DPDP AI Readiness Checklist for Indian Enterprises

A note on scope: this is a practical readiness aid, not legal advice. Your exact obligations depend on your sector and the DPDP Rules as they apply to you, so confirm specifics with your own counsel. Where an item says architecture "supports" an obligation, that means it makes the obligation easier to meet and evidence. No product makes an organisation DPDP compliant on its own.

Know your personal data, including the AI shadow copies

The Act assumes you know what personal data you hold and where it goes. Most organisations know their official systems and forget the unofficial ones.

Have you mapped every system holding personal data: CRM, HR, core databases, shared drives, email exports?
Have you asked, honestly, which AI tools your staff already use, and what gets pasted or uploaded into them?
Do you know which of those flows send personal data to servers outside India?
Is there a one-page AI usage policy saying what may go into which tool, and what must never leave your systems?

Notice and consent that a normal person can read

Consent buried in a wall of terms is not the consent the Act wants.

At every point you collect personal data, do you tell people what you collect and why, in plain language?
Is consent specific and separable, not bundled into a single tick for everything?
Can a person withdraw consent as easily as they gave it?
If your processing purposes change because of AI, have the notices changed with them?

The AI boundary question

Under the Act you remain the Data Fiduciary for personal data your staff put into AI tools, wherever that tool processes it. "We did not know" is not a defence; it is the finding.

For each AI tool in use, can you answer in one line: where is this processed and who can see it?
Do staff have an approved internal alternative, so the safe path is also the convenient one?
Does personal data used with AI stay inside your own infrastructure, rather than travelling to an outside service?
Where something must go out, is it logged and redacted so the egress is accountable?

Security safeguards you can evidence

This is the obligation whose failure carries the headline penalty of up to ₹250 crore. The test is not whether you have controls; it is whether you can produce the evidence.

Is access to personal data role-scoped, so the wrong people cannot reach the wrong records?
Is privileged and administrative access logged, with a trail you can produce on demand?
Are the safeguards written down, owned by someone, and reviewed on a schedule?
Would your evidence survive without a vendor's cooperation, because the logs and stores are yours?

Breach readiness, rehearsed

Detection, containment and reporting to the Data Protection Board and affected individuals run on timelines. Your obligation does not pause while a vendor investigates.

Do you know, today, how you would detect and contain a personal data breach?
Is there a named owner and a written drill for notifying the Board and affected people in time?
Do your vendor contracts oblige processors to tell you fast enough for you to meet your own clock?

Data principal rights, as a process

Access, correction, erasure and grievance handling should be a procedure someone runs, not a scramble someone survives.

If a person asks what you hold about them, can you answer without an engineering project?
Can you correct or erase personal data across systems, including the unofficial copies from item 01?
Do you have retention rules with real deletion, keeping data only as long as the purpose lasts?
Is there a working grievance channel with a response clock?

Children's data, if you touch it

Anyone under eighteen is a child under the Act. Schools, universities, edtech, gaming, healthcare and many consumer businesses are in this section whether they planned to be or not.

Do you know where minors' data enters your systems, including AI-assisted channels?
Can you obtain verifiable parental consent where the Act requires it?
Are you clear of tracking, behavioural monitoring and targeted advertising aimed at children?

If you are large: Significant Data Fiduciary duties

Organisations notified as Significant Data Fiduciaries carry extra duties. If you might be one, plan as if you are.

Is a Data Protection Officer appointed, based in India, and reachable in your notices?
Are Data Protection Impact Assessments scheduled, including for AI adoption?
Are independent audits planned, with the evidence trail they will ask for already accumulating?

Notice a pattern in the hard rows. Items 03 and 04 get easy or hard depending on one architectural choice: where the AI runs. When it runs on somebody else's cloud, "where is this processed" is a clause you cite and hope holds up. When it runs inside your own boundary, it is a fact you show. A private deployment on your own infrastructure supports the boundary, safeguards and evidence rows by design; your notices, consent flows and policies still do the rest of the work. For the background, read the DPDP countdown to May 2027 and the eight questions your compliance team should ask, and see how ZenithAI supports each control in security and governance.

The DPDP AI readiness checklist.