DPDP gap assessment and data mapping
A personal data inventory, data-flow maps and a costed plan, with a fixed written scope before we start.
What the assessment covers
A DPDP readiness assessment of every system that touches personal data. If you also want infrastructure, code and spend checked, our full tech audit includes data protection.
Personal data inventory
Every system that holds personal data, and what it holds.
Data flows
How personal data moves across your systems and vendors.
Consent and notices
What you tell people, and how consent is captured and recorded.
Rights-request readiness
Whether you can find, correct and erase one person's data on request.
Retention and deletion
How long data is kept, and whether deletion actually happens.
Security and breach readiness
Safeguards on personal data, and how you would detect and report a breach.
Processor contracts
Vendor terms flagged for review by our partner law firm.
What you receive
A DPDP compliance assessment you can act on: the personal data inventory, the DPDP data mapping, and a plan with costs.
Data inventory
System, data type, purpose and owner for each one.
Data-flow diagrams
Including vendors and cross-border flows.
Gap register
Every gap against the Act and Rules, with a severity.
Costed implementation plan
What to fix, in what order, and what it costs.
Items for legal review
The questions our partner law firm needs to answer.
Board summary
One page your board can read.
How it runs
We work with read-only access. Nothing in your systems changes during the assessment.
- 01
Kickoff
Agree scope, owners and the systems we'll look at.
- 02
Discovery interviews
Short conversations with the people who run each system.
- 03
System review
Schemas, exports and configs, with read-only access.
- 04
Gap analysis
Each system compared against the Act and Rules.
- 05
Plan and readout
The gap register and costed plan, walked through with your team.
After the assessment
The gap register tells you what to fix. You can fix it yourselves, or we can build it with DPDP implementation: consent logs, rights requests, retention jobs and breach workflows. See the full picture on our DPDP compliance page.
FAQ
DPDP gap assessment FAQs
No. Our engineers do the technical work. Our partner law firm reviews it and gives you signed, written legal documentation.
Find every system that holds personal data, then compare how each one works against the Act and Rules. That is the gap assessment.
It depends on how many systems hold personal data. After a 30-minute call we send a fixed written scope and price.
Yes. Every system, the personal data it holds, why, who owns it and where it flows, including vendors.