Fifty questions covering eight categories of the DPDP Act 2023 — the same eight categories DPDP audits will examine. Each item scores Yes / Partial / No against the obligations the Act imposes on Data Fiduciaries. Scoring runs live as you work through the items; results persist locally so you can return to them. The output is a current readiness percentage, category-level gap analysis, and a maturity band that tells you where you actually stand relative to the 13 May 2027 full-compliance deadline. Designed for honest self-assessment, not box-ticking — under-scoring is more useful than over-scoring.
Without clear ownership and accountable governance, every other DPDP control operates without direction. SDF designation is not a self-determination — but the Act requires every Data Fiduciary to demonstrate accountability proportionate to its data exposure.
You cannot protect what you do not know exists. The DPDP Act assumes a Data Fiduciary knows what personal data it holds, where, why, and for how long. Visibility is the precondition for every other obligation.
DPDP is consent-driven by design. Notice and consent quality is the most heavily weighted category — not because it is mechanically the largest area, but because failure here typically means the entire processing operation lacks lawful basis. Get this wrong and everything downstream is compromised.
Data Principal rights are operational obligations. Whether a Data Fiduciary handles them well determines whether complaints reach the Data Protection Board — and the Board's enforcement focus is anticipated to start with rights handling failures.
DPDP s.8(5) requires "reasonable security safeguards." The standard does not prescribe specific controls, but in practice tracks closely with what ISO 27001, CIS Controls, and similar frameworks specify. Sectoral regulators (RBI, IRDAI, SEBI) layer on additional sector-specific security obligations.
DPDP imposes strict breach notification obligations: prompt initial notification to the Data Protection Board, follow-up detailed report within 72 hours, notification to affected Data Principals. Failure to notify is itself a violation — over and above the underlying breach.
Under DPDP, the Data Fiduciary remains accountable for processor actions. Contractual controls, technical safeguards, and continuous oversight of processors are the operational discipline that makes that accountability real rather than nominal.
Storage limitation is now a legal requirement, not an aspirational principle. The DPDP Act explicitly requires deletion when the original purpose has been served. Retention discipline is the most operationally underestimated obligation in early DPDP implementations.
The composite score below weights each category by its regulatory significance — not all 50 items count equally. Notice and consent failures threaten the lawful basis of the entire processing operation; retention failures are typically remediable with focused effort. The maturity band tells you where you stand relative to the 13 May 2027 full-compliance deadline.
Your composite score will appear here as you answer items. The tool weights categories by regulatory significance — under-scoring is more useful than over-scoring; the goal is an honest baseline, not a flattering one.
Each item scores Yes (full credit) / Partial (half credit) / No (zero). Items within a category sum to the category's weighted contribution. The maturity bands below provide rough interpretation — but the band is less useful than the category breakdown. A composite score of 70% with 30% on consent and 90% on security is materially different from 70% with 70% across all categories. Read the categories.
| Band | Score | Interpretation |
|---|---|---|
| Pre-compliance | Below 30% | Substantial DPDP gaps across most categories. Treat as a fresh build rather than a remediation. Even with 13 May 2027 still 18 months away, this state requires immediate, sustained programme work. |
| Building | 30 — 55% | Foundation visible, core gaps remain. Typical state for organisations that have started DPDP work but treated it as document drafting rather than operational change. Realistic 12-month remediation horizon. |
| Substantive | 55 — 75% | Most obligations operational; specific gaps remain. Typical state for mature organisations approaching full compliance. The gap-closing work is targeted; the core programme exists. |
| Substantially compliant | 75 — 90% | Programme operating at near-full coverage. Remaining gaps are usually high-effort items: consent manager integration, full backup-retention alignment, end-to-end erasure propagation. Audit-credible. |
| DPDP-ready | Above 90% | Comprehensive operational compliance. Maintenance discipline rather than build effort. Honest 90%+ self-assessments are uncommon — under-scoring is more useful than over-scoring. |
This tool is a working baseline, not a regulatory determination. The Data Protection Board of India determines compliance through formal investigation and audit; nothing here substitutes for that. The tool's value is in honest internal assessment — identifying where remediation effort should concentrate before regulatory exposure crystallises. For substantive review of your DPDP posture against the 13 May 2027 deadline, a Readiness Review engagement is the natural next step.
A self-assessment is the start of the work, not the end. If your score reveals gaps you cannot close internally on the 13 May 2027 timeline, a 30-minute scoping call costs nothing — we will tell you honestly whether the gap is closeable with focused effort or requires a substantial programme, and what realistic remediation looks like for your specific situation.
Schedule a call