DPDP applicability and readiness check
Find out whether the DPDP Act applies to you, then get a list of your gaps, each tagged by who fixes it: legal, a tool, or engineering.
Start the check
Takes about 2 minutes. Nothing you enter is stored or sent anywhere. This is a quick check, not legal advice.
What the check asks
Five questions on whether the Act applies to you, then one on each area that matters. Each answer is Yes, Partly, No or Not sure.
Does the DPDP Act apply?
- Do you handle personal data about people: customers, users, employees or job applicants?
- Is any of it digital: apps, databases, spreadsheets, email, CRM, HR or payroll software? Paper records later typed or scanned in count too.
- Where are you, and who do you serve?
- Whose data is it?
- Which of these apply to you? Select all that apply.
Where do you stand?
- Data mapping
- Do you have a written list of every system that holds personal data: apps, databases, spreadsheets and SaaS tools?
- Notice
- When you collect personal data, do you show a notice saying what you collect and why?
- Consent
- Do you keep a record of who consented, to which notice version, and when?
- Rights
- Is there a clear way for people to ask to see, correct or erase their data?
- Security
- Is access to personal data limited to people who need it, and reviewed regularly?
- Breach
- Do you have a written breach plan covering affected people, the Data Protection Board (detailed report within 72 hours) and CERT-In (within 6 hours)?
- Retention
- Is data actually deleted when its period ends or the person asks, including in backups, analytics and vendor systems?
- Vendors
- Do you have a written contract with every vendor that processes personal data for you?
- Children's data (only if you hold children's data)
- Do you get verifiable consent from a parent before processing a child's data?