is scattered across, the smaller your risk surface and the simpler every step below becomes.

2. Collect consent you can actually prove

DPDP expects consent that is free, specific, informed and revocable — and, crucially, that you can demonstrate on request. A tick-box with no record is not enough. Capture what the person agreed to, when, and through which channel, and store it against their record. The same applies to marketing: every WhatsApp opt-in, every SMS subscription, every email list needs a timestamped consent trail and a one-tap way to opt out.

3. Keep data where the law expects it

Data residency is no longer a nice-to-have. For many Indian businesses the simplest, safest answer is to keep customer data hosted in India, with clear controls over any cross-border processing. When you evaluate a platform, ask bluntly: where does my data physically live, and who can access it? A vendor that cannot answer precisely is a liability you are inheriting.

4. Give people genuine control over their data

Data Principals (your customers) have the right to access their data, correct it, and have it erased. In practice that means you need to be able to find every record for one person quickly, update it everywhere at once, and delete it cleanly when a valid request comes in. This is painful across five disconnected tools and trivial on a single shared record — which is the real argument for consolidation that most compliance conversations miss.

5. Lock down who can see what

Not everyone in your company should see everything. Field-level privileges, role-based access and an audit trail of who viewed or changed a record are no longer enterprise luxuries — they are how you show a regulator that personal data is handled on a need-to-know basis. If a junior agent can export your entire customer database to a spreadsheet, you have a problem no policy document will fix.

6. Have a breach plan before you need one

DPDP requires you to notify the Data Protection Board and affected individuals in the event of a breach. That is only possible if you have logs showing what was accessed and when. Treat audit trails and session controls not as overhead but as the evidence that protects you when something goes wrong.

Making compliance routine, not a project

Notice the pattern: almost every control above gets dramatically easier when customer data lives on one connected platform instead of scattered across a dozen. One record per customer makes data mapping, access requests and erasure straightforward. Built-in consent logging, India data residency, role-based privileges and audit trails turn DPDP obligations into settings you configure once rather than fire drills you run every quarter.

Office24by7 was built India-first with exactly this in mind — consent captured on every channel, data kept in India, field-level access control and a full audit trail on every record. Compliance stops being a separate workstream and becomes a property of how your teams already operate. See how we handle security and data residency.

This article is practical guidance, not legal advice — confirm your specific obligations with a qualified advisor.