DPDPA Compliance Checklist for IT Teams -- The Five Technical Obligations and the ManageEngine Controls That Address Them

The Digital Personal Data Protection Act creates obligations that IT teams need to deliver -- not at the policy level, but at the level of access controls, monitoring, audit trails, and breach detection. This checklist covers the five technical obligations and the ManageEngine tools that address each one.

A note before the checklist: this document covers the technical IT implementation component of DPDPA compliance. Policy documentation, consent management, privacy notices, data fiduciary registration, and vendor agreements are handled by your legal and compliance team. If you are reading this checklist looking for policy guidance, you are looking in the wrong place.

1. Reasonable Security Safeguards (Section 8(5)): The Act requires data fiduciaries to implement appropriate technical and organisational measures to prevent personal data breaches. The technical measures that constitute reasonable safeguards include: access controls limiting who reaches personal data, endpoint patch management and security policies on devices processing personal data, monitoring for unauthorised access attempts, and network security controls. ManageEngine tools: AD360 (access controls), Endpoint Central (endpoint security), Log360 (monitoring).

2. Breach Detection and Notification Capability: In the event of a breach, you need to notify the Data Protection Board and affected data principals. Accurate breach notification requires knowing what happened, when it happened, and which data was affected. Without centralised log management, this reconstruction is guesswork. ManageEngine tools: Log360 (centralised logs, incident timeline), ADAudit Plus (file server access events).

3. Access Controls and Accountability: Only personnel with legitimate purpose should access personal data. Access controls must be role-based, automated, and reviewed periodically. Every access event must be attributable to a named individual. ManageEngine tools: AD360 + ADManager Plus (provisioning and deprovisioning), ADAudit Plus (access audit trail), PAM360 (privileged access governance).

4. Data Accuracy and Deletion: Personal data must be accurate and deleted when no longer needed. Purpose limitation means access should be removed when the purpose is fulfilled. ManageEngine tools: ADAudit Plus (modification tracking), ADManager Plus (automated deprovisioning workflows).

5. Response to Data Principal Rights Requests: When a data principal requests access to, correction of, or erasure of their data, you need to respond accurately. Accurate response requires a searchable audit trail across all systems holding that individual's data. ManageEngine tools: ADAudit Plus + Log360 (cross-system log search by identity).

The common thread across all five obligations: you need to be able to demonstrate controls, not just assert them. Auditors and the Data Protection Board will ask for evidence. ManageEngine tools -- configured correctly -- produce that evidence automatically.

Download the full DPDPA Readiness Checklist for IT Teams from our Guides page for a self-assessment tool you can use before engaging for a formal assessment.