DPDP Act checklist: where does your company's data live?

The short answer: the Digital Personal Data Protection Act makes your company responsible for the personal data it holds about customers, employees and anyone else, wherever that data is stored and whoever stores it for you. You cannot meet its duties, such as keeping data secure, reporting a breach, or deleting data on request, unless you first know where every copy lives. So the first job is a map, and the checklist below starts there.

This is a practical guide, not legal advice. Use it to prepare for the conversation with your lawyer or company secretary, not to replace it.

What does the DPDP Act expect from a business?

The Act was passed in August 2023, and the Rules that put it into operation were notified on 14 November 2025, with an eighteen-month period for phased compliance. The Government's own summary is the best short reading: the Press Information Bureau's backgrounder on the DPDP Rules, 2025. By that timetable the main obligations arrive around the middle of 2027. Confirm the exact dates that apply to you with your adviser.

In the Act's language, your company is a Data Fiduciary: it decides why and how personal data is used. The people the data is about are Data Principals. A vendor that handles the data for you, such as a payroll service or a cloud provider, is a Data Processor.

The backgrounder lists seven principles behind the law. In plain words:

The same document sets out what is at stake. Penalties under the Act go up to ₹250 crore for failing to maintain reasonable security safeguards, up to ₹200 crore for not notifying the Board or affected individuals of a breach, and up to ₹50 crore for other violations. Those are ceilings, not standard fines, but they explain why this is a board-level subject.

Why does it matter where the data lives?

Look at what the law asks you to be able to do, and each duty turns into a question about location.

• Secure it. You cannot protect a copy you do not know exists: the old laptop in a cupboard, the export a manager emailed to a personal account.
• Report a breach. When personal data is exposed, affected people must be told without delay, in plain language. You can only do that if you know what was on the system that was breached.
• Answer requests. Individuals can ask to see, correct, update or erase their data, and the backgrounder says requests must be answered within ninety days. If the data sits in six tools, you need to find all six.
• Delete it when the purpose ends. That includes the copies in backups, old spreadsheets and the HR tool you stopped using two years ago.
• Stand behind your vendors. A processor works on your behalf. If it loses your data, the question comes to you.

Does the DPDP Act say data must stay in India?

Not in general. The Act does not ban storing personal data abroad. It gives the Central Government the power to restrict transfers to particular countries, and the backgrounder notes that Significant Data Fiduciaries may be directed to keep certain categories of data locally. Separately, some regulated sectors have their own storage rules.

So for most small and mid-sized companies, keeping data in India is a choice, not a mandate. It is often a sensible one. Data held in India, on systems you control, is governed by one legal system you understand, is easier to locate when someone asks, and is one less thing to explain to a client's compliance team. The related ideas are in our explainer on sovereign and private AI.

The checklist: twelve steps

Work through these in order. The first four are the map; the rest depend on it.

Map what you hold

• List every kind of personal data you hold. Customers, employees, job applicants, vendors' staff, visitors. Include what is on paper.
• List every place it is stored. Laptops, phones, the office server, each cloud tool, email inboxes, WhatsApp groups, backups, the accountant's copy.
• Write down the country for each cloud tool. If the vendor will not say where your data is held, record that as a finding.
• Name an owner for each store. A person, not a department.

Reduce it

• Stop collecting what you do not use. Forms that ask for a date of birth "just in case" create duty without benefit.
• Set a retention period for each kind of data, and delete what is past it. Old applicants' CVs and ex-customers' records are the usual pile.
• Close the stray copies. Shared drives open to "anyone with the link", exports in downloads folders, personal email forwards.

Protect it

• Encrypt every laptop and phone that holds company data. A lost device should be an inconvenience, not a breach. We explain how in disk encryption and device management, for owners.
• Give each person their own login, and remove it the day they leave. Shared passwords make accountability impossible.
• Decide which AI tools may see personal data. If staff paste customer details into public chatbots, that is processing you are answerable for. See shadow AI and a policy that works.

Be ready to respond

• Publish a contact for data questions, and write a clear notice saying what you collect and why.
• Write a one-page breach plan: who decides, who is told, and what the message to affected people says. Practise it once.

What should you ask your software vendors?

Every tool that holds personal data for you is part of your compliance. Send each vendor the same five questions and keep the answers.

1. In which country, and with which hosting provider, is our data stored?
2. Who at your company can access it, and is that access logged?
3. How will you tell us about a breach, and how quickly?
4. How do we export all our data, and how do you delete it when we leave?
5. Do you use our data, or our prompts, to train AI models?

A vendor that answers promptly and specifically is a good sign. One that sends a brochure is telling you something too.

Where does an owned stack help?

The fewer places your data lives, the shorter the map. That is the plain advantage of running on systems you own. With DNX OS, documents, mail, HR records and chat stay on your own machines and a hub you host on your premises or in an Indian data centre, and the AI runs on the device rather than on a public service. Keeping personal data in India under your own control makes these duties simpler to meet. It does not meet them for you: you still need the notice, the retention rule and the breach plan.

Whatever you run on, start with the first four boxes this week. A company that knows where its data lives has done the hardest part.