DPDP Startup Readiness Checklist

Section 1: Data collection visibility

1. List all major points where personal data enters the business
2. Map signup, forms, onboarding, checkout, support, CRM, analytics, and marketing systems
3. Identify which data fields are actually collected in each workflow
4. Document which teams and vendors can access that data

Section 2: Notice and consent quality

1. Check whether user-facing notices reflect what the business really does
2. Review whether consent requests are clear, specific, and understandable
3. Identify workflows where marketing capture and notice language have drifted apart
4. Check whether teams can explain what users were shown at the point of collection

Section 3: Rights and grievance handling

1. Identify who owns request intake
2. Check whether access, correction, deletion, and complaint workflows exist
3. Check whether support/ops know where to route requests
4. Review whether request handling can be tracked and documented

Section 4: Retention, deletion, and vendors

1. Review whether data categories have any retention logic at all
2. Check where deletion is assumed rather than verified
3. Identify key third-party vendors handling personal data
4. Review whether vendor access and responsibility are understood internally

Section 5: Governance and ownership

1. Assign ownership for privacy-related follow-up
2. Review who updates notices and form logic after changes
3. Identify whether any internal SOPs or recurring reviews exist
4. Decide what gets fixed now, what gets tracked, and what needs legal review

Best next reads: compliance checklist, consent guide, privacy notice checklist, rights handling guides, vendor review checklist.