हिंदी

DPDP readiness check

15 questions, about 5 minutes. Each one is tied to a section of the DPDP Act 2023 or a rule of the DPDP Rules 2025. At the end you get a score out of 100 and your gaps, most important first.

Answer for your business as it works today. "Partly" means you do it for some customers or some channels only.

Question 1/15 Do you have a written list of the personal data you collect, where it is stored and why you collect it?

Customer names, phone numbers, WhatsApp chats, Google Sheets, your billing software, your CRM. Every place counts. (s.4, s.5, s.8(1))

Question 2/15 For each use of personal data, do you know whether you rely on consent or on one of the "legitimate uses" in section 7?

The Act allows processing only with consent or for a legitimate use listed in section 7 (for example, data the person gave you voluntarily for a specific purpose without objecting, or compliance with a law). (s.4, s.6, s.7)

Question 3/15 When you ask for consent, do you show a separate notice that lists each data item, each purpose, how to withdraw consent, how to use rights and how to complain to the Data Protection Board?

Rule 3 asks for a notice that stands on its own, is in clear and plain language, and itemises data and purposes. A long website policy written for the IT Act usually misses some items. (s.5, r.3)

Question 4/15 Can a customer read your notice in English or in any of the 22 Eighth Schedule languages, if they ask?

Section 5(3) requires the option to access the notice in English or any language in the Eighth Schedule to the Constitution. (s.5(3))

Question 6/15 Can people withdraw consent as easily as they gave it, and do you (and your vendors) then stop using their data?

If consent was one tap, withdrawal cannot need a letter. After withdrawal you and your processors must stop processing within a reasonable time, unless a law requires otherwise. (s.6(4), s.6(6))

Question 7/15 Can you prove who gave consent, when, for what, and which version of the notice they saw?

If a dispute arises, section 6(10) puts the burden of proving that notice was given and consent obtained on you, the Data Fiduciary. (s.6(10))

Question 8/15 Do you have a written contract with every vendor that handles personal data for you (hosting, CRM, payroll, WhatsApp or SMS provider, agency)?

A Data Fiduciary may engage a Data Processor only under a valid contract, and stays responsible for what the processor does on its behalf. (s.8(1), s.8(2))

Question 9/15 Do you have basic security in place: access only for staff who need it, encryption or masking, access logs kept for at least a year, and backups?

Rule 6 lists minimum "reasonable security safeguards", including access control, logs and monitoring, and keeping logs for at least one year. Failing to take reasonable safeguards carries the highest penalty in the Schedule, up to ₹250 crore. (s.8(5), r.6)

Question 10/15 If customer data leaks, do you know who informs the affected people and the Data Protection Board, and that the detailed report to the Board is due within 72 hours?

Rule 7: inform each affected person and the Board without delay, then send the Board a detailed report within 72 hours of becoming aware of the breach (or a longer period the Board allows). Failing to notify can cost up to ₹200 crore. (s.8(6), r.7)

Question 11/15 Do you delete personal data once the purpose is over or consent is withdrawn, and ask your vendors to delete it too?

Section 8(7) requires erasure when consent is withdrawn or the purpose is no longer served, unless a law requires you to keep it. Rule 8 adds two things: fixed erasure periods with a 48-hour warning for some large platforms (Third Schedule), and, for every business, a minimum of one year during which the data and logs of each processing must be kept before erasure (Rule 8(3)). (s.8(7), r.8, r.8(3))

Question 12/15 Do your website, app and replies show the contact details of a person who can answer questions about how you use personal data?

Rule 9: publish, prominently on your website or app, the business contact information of a person who can answer such questions (or of the Data Protection Officer, for a Significant Data Fiduciary), and mention it in every reply to a data request. (s.8(9), r.9)

Question 13/15 Do you have a grievance process with a published reply time, and do you track complaints until they are closed?

You must have an effective grievance redressal mechanism. Rule 14 asks you to publish your reply period and respond within a maximum of 90 days. A person must use your process before complaining to the Board. (s.8(10), s.13, r.14)

Question 14/15 Can you answer a request to see, correct or erase someone's data, or to register a nominee, without scrambling?

Data Principals can ask for a summary of their data and who it was shared with (s.11), correction or erasure (s.12), and can nominate someone (s.14). Rule 14 asks you to publish how to make these requests. (s.11, s.12, s.14, r.14)

Question 15/15 If you process data of anyone under 18, do you get verifiable consent from a parent or guardian, and avoid tracking and targeted ads aimed at children?

Schools, coaching institutes, kids' brands and gaming apps are directly concerned. Section 9 also bans tracking, behavioural monitoring and targeted advertising directed at children. Breaching it can cost up to ₹200 crore. The Fourth Schedule partly exempts some classes (clinical establishments, educational institutions, crèches, child transport) for specific purposes only; read the conditions before relying on it. (s.9, r.10, r.11)