DPDP Prerequisites Checklist — 62 items across 9 categories

Governance

Organisation chart — full hierarchy showing all departments and reporting lines

Governance

List of all legal entities, branch locations and registered offices

Governance

DPO appointment letter — mandatory only if SDF designation confirmed

Governance

Privacy contact designation published under Rule 9 — name and contact details

Governance

Board or senior management data governance mandate or resolution

Governance

Existing Information Security Policy — current approved version

Governance

Existing Privacy Policy — current version with effective date

Governance

Leadership confirmation of DPDP Act 2023 and Rules 2025 awareness

Governance

Existing privacy or data protection framework — ISO 27701, SOC2, HIPAA if any

Data Inventory

Purpose register — all purposes for which personal data is collected with declared lawful basis per Section 4

Data Inventory

Categories of personal data collected — all types including patient, employee, vendor

Data Inventory

Special category data list — health, biometric and children data inventoried separately

Data Inventory

Data flow diagrams for all processes — patient registration, sample collection, report delivery, billing

Data Inventory

Inventory of all IT systems processing personal data — LIS, HIS, mobile app, billing, HR

Data Inventory

Estimated data subject volume per system — number of patients, employees, vendors per application

Data Inventory

Cross-border data transfer details — destination countries, data categories, transfer mechanism

Data Inventory

Data retention schedule per category — how long each personal data type is kept and why

Data Inventory

Statutory retention obligations — MCI Regulations 2002, NDPS Act 1985, POCSO Act 2012

IT Systems

LIS / HIS / EHR system documentation — vendor, version, hosting details, modules used

IT Systems

Network architecture diagram — internal network, DMZ, cloud connectivity, remote access

IT Systems

Database inventory — on-prem, cloud and hybrid — database type, location, data residency country

IT Systems

Cloud provider contracts and data residency confirmation — which region, which data

IT Systems

API integration list — hospitals, diagnostic aggregators, insurance, government portals

IT Systems

Mobile application architecture documentation — iOS, Android, backend, third-party SDKs

IT Systems

Access control matrix — all roles, permissions and systems accessible per role

IT Systems

Encryption status per system — at rest and in transit — confirmed by IT team

IT Systems

Audit log configuration — what events are logged, where logs are stored, retention period

IT Systems

Latest Vulnerability Assessment and Penetration Test reports — last 12 months

IT Systems

Backup and disaster recovery documentation — backup frequency, retention, recovery testing

Consent Management

All patient registration forms — physical and digital versions including telemedicine and home collection

Consent Management

Website privacy policy and cookie consent mechanism — current live version

Consent Management

Mobile app consent flows and permission screens — screenshots of all consent steps

Consent Management

Consent records management process — where consent records are stored, how long kept

Consent Management

Consent withdrawal mechanism documentation — how patients can withdraw consent per Section 6(4)

Consent Management

Consent record storage details — system, format and retention period for stored consent records

Consent Management

Minor patient consent process — age verification mechanism and parental consent workflow

Consent Management

Research or analytics consent forms — if patient data is used for any research or reporting purpose

Consent Management

Marketing consent and opt-out mechanism — how patients opt in and out of communications

Data Principal Rights

Patient rights request process documentation — access, correction, erasure requests handling

Data Principal Rights

Sample rights request form provided to patients — access, correction, erasure request form

Data Principal Rights

Rights fulfilment SLA documentation — internal target response time per right type

Data Principal Rights

Rights request log — records of all rights requests received and their resolution — last 12 months

Vendor Management

Complete vendor list — all vendors with whom personal data is shared, with data categories shared per vendor

Vendor Management

Data Processing Agreement status list — which vendors have signed DPA, which are pending

Vendor Management

Key vendor contracts with privacy and DPA clauses — hospital partners, aggregators, cloud providers

Vendor Management

Sub-processor list for cloud and IT vendors — third parties used by your processors

Vendor Management

Vendor security certifications — ISO 27001, SOC2 Type 2 certificates from key data processors

Vendor Management

Cloud data residency confirmation per provider — region, data types stored

Vendor Management

Third Party Risk Management process documentation — if formal TPRM process exists

Retention and Erasure

Data retention and disposal schedules — all categories with retention period and disposal method

Retention and Erasure

Erasure and destruction process documentation — how personal data is deleted when retention period ends

Retention and Erasure

Backup erasure process — confirmation that backups are also erased and not only live systems

Retention and Erasure

Statutory retention conflict documentation — where MCI or NDPS retention overrides DPDP erasure obligation

Incidents and Breach

Data breach response plan — Incident Response Plan covering Rule 7 DPB notification obligations

Incidents and Breach

IRP testing records — date and method of last test or drill

Incidents and Breach

History of past data incidents or security events — last 3 years

Incidents and Breach

Grievance redressal mechanism details — published contact, SLA, escalation process

Incidents and Breach

Previous regulatory notifications sent — CERT-In, SEBI, IRDA or any other regulator

HR and Training

Employee personal data processing activities — what employee data is collected and for what purpose

HR and Training

HR data inventory — categories of employee data held, systems, retention periods

HR and Training

Data privacy training records — who was trained, when, on what content

HR and Training

Employee confidentiality agreements and NDAs — standard template and signed copies