Building DPDP-Compliant Custom Software in India: A Practical Developer Checklist

India's Digital Personal Data Protection (DPDP) Act, 2023 changes how we design almost every business application that stores customer or employee data: CRMs, ERPs, POS systems, booking portals, HR tools. At Light Animation we build custom software for Indian businesses, and DPDP now shapes our architecture decisions from the first discovery call.

This is the practical checklist our team uses. It is written for developers and product owners, not lawyers, so treat it as an engineering guide and confirm specifics with your legal advisor.

1. Map every piece of personal data first

Before writing code, list:

• What personal data you collect (name, phone, email, Aadhaar-linked IDs, location, payment info)
• Why you collect each field (the purpose)
• Where it is stored (database, backups, logs, third-party tools)
• Who can access it (roles)

If a field has no clear purpose, don't collect it. Data minimisation is the cheapest compliance win you will ever get.

2. Build consent as a feature, not a checkbox

Under DPDP, consent must be free, specific, informed and given by a clear affirmative action. In practice:

• Show a plain-language notice explaining what you collect and why
• Use separate, unticked opt-ins for separate purposes (e.g. order processing vs. marketing)
• Store a consent record: user ID, purpose, notice version, timestamp, channel
• Make withdrawing consent as easy as giving it, and propagate withdrawal to downstream systems

A simple consents table with purpose, notice_version, granted_at and withdrawn_at columns covers most apps.

3. Purpose limitation in your data model

Tag data with the purpose it was collected for, and check that purpose before using it elsewhere. For example, a phone number collected for delivery updates should not silently flow into a marketing campaign tool.

4. Retention and erasure jobs

Personal data should not live forever. Define a retention period per purpose and run scheduled jobs that delete or anonymise records once the purpose is served or consent is withdrawn. Remember backups, logs and analytics exports too.

5. Data principal rights endpoints

Users can ask to access, correct or erase their data and to raise grievances. Build:

• A "Download my data" export
• Profile correction flows
• An erasure request queue with an audit trail
• A visible grievance contact in the app

6. Reasonable security safeguards

DPDP expects reasonable security safeguards to prevent breaches. Our baseline for every project:

• Encryption in transit (TLS) and at rest for sensitive fields
• Role-based access control and least privilege
• Masking of personal data in logs and non-production environments
• Access logs for admin actions
• Regular dependency updates and vulnerability scans

7. Breach response plan

If a personal data breach happens, the Data Protection Board and affected users must be informed. Keep an incident runbook ready: who decides, how you detect, how you notify, and how you document it.

8. Children's data

If your users may be under 18, you need verifiable parental consent and must avoid tracking or targeted advertising directed at children. Decide early whether your product should allow minors at all.

9. Vendors and processors

Payment gateways, SMS providers, cloud hosts and analytics tools process data on your behalf. Keep a list of processors, sign contracts that cover data protection, and share only what each vendor needs.

Quick checklist

• [ ] Personal data inventory with purposes
• [ ] Clear notice + granular consent records
• [ ] Purpose tags in the data model
• [ ] Retention and erasure jobs (including backups)
• [ ] Access, correction, erasure and grievance flows
• [ ] Encryption, RBAC, log masking
• [ ] Breach runbook
• [ ] Children's data decision
• [ ] Processor list and contracts

Designing for DPDP from day one is far cheaper than retrofitting it later. If you are planning ERP, CRM, POS or SaaS work in India, build these patterns into your first sprint.

This post is an engineering guide, not legal advice.