Free tool · no login

DPDP Readiness Score

Most early-stage Indian startups have no compliance artefact folder — so we ask instead. Answer a few questions and get an honest readiness score for the Digital Personal Data Protection Act, framed around the ~May 2027 compliance deadline. We only flag what actually applies to you.

This is a compliance-readiness self-assessment, not legal advice and not a determination of compliance. Verify against the primary law and consult a qualified practitioner before relying on the results.

Step 1 of 5 · Take the free check
Regulation

DPDP returns a readiness score. EU AI Act returns the applicable obligations (no numeric score yet — EU posture scoring is pending legal review).

About your organisation
What does this mean? Where do I find it?

Determines baseline Data Fiduciary status.

e.g. a 15-person media-booking startup = 'Startup'. A one-person consultancy = 'Individual'.

What does this mean? Where do I find it?

Some sectors carry extra obligations or exemptions.

e.g. a booking site = 'SaaS', or the closest match. If you sell goods online, 'E-commerce'.

What does this mean? Where do I find it?

Used only to check Third-Schedule class triggers (e-commerce/social >=2cr, gaming >=50L).

e.g. 40000. A rough number is fine — this only checks whether you are near the very large thresholds.

What does this mean? Where do I find it?

SDF duties (DPIA, audit, India DPO) apply ONLY to notified SDFs. Most startups are NOT SDFs.

e.g. if you have never received a Government notification naming you, the answer is No. Almost every startup answers No.

Data you handle
What does this mean? Where do I find it?

Triggers verifiable parental consent (Rule 10) + Act s.9 bans, subject to Fourth-Schedule exemptions.

e.g. if your terms say 18+ and you never collect a birth date under 18, the answer is No. An after-school tutoring app answers Yes.

Your current posture
What does this mean? Where do I find it?

A separate, easy-to-read notice telling people what data you collect, why, and their rights (DPDP s.5 / Rule 3). Look for a 'Privacy Policy' / 'Privacy Notice' page linked in your website or app footer.

e.g. if your footer links to a 'Privacy Policy' page written in plain English, Yes. If the only thing you have is a Terms & Conditions page, No.

What does this mean? Where do I find it?

How users agree to your data use. 'Explicit opt-in' = an unticked box or clear action they must take. Check your sign-up / cookie / onboarding screens.

e.g. if users tick an unticked box agreeing before signup = 'Explicit opt-in'. If the box is already ticked for them = 'Pre-ticked or implied'.

What does this mean? Where do I find it?

Written technical/organisational measures protecting personal data — e.g. encryption, role-based access, audit logs (DPDP s.8(5) / Rule 6). Ask your engineering/security lead or check your security policy / SOC2-ISO docs.

e.g. if you can point to a written page listing encryption, who has access, and what is logged = Yes. If it's all in your engineers' heads = No.

What does this mean? Where do I find it?

A documented plan for what happens if data is exposed — who is told, and a log of incidents (DPDP s.8(6) / Rule 7 requires notifying the Board and affected people). Check for an incident-response runbook or breach register.

e.g. if you have a written note saying who to call and who to tell when data leaks = Yes. 'We'd figure it out' = No.

What does this mean? Where do I find it?

A named contact / channel users can reach about their data (DPDP s.13 requires a response within ~90 days). Look for a 'Grievance Officer', DPO email, or contact form in your privacy notice.

e.g. a named 'Grievance Officer' with an email in your privacy notice = Yes. A generic 'contact us' form alone = No.

Add 18 more for a deeper, more precise score

Optional. Leaving these blank is fine — they simply score as “needs review” rather than a pass, so answering more sharpens your score.

About your organisation
What does this mean? Where do I find it?

Used to write your name into the documents we generate for you. Not used for scoring.

e.g. 'BookMyMedia Technologies Pvt Ltd' — the name on your incorporation certificate.

What does this mean? Where do I find it?

The website or app URL the notice will live on. Used only to fill in your documents.

e.g. https://bookmymedia.in — wherever the privacy page will live.

What does this mean? Where do I find it?

Printed in the grievance workflow so people know where to write. Used only to fill in your documents.

e.g. '4th Floor, 12 MG Road, Bengaluru 560001'. The address on your website footer is usually the right one.

What does this mean? Where do I find it?

DPDP applies within India and extraterritorially to those serving Indian users (Act s.3).

e.g. if anyone in India can sign up and pay you, the answer is Yes.

What does this mean? Where do I find it?

Certain State processing follows the Second Schedule standards (Rule 5).

e.g. a private company answers No. A municipal corporation or a State-owned body answers Yes.

What does this mean? Where do I find it?

Consent Manager obligations (Rule 4) apply only if you act as one.

e.g. unless you have registered with the Data Protection Board to manage consent for other companies, the answer is No.

Data you handle
What does this mean? Where do I find it?

Triggers the s.9-proviso lawful-guardian consent path (DPDP-SEC9-GUARDIAN-001). Mirrors the children's-data gate; the guardian rule also fires when you process children's data.

e.g. if a parent or court-appointed guardian ever signs up on someone's behalf, the answer is Yes. Most consumer products answer No.

What does this mean? Where do I find it?

Permitted subject to future Central-Govt restrictions (Rule 15).

e.g. if your servers, your CRM or your analytics tool sit outside India, the answer is Yes — even if you never thought of it as a 'transfer'.

What does this mean? Where do I find it?

Itemised personal data must be listed in your notice (Rule 3).

e.g. most sites collect name, email and phone; add 'Financial' if you take money, 'Location' if you use maps or delivery.

What does this mean? Where do I find it?

Used to map where personal data may reside (informs security & processor checks).

e.g. if your app runs on AWS and your support inbox is a SaaS helpdesk, tick 'AWS' and 'Third party SaaS'.

Your current posture
What does this mean? Where do I find it?

A way for users to say 'stop using my data' that is as simple as giving consent was (DPDP s.6). Look for an account setting, an unsubscribe/opt-out link, or a documented request process.

e.g. an 'unsubscribe' link or a 'delete my account' button in settings = Yes. 'Email us and we'll consider it' = No.

What does this mean? Where do I find it?

Rules for how long you keep personal data and when you delete it (DPDP s.8(7)-(8) / Rule 8). Check for a data-retention schedule or policy; if you 'keep everything forever', the answer is No.

e.g. if you can say 'we delete inactive accounts after 24 months' and it is written down = Yes. If you keep everything forever = No.

What does this mean? Where do I find it?

The email address you publish for data-protection questions and grievances. Find it in your privacy notice or website footer / contact page.

e.g. privacy@yourcompany.in — an address a real person actually reads.

What does this mean? Where do I find it?

A list of third parties that handle personal data on your behalf (AWS, analytics, CRM, payroll…) with data-processing agreements in place (DPDP s.8(2) / Rule 6(f)). Check your vendor list / DPA folder.

e.g. if you keep a list of vendors that touch customer data, with signed agreements = Yes. If you would have to reconstruct it from your card statement = No.

What does this mean? Where do I find it?

Comma-separated: payment gateway, hosting, analytics, CRM, email, payroll. Named here, they appear by name in your privacy notice and processor inventory.

e.g. 'Razorpay, AWS, Google Analytics, Zoho CRM'. Anyone you pay who can see your customers' data.

What does this mean? Where do I find it?

E.g. '24 months after account closure'. We never invent a retention period — leave it blank and your schedule carries a marked placeholder instead.

e.g. '24 months after account closure'. Pick something you can actually honour — leave blank rather than guess.

What does this mean? Where do I find it?

DPDP s.13 expects a reachable human, not a role alias. Used to fill in your grievance workflow.

e.g. 'Priya Nair, Head of Operations'. In a small team this is usually a founder.

What does this mean? Where do I find it?

A named person or on-call role. Used to fill in your breach response SOP.

e.g. 'Arun Mehta, CTO' or 'the on-call engineer'. Someone who can be woken up.

Get the full report by email (optional)

Your answers are processed to generate your score and are not stored for anonymous visitors. This is a readiness self-assessment, not legal advice.