DPDP Readiness Self-Assessment

Do you obtain free, specific, informed, and unambiguous consent through clear affirmative action before collecting personal data?

Is your privacy notice separate from your Terms of Service, and does it cover purpose, rights, withdrawal mechanism, and Board complaint mechanism?

Can users withdraw consent as easily as they gave it (same channel, same friction level)?

Is your privacy notice available in English plus at least one additional Eighth Schedule language (or a mechanism for users to request translation)?

Do you have a documented and tested process for Data Principals to request access to their personal data, with a published contact point?

Can you retrieve all personal data about a specific Principal across all your systems (product DB, CRM, analytics, support, billing, warehouses, backups)?

Do you have an erasure process that also propagates to data processors and any Fiduciaries you have shared the data with?

Is a grievance officer named and publicly contactable, with a documented response SLA under 14 days?

Is all personal data encrypted at rest and in transit (TLS 1.2+)?

Is access to personal data governed by role-based access control, with MFA required for internal access to production?

Do you have a vulnerability management programme (continuous scanning, annual VAPT, dependency audit) with documented cadence?

Do you maintain audit logs of all access to personal data for minimum 12 months, with alerting on anomalous access?

Do you have a documented breach-response playbook with defined roles, escalation paths, and decision gates?

Have you tested your breach response with a tabletop exercise within the last 12 months?

Do you have pre-drafted notification templates (Board, Data Principals, public statement) reviewed by legal counsel?

Does your detection infrastructure (SIEM, DLP, anomaly detection) surface credible breach signals within hours — not days?

If your product has any under-18 users, do you have verifiable parental consent infrastructure (not just age self-declaration)?

Have you mapped all cross-border data flows and identified sector-specific localization requirements (RBI, IRDAI, ABDM)?

Have you assessed your organization's likelihood of Significant Data Fiduciary (SDF) designation and prepared for heightened obligations?

Do you have a Data Processing Addendum (DPA) template you can provide to enterprise buyers, with DPDP-specific clauses?