Tool · Free · No sign-up

DPDP readiness check

Answer 13 questions about the duties the DPDP Act puts on most businesses, and get a readiness score and a list of what to fix first, with the section behind each gap.

Your answers

Answer for the way things work today. Partly means it is in place for some of your data, systems or users, but not all.

1 · Notice · s. 5 and Rule 3Does every consent request come with a standalone notice that lists the personal data and the purpose, and says how to withdraw consent, exercise rights and complain to the Board?

Yes Partly No

2 · Earlier consents · s. 5(2)Will everyone whose consent you took before the Act applies get that notice, as soon as you reasonably can send it?

Yes Partly No

3 · Consent · s. 6Is consent given by a clear affirmative action, for the stated purpose only, recorded, and as easy to withdraw as it was to give?

Yes Partly No

4 · Data Processors · s. 8(2)Does every Data Processor work for you under a valid contract?

Yes Partly No

5 · Security safeguards · s. 8(5) and Rule 6Is personal data encrypted or masked, behind access control, logged with the logs kept and reviewed for a year, backed up, and covered by security clauses in every processor contract?

Yes Partly No

6 · Breach intimation · s. 8(6) and Rule 7Could you tell the Board and every affected person about a breach without delay, and file the full report within 72 hours?

Yes Partly No

7 · Retention and erasure · s. 8(7) and Rule 8Do you, and your processors, erase personal data once its purpose is served or consent is withdrawn, after keeping it and its logs for the one-year minimum?

Yes Partly No

8 · A contact for questions · s. 8(9) and Rule 9Is a contact for questions about your processing published on your website or app?

Yes Partly No

9 · Grievances · s. 8(10), s. 13 and Rule 14(3)Do you run a grievance channel that is easy to find and answers within a published period of 90 days or less?

Yes Partly No

10 · Rights requests · ss. 11 and 12, Rule 14(1)Can people ask, through a published channel, for a summary of their data, and to correct, complete, update or erase it?

Yes Partly No

11 · Nomination · s. 14 and Rule 14(4)Can a person nominate someone to exercise their rights after their death or incapacity?

Yes Partly No

12 · Children's data · s. 9 and Rule 10If you process children's data: do you get verifiable consent from a parent or lawful guardian, and keep tracking, behavioural monitoring and targeted advertising away from under-18s?

Yes Partly No Does not apply

13 · Significant Data Fiduciary duties · s. 10 and Rule 13If you are notified as a Significant Data Fiduciary: do you have a Data Protection Officer in India, an independent data auditor, and an impact assessment and audit every year?

Yes Partly No Does not apply

Nothing you enter leaves your browser.

Your readiness

Answer the questions to see your readiness score and what to fix first.

Applies from 13 May 2027

How the score works

Each duty scores 2 points when it is in place, 1 when it is partly in place and 0 when it is not. Duties that do not apply to you are left out, and the score is your points as a share of the points available.

This is a short self-check of the duties most businesses carry, not an audit. It leaves out duties that apply only in some cases, such as processing by the State and transfers outside India.

What the check covers

Source: DPDP Act 2023 and DPDP Rules 2025, as published in the Gazette of India. The ceiling is the most the Board may impose under the Schedule.

Duty	Penalty ceiling	Status
NoticeDPDP Act 2023, s. 5; DPDP Rules 2025, Rule 3	Rs 50 crore (item 7)	Upcoming · 13 May 2027
Notice to people who consented earlierDPDP Act 2023, s. 5(2)	Rs 50 crore (item 7)	Upcoming · 13 May 2027
ConsentDPDP Act 2023, s. 6	Rs 50 crore (item 7)	Upcoming · 13 May 2027
A valid contract with every Data ProcessorDPDP Act 2023, s. 8(2)	Rs 50 crore (item 7)	Upcoming · 13 May 2027
Security safeguardsDPDP Act 2023, s. 8(5); DPDP Rules 2025, Rule 6	Rs 250 crore (item 1)	Upcoming · 13 May 2027
Breach intimationDPDP Act 2023, s. 8(6); DPDP Rules 2025, Rule 7	Rs 200 crore (item 2)	Upcoming · 13 May 2027
Retention and erasureDPDP Act 2023, s. 8(7); DPDP Rules 2025, Rule 8	Rs 50 crore (item 7)	Upcoming · 13 May 2027
A published contact for questionsDPDP Act 2023, s. 8(9); DPDP Rules 2025, Rule 9	Rs 50 crore (item 7)	Upcoming · 13 May 2027
Grievance redressalDPDP Act 2023, ss. 8(10) and 13; DPDP Rules 2025, Rule 14(3)	Rs 50 crore (item 7)	Upcoming · 13 May 2027
Rights requestsDPDP Act 2023, ss. 11 and 12; DPDP Rules 2025, Rule 14(1)	Rs 50 crore (item 7)	Upcoming · 13 May 2027
NominationDPDP Act 2023, s. 14; DPDP Rules 2025, Rule 14(4)	Rs 50 crore (item 7)	Upcoming · 13 May 2027
Children's dataDPDP Act 2023, s. 9; DPDP Rules 2025, Rule 10	Rs 200 crore (item 3)	Upcoming · 13 May 2027
Significant Data Fiduciary dutiesDPDP Act 2023, s. 10; DPDP Rules 2025, Rule 13	Rs 150 crore (item 4)	Upcoming · 13 May 2027

Sources: DPDP Act 2023, ss. 5, 6 and 8 to 14 and the Schedule; DPDP Rules 2025, Rules 3, 6 to 10, 13 and 14

This page explains the law in plain English. It is not legal advice.