Skip to content
DPDP
Free · in browser·10 min · no account

42 questions that tell you what is actually missing

Most readiness assessments ask what you have written down. This one asks what your systems actually do. Answer honestly and you get a ranked gap list — not a score designed to sell you something.

Start nowAll free tools
Time needed
10 minTime needed
Signup steps
0Signup steps
Maps to
Across the ActMaps to

The tool

0 of 42 answered

Notice & consent
  • Every collection point shows an itemised notice before or at the time of collection
  • Notices are available in English and at least one Eighth Schedule language
  • Consent is recorded per purpose, not as a single blanket flag
  • Withdrawing consent is as easy as giving it
  • You can produce the exact notice text a person saw on a given date
  • Consent collected before the Act commenced has been refreshed
Data principal rights
  • There is a published route for access, correction and erasure requests
  • Requester identity is verified before any data moves
  • Every request has an SLA clock and a named owner
  • Nomination requests under Section 14 can be honoured
  • Erasure actually deletes across systems, including backups on a defined lag
Data inventory
  • You have a current record of every system holding personal data
  • Each personal data element has a named business owner
  • The inventory refreshes automatically, not at audit time
  • You know which data leaves India and under what basis
  • Orphaned copies (exports, analytics dumps, backups) are tracked
Security safeguards
  • Personal data is encrypted in transit and at rest
  • Access to personal data is role-based and reviewed on a cycle
  • Administrative access to personal data is logged
  • Vulnerability scanning and penetration testing run on a schedule
  • Cloud storage holding personal data is checked for public exposure
Retention
  • Retention windows are defined per purpose, not per table
  • Deletion runs on schedule and returns proof per system
  • Statutory retention is reconciled field by field with erasure rights
  • Legal holds are explicit, logged and time-bound
Breach readiness
  • You can name the affected data categories within hours of an incident
  • A breach playbook exists with named roles and escalation paths
  • You have rehearsed the process in the last twelve months
  • You can generate both the Board notification and the individual notice
Processors & vendors
  • Every vendor touching personal data is on a register
  • Each has a Data Processing Agreement that is currently in force
  • Sub-processors are known and approved
  • Vendor security posture is reassessed at least annually
Governance
  • Grievance Officer details are published and monitored
  • A named person owns privacy day to day
  • DPIAs run before launches that touch personal data
  • Privacy status is reported to leadership on a cycle
Children's data
  • You can identify which accounts belong to under-eighteens
  • Parental consent is verified by a method you can evidence
  • Behavioural tracking is blocked on child accounts
  • Consent transitions from guardian to individual at eighteen
  • Not applicable — you do not knowingly process children's data

Your readiness

—

42 left to answer

  • Notice & consent0%
  • Data principal rights0%
  • Data inventory0%
  • Security safeguards0%
  • Retention0%
  • Breach readiness0%
  • Processors & vendors0%
  • Governance0%
  • Children's data0%
Get help closing these

Runs entirely in your browser. Nothing is submitted.

3 questions

Common questions

How DPDP Readiness Checklist works, what it can and cannot see, and what happens to anything you enter.

No. Everything runs in your browser and nothing is submitted anywhere unless you choose to send it to us.

Other free tools

30 minutes·one real data flow

Ready to Simplify DPDP Compliance?

Most vendors open a deck. We open the product, map one of your real data flows, and tell you honestly how far you are from compliant.

Book a DemoContact Sales
  • No slides
  • No obligation
  • Data stays in India

What the 30 minutes looks like

  1. 0–5Your stack, in your wordsWhere data lands today, and who already owns it.
  2. 5–15One real flow, mapped liveWe connect a sample source and build the map on the call.
  3. 15–25Where you are exposedThe gaps we can see, ranked — including the ones you already knew.
  4. 25–30Effort and costWhat closing them takes, and whether we are the right answer.

If we are not the right fit, we will say so on the call rather than three follow-ups later.