Prompt to draft a DPDP Act compliance checklist for an app

You are a privacy lead. Draft a checklist for this app under India's Digital Personal Data Protection Act and its rules.

App: [APP]
Data we collect: [DATA]
Users under 18: [MINORS]

Cover, as yes / no lines with the owner and evidence:
1. Notice: what we tell users before we collect
2. Consent: how it is asked, recorded, and withdrawn
3. Purpose and retention: when each data type is deleted
4. Children's data, if any
5. User rights: access, correction, erasure, grievance
6. Processors and vendors: contracts and checks
7. Breach: who decides, who is told, within what time
End with the order to do these in over 90 days. Say clearly this is a draft to check with a lawyer.

Rules:
- Use the India figures listed below and name the source and month next to each one you use.
- If you need a figure that is not listed, write "Assumption:" and give your reasoning instead of a number you cannot source.
- Plain words. Short sections with headings. No filler.

India figures to use (from productgrowth.in/numbers):
- India had 958 million active internet users in 2025 (IAMAI-Kantar). Source: https://productgrowth.in/numbers/internet-users-india/

DPDP checklist: fitness app (DRAFT — have a lawyer review before relying on it)

Context. DPDP Act 2023 plus DPDP Rules (notified Nov 2025), with core obligations phasing in through May 2027 [1]. The consent-manager provisions apply from 13 Nov 2026 and full obligations from 13 May 2027 [1]. India had 958M active internet users in 2025 (IAMAI–Kantar) [3], so assume regulator attention will scale with the user base.

Heart rate and weight are health data. The Act has no separate "sensitive data" tier, but treat them as high-risk anyway. Assumption: this is my design choice, not a legal requirement.

1. Notice

• [ ] Notice shown before or at the point of collection? Owner: Product + Legal. Evidence: screenshot, version log.
• [ ] Lists each data item (name, phone, weight, steps, heart rate) and each purpose?
• [ ] Explains how to withdraw consent and how to complain to the Data Protection Board?
• [ ] Available in English plus the major languages of your users?

2. Consent

• [ ] Separate, unticked, plain-language consent for the watch heart-rate feed? Owner: Product. Evidence: UI flow.
• [ ] Consent logged with timestamp, notice version and user ID? Owner: Engineering. Evidence: consent table export.
• [ ] Withdrawal is as easy as giving consent (one tap in Settings)?
• [ ] Withdrawal stops processing and triggers deletion?
• [ ] Plan for consent-manager integration by 13 Nov 2026 [1]?

3. Purpose and retention

Assumption: the periods below are examples for you to set, not statutory numbers.

• [ ] Each data type has a stated purpose and delete date? Owner: Privacy lead. Evidence: retention schedule.
• Heart rate: raw data, e.g. 12 months, then aggregate or delete
• Steps and weight: tied to account life
• Name and phone: until account closure
• [ ] Automated deletion job running and tested?
• [ ] Inactive accounts purged on a defined rule?

4. Children's data (16 and 17 year olds)

Under the Act, anyone under 18 is a child. This is your biggest exposure.

• [ ] Age gate at signup? Owner: Product.
• [ ] Verifiable parent or guardian consent for under-18 users? Evidence: consent record linked to the guardian.
• [ ] No tracking, behavioural monitoring or targeted ads aimed at under-18s?
• [ ] Heart-rate and weight features reviewed for harm to minors (e.g. weight-loss nudges)?
• [ ] Check with counsel whether any exemptions apply; do not assume one.

5. User rights

• [ ] Users can see what data you hold (access)? Owner: Engineering. Evidence: export tool.
• [ ] Correction of name, phone, weight in-app?
• [ ] Erasure request flow, with the time you take to respond stated?
• [ ] Named grievance contact published, with a response timeline? Owner: Privacy lead.
• [ ] Nominee option for a user who dies or becomes incapacitated?

6. Processors and vendors

• [ ] Inventory of every vendor touching personal data (cloud, analytics, push, watch SDKs, payments)? Owner: Privacy lead. Evidence: vendor register.
• [ ] Written contract with each processor covering purpose limits, security, deletion and breach reporting?
• [ ] Security review done per vendor?
• [ ] Watch-maker integrations (Apple, Garmin, Google) reviewed for what they share with you?
• [ ] Any transfer outside India checked against government restrictions?

7. Breach

• [ ] Written incident plan naming who decides a breach has occurred? Owner: CTO + Privacy lead.
• [ ] Process to notify the Board and each affected user? Confirm exact timelines with your lawyer against the Rules; I have not quoted a deadline I can't source.
• [ ] Log of past incidents and a tested drill?
• [ ] Vendors obliged to alert you quickly?

90-day order

• Days 1–15: data map, vendor inventory, name the grievance owner.
• Days 16–35: age gate and guardian consent (highest risk), then notice rewrite.
• Days 36–55: consent logging and one-tap withdrawal.
• Days 56–70: retention schedule and deletion jobs.
• Days 71–85: rights flows (access, correction, erasure) and vendor contracts.
• Days 86–90: breach drill, then lawyer sign-off on the whole pack.

Draft only. Verify every item with a qualified lawyer, because the Rules are new and phasing continues to May 2027 [1]. For a product-architecture view, see our guide [5].

Next action: build the under-18 consent flow first.