DPDP Compliance Checklist for D2C Brands
India's Digital Personal Data Protection Act is now a hard deadline. The marketing list you spent years building resets to zero unless every contact is re-permissioned with valid, explicit consent before enforcement begins.
Enforcement starts
May 14, 2027
Maximum penalty
₹250 Crore
Realistic timeline
6–8 months
Download the free checklist
The hardest pill for growth teams
Once enforcement begins, you will not be able to send any promotional email, WhatsApp, or SMS to your existing customers (the list you spent years and crores building) unless you have captured fresh, explicit, DPDP-valid consent from each one before the deadline. Old consent, implied consent, and “they bought from us so they opted in” do not survive.
Why D2C brands are in the blast radius
D2C brands sit on large volumes of high-intent, sensitive data. The exact growth tactics that made Indian D2C fast are now the exact tactics that create serious liability.
RTO & COD fraud-prediction apps
Third-party plugins cross-reference customer phone numbers across thousands of stores. Sharing numbers without explicit opt-in is an unauthorised transfer, with exposure of ₹200 Cr+.
Client-side pixels firing too early
Meta Pixel, GA4, TikTok Tag and Hotjar harvest IPs, device fingerprints and behavioural heatmaps before tracking consent is given. That alone violates the consent requirement.
Unmanaged 3PL delivery manifests
Handing raw, unencrypted manifests (full names, phones, addresses) to couriers with no binding Data Processing Agreement leaves you 100% liable if a driver leaks or sells data.
Automated abandoned-cart spam
Grabbing a phone number at checkout and instantly firing WhatsApp/SMS recovery flows without prior consent is a direct breach of purpose-limitation rules.
Inside the checklist
Print it. Work top to bottom. If you can't tick a box with evidence, it's a gap. The guide covers six implementation areas and an 8-section action checklist.
Data discovery & mapping
Inventory every ingestion point (checkout, CRM, POS, support), tag each field with purpose and consent basis, and purge undocumented dark data.
Notice & consent architecture
Itemised plain-language notices, unbundled unchecked opt-ins, one-tap revocation, and support for the 22 scheduled Indian languages.
Retention & automated purging
Tiered schedules (7 years for tax, 12–24 months for behavioural), the 3-year inactivity purge with 48-hour warning, and verifiable deletion logs.
Security & privacy by design
AES-256 at rest, TLS 1.3 in transit, role-based access with PII masking, server-side tracking, and mandatory 1-year immutable logs.
Vendor & 3PL governance
Re-execute binding DPAs with couriers, CRMs and widgets: sole-purpose use, no data reuse, T+0 breach notice, post-termination deletion certificates.
Rights & grievance redressal
A self-service My Data portal (access, correction, erasure, nomination), a named India-resident Grievance Officer, and a 90-day SLA.
8-section action checklist
Don't build this alone
Book a free 30-minute audit. We will map exactly where your brand is exposed, how much of your marketing list is at risk, and a realistic timeline to be ready. No cost, no obligation.
Book a Free AuditBy downloading, you agree to receive occasional compliance updates from DPDP Compliant. We will never share your details.