Guide
Run a DPDP readiness assessment
A readiness assessment tells you how far your current practice is from the duties that begin on 13 May 2027, and what to fix first.
Short answer
A DPDP readiness assessment compares how you handle personal data today with the duties in the DPDP Act and the Rules that begin on 13 May 2027. Cover the data inventory, grounds for processing (s.4), notices and consent (s.5, s.6), rights and grievances (Rule 14), security (Rule 6), breach response (Rule 7), processors and transfers (s.8(2), s.16), retention (s.8(7)) and children's data (s.9). Rate each area in plain words backed by evidence, not a numeric benchmark, and turn every gap into a task with an owner and a date.
The areas to assess
| Area | What to check | Act or Rule |
|---|---|---|
| Data inventory | Every system, file store and SaaS tool that holds digital personal data, and who owns it | s.3, s.8(1) |
| Grounds for processing | Each purpose rests on consent or a legitimate use | s.4, s.6, s.7 |
| Notices | Notices stand on their own, itemise data and purposes, and link to withdrawal, rights and the Board | s.5, Rule 3 |
| Consent | Consent is free, specific, informed, unconditional and unambiguous, and withdrawal is as easy as giving it | s.6 |
| Rights and grievances | Published request method and identifier; grievance period of no more than 90 days | s.11 to s.14, Rule 14 |
| Security | Encryption or masking, access control, logs kept for one year, backups, processor security terms | s.8(5), Rule 6 |
| Breach response | A plan to tell affected Data Principals and the Board without delay, and a detailed report within 72 hours | s.8(6), Rule 7 |
| Processors and transfers | A contract with every processor, and a list of where data goes outside India | s.8(2), s.16 |
| Retention | Data erased when the purpose is served, unless a law requires you to keep it | s.8(7), Rule 8 |
| Children and SDF exposure | Verifiable parental consent where under-18s are served; exposure to SDF notification | s.9, s.10, Rule 10, Rule 13 |
How to run the assessment
- 01Set the scope
Name the legal entities, products, websites and apps in scope. Include employee and candidate data, which is easy to miss.
- 02Collect the inventory
Gather systems and vendors from IT, finance and procurement. Unknown SaaS tools often show up in expense reports and single sign-on logs.
- 03Interview owners
Hold a short session with each owner: product, engineering, security, support, marketing, HR and legal. Ask the questions below and ask to see the evidence.
- 04Rate each area
Use the four ratings in the next section. A rating without evidence counts as not started.
- 05Write the gap plan
Turn every gap into a task with an owner, a due date before 13 May 2027 and the evidence that will close it.
- 06Repeat
Reassess each quarter until May 2027, and after any major product or vendor change.
Rate in plain words, not invented benchmarks
Neither the Act nor the Rules set a scoring method. Use plain ratings that a director can read, and attach the evidence behind each one.
| Rating | Meaning | Evidence needed |
|---|---|---|
| In place | The control works today and someone owns it | A record, log or document you could show an auditor |
| Partial | The control exists for some systems or products | A list of what is covered and what is not |
| Not started | No control, or no evidence that one works | The gap and a planned owner |
| Not applicable | The duty does not apply, with a reason | A short note, reviewed by legal |
A self-assessment is not a certification, and it does not show that a regulator would agree with your ratings. Have counsel review any area you mark not applicable.
Questions to ask in each area
- Can we list every system that holds personal data, and who owns each one?
- For each purpose, do we rely on consent or a named legitimate use under s.7?
- Does every consent request come with a notice that meets Rule 3?
- Can a person withdraw consent as easily as they gave it?
- Have we published how to make a request, the identifier we need and our grievance period?
- Who decides that an incident is a personal data breach, and who tells the Board?
- Does every processor contract include security terms?
- Do we know which personal data leaves India, and where it goes?
- When does each type of personal data get erased, and who checks?
- Do under-18s use our service, and how do we verify a parent?
How TruePrivacy helps
The DPDP checklist in TruePrivacy marks each control compliant, partial or non-compliant and works out a posture score from live records. Treat it as a readiness view, not a certification.
Data discovery builds the inventory from connected databases, cloud stores and SaaS tools, and classification flags Indian identifiers such as Aadhaar, PAN and UPI IDs. Vendors and processors holds vendor assessments and contracts, and records of processing keeps purposes in one register. Start with the readiness quiz.
Is there an official DPDP readiness score?
No. Neither the Act nor the Rules set a scoring method, so use plain ratings backed by evidence and avoid comparing yourself with figures you cannot source.
Who should run a DPDP readiness assessment?
A programme owner, with input from legal, security, product, HR and support. Legal should review every area marked not applicable.
How often should we reassess?
Quarterly until 13 May 2027 is a sensible rhythm, and again after major product, vendor or structural changes.
Does a good assessment mean we are compliant?
No. It shows where you stand on the evidence you have. It is not a certification or a regulator's view.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin