DPDP Act Readiness Checklist
for Indian Organisations
Twenty practitioner-grade questions to test whether your organisation is genuinely DPDP-ready — or whether you are one DSR away from a regulator enquiry. No email gate.
Answer Honestly. No One Is Watching.
Five sections, twenty yes/no questions. Click Yes only if you can produce the document or run the workflow today. Score reveals at the bottom when you complete all twenty.
Discovery & Data Mapping
You cannot comply with what you have not catalogued. Every DPDP gap audit starts here.
Lawful Basis & Consent
DPDP §6 sets a high bar for consent. Most existing consent flows fail it.
Data Principal Rights
Section 11 to 14 rights are enforceable. Build the workflows before the requests arrive.
Vendors, DPAs & Cross-Border
Your processors are your liability. Map them, paper them, monitor them.
Governance, Security & Breach Response
The DPDP Board will ask for these documents first when an incident or complaint lands.
Your DPDP readiness score
Three Bands. Three Plays.
You are materially non-compliant. A Data Principal complaint or breach today will not survive Board scrutiny. Treat the next 90 days as remediation: data discovery, RoPA build-out, consent-flow rework, DPA papering with all vendors.
Foundations exist but operational evidence is thin. Close DSR workflow, breach runbook, and the highest-risk vendor DPAs in the next 60 days. Schedule a tabletop exercise to test breach response under the 72-hour clock.
You can stand behind your posture in front of a Data Protection Board enquiry. Move to continuous monitoring: quarterly RoPA refresh, annual DPIA review, automated DSR routing, and board-level privacy MIS.
Common Questions
Who is in scope of the DPDP Act?
Every business that processes digital personal data in India, plus foreign businesses offering goods or services to people in India. There is no minimum-size threshold — a 5-person startup with a customer email list is in scope.
What is the difference between a Data Fiduciary and a Significant Data Fiduciary?
A Data Fiduciary is anyone who decides the purpose and means of processing personal data. A Significant Data Fiduciary (SDF) is a Fiduciary the Central Government has designated based on volume, sensitivity, risk, or sectoral importance. SDFs face additional obligations: mandatory DPO, mandatory DPIA, and independent audit.
When does enforcement actually begin?
The Act was notified in August 2023. Most operational obligations activate when the Central Government notifies the DPDP Rules, which have been circulated in draft. A staged rollout through 2026 is the regulator's signalled approach. Treat the Act as already binding — retrofitting consent and data mapping takes months, not weeks.
Do small businesses really need a DPO?
A DPO is mandatory only for entities designated as Significant Data Fiduciaries. Non-SDFs still need a Contact Person who can address grievances. Practically, every business with meaningful personal data volumes should name a DPO — regulators view it as evidence of accountability.
What is the difference between this checklist and the buyer's guide?
The checklist diagnoses readiness in 5 minutes. The 50-page buyer's guide explains the why behind every line, walks through gap-assessment methodology, RoPA construction, DSR runbook design, breach-notification mechanics, and vendor selection — with sample templates and Indian-context cost benchmarks.
Skip the Guesswork. Get a DPDP Roadmap.
A 30-minute consultation. Walk away with a prioritised remediation list, an effort estimate, and a sequenced 90-day plan that closes your highest-risk gaps first.
No sales pitch. Responds within 24 hours.