Free tool · no login

DPDP Readiness Score

Most early-stage Indian startups have no compliance artefact folder — so we ask instead. Answer a few questions and get an honest readiness score for the Digital Personal Data Protection Act, framed around the ~May 2027 compliance deadline. We only flag what actually applies to you.

This is a compliance-readiness self-assessment, not legal advice and not a determination of compliance. Verify against the primary law and consult a qualified practitioner before relying on the results.

Regulation

DPDP returns a readiness score. EU AI Act returns the applicable obligations (no numeric score yet — EU posture scoring is pending legal review).

About your organisation
What does this mean? Where do I find it?

Determines baseline Data Fiduciary status.

What does this mean? Where do I find it?

Some sectors carry extra obligations or exemptions.

What does this mean? Where do I find it?

Used only to check Third-Schedule class triggers (e-commerce/social >=2cr, gaming >=50L).

What does this mean? Where do I find it?

SDF duties (DPIA, audit, India DPO) apply ONLY to notified SDFs. Most startups are NOT SDFs.

Data you handle
What does this mean? Where do I find it?

Triggers verifiable parental consent (Rule 10) + Act s.9 bans, subject to Fourth-Schedule exemptions.

Your current posture
What does this mean? Where do I find it?

A separate, easy-to-read notice telling people what data you collect, why, and their rights (DPDP s.5 / Rule 3). Look for a 'Privacy Policy' / 'Privacy Notice' page linked in your website or app footer.

What does this mean? Where do I find it?

How users agree to your data use. 'Explicit opt-in' = an unticked box or clear action they must take. Check your sign-up / cookie / onboarding screens.

What does this mean? Where do I find it?

Written technical/organisational measures protecting personal data — e.g. encryption, role-based access, audit logs (DPDP s.8(5) / Rule 6). Ask your engineering/security lead or check your security policy / SOC2-ISO docs.

What does this mean? Where do I find it?

A documented plan for what happens if data is exposed — who is told, and a log of incidents (DPDP s.8(6) / Rule 7 requires notifying the Board and affected people). Check for an incident-response runbook or breach register.

What does this mean? Where do I find it?

A named contact / channel users can reach about their data (DPDP s.13 requires a response within ~90 days). Look for a 'Grievance Officer', DPO email, or contact form in your privacy notice.

Add 11 more for a deeper, more precise score

Optional. Leaving these blank is fine — they simply score as “needs review” rather than a pass, so answering more sharpens your score.

About your organisation
What does this mean? Where do I find it?

DPDP applies within India and extraterritorially to those serving Indian users (Act s.3).

What does this mean? Where do I find it?

Certain State processing follows the Second Schedule standards (Rule 5).

What does this mean? Where do I find it?

Consent Manager obligations (Rule 4) apply only if you act as one.

Data you handle
What does this mean? Where do I find it?

Triggers the s.9-proviso lawful-guardian consent path (DPDP-SEC9-GUARDIAN-001). Mirrors the children's-data gate; the guardian rule also fires when you process children's data.

What does this mean? Where do I find it?

Permitted subject to future Central-Govt restrictions (Rule 15).

What does this mean? Where do I find it?

Itemised personal data must be listed in your notice (Rule 3).

What does this mean? Where do I find it?

Used to map where personal data may reside (informs security & processor checks).

Your current posture
What does this mean? Where do I find it?

A way for users to say 'stop using my data' that is as simple as giving consent was (DPDP s.6). Look for an account setting, an unsubscribe/opt-out link, or a documented request process.

What does this mean? Where do I find it?

Rules for how long you keep personal data and when you delete it (DPDP s.8(7)-(8) / Rule 8). Check for a data-retention schedule or policy; if you 'keep everything forever', the answer is No.

What does this mean? Where do I find it?

The email address you publish for data-protection questions and grievances. Find it in your privacy notice or website footer / contact page.

What does this mean? Where do I find it?

A list of third parties that handle personal data on your behalf (AWS, analytics, CRM, payroll…) with data-processing agreements in place (DPDP s.8(2) / Rule 6(f)). Check your vendor list / DPA folder.

Get the full report by email (optional)

Your answers are processed to generate your score and are not stored for anonymous visitors. This is a readiness self-assessment, not legal advice.