Free tool
DPDP readiness quiz
Fourteen questions across twelve DPDP topics. Answer honestly and get a list of what to work on, with the section or rule behind each.
Short answer
The DPDP readiness quiz asks 14 questions across inventory, notice, consent, children, rights, grievances, breach, security, vendors, retention, transfers and governance. For every answer other than Yes, it shows what the Act or Rules ask for and where to read more. It gives no score or percentage, and it is not a certification or legal advice.
14 questions across 12 DPDP topics. Answer Yes, Partly, No or Not sure. For anything other than Yes you get a short note on what to do, the section or rule behind it, and where to read more. Your answers stay in your browser.
01 · Inventory
Do you know where personal data sits across your databases, cloud storage, SaaS tools and employee devices?
02 · Inventory
For each purpose, have you recorded whether you rely on consent (s.6) or a legitimate use (s.7)?
03 · Notice
Does every consent request come with a notice that itemises the personal data and purposes, and links to withdrawing consent, exercising rights and complaining to the Board?
04 · Consent
Is consent given by a clear affirmative action, for a specific purpose, without pre-ticked boxes or bundling, and only for the data that purpose needs?
05 · Consent
Can people withdraw consent as easily as they gave it, and do you and your processors then stop processing?
06 · Children
Do you know whether any users are under 18, and do you get verifiable parental consent before processing their personal data?
07 · Rights
Can a Data Principal ask for access, correction, completion, updating or erasure, or nominate someone, and can you find their data in every system?
08 · Grievances
Have you published a grievance response period of no more than 90 days, and the contact who answers questions about processing?
09 · Breach
If a personal data breach happened today, could you inform each affected person and the Board without delay, and send the Board a detailed report within 72 hours?
10 · Security
Do you have the Rule 6 safeguards: encryption, obfuscation, masking or virtual tokens; access control; access logs that are reviewed; backups; and logs kept for one year?
11 · Vendors
Does every vendor that processes personal data for you work under a contract with security terms?
12 · Retention
Do you erase personal data when consent is withdrawn or the purpose is no longer served, and make your processors do the same?
13 · Transfers
Do you know which personal data leaves India, and to which countries and vendors?
14 · Governance
Has a named person been given responsibility for DPDP readiness, with a plan to 13 May 2027 that senior management reviews?
What the quiz covers
Most questions follow the duties that start for Data Fiduciaries when core obligations begin on 13 May 2027 (Rule 1). Two more cover groundwork the law assumes: knowing where personal data sits and who owns the programme.
| Theme | Where it comes from |
|---|---|
| Inventory | s.4, s.7, Rule 3 |
| Notice | s.5, Rule 3 |
| Consent | s.6(1), s.6(4), s.6(6), s.6(10) |
| Children | s.9, Rule 10, Rule 12 |
| Rights | s.11, s.12, s.14, Rule 14 |
| Grievances | s.13(3), Rule 9, Rule 14(3) |
| Breach | s.8(6), Rule 7 |
| Security | s.8(5), Rule 6 |
| Vendors | s.8(1), s.8(2), Rule 6 |
| Retention | s.8(7), Rule 8 |
| Transfers | s.16 |
| Governance | s.8(1) |
How to read your results
Answer Yes, Partly, No or Not sure. For each answer other than Yes, the quiz shows a short note on what to do, the section or rule behind it, and links to the guide or feature page.
The result is a list of topics to work on, not a score. Treat Not sure as a gap until someone has checked. Take the quiz with the people who run the systems, not alone.
Your answers stay in your browser. Nothing you select is sent anywhere.
What the quiz does not do
The quiz is educational information, not legal advice and not a certification. It cannot see your systems, so it relies on your answers. For a structured review, read the readiness assessment guide and check gaps with counsel.
How TruePrivacy helps
The DPDP checklist in TruePrivacy marks controls as compliant, partial or non-compliant and works out a posture score from live records. It is a readiness view, not a certification.
The platform finds personal data with data discovery, tracks Data Principal requests and grievances against the 90-day outer limit, and runs the clocks for breach notification.
Does the DPDP readiness quiz give a compliance score?
No. It lists the topics where you answered Partly, No or Not sure, with guidance and links. It gives no score or percentage.
Is the quiz a DPDP certification?
No. It is educational information, not legal advice and not a certification.
When do the duties in the quiz start?
Core obligations for Data Fiduciaries, including notice, consent, security safeguards, breach intimation, rights and grievances, begin on 13 May 2027 (Rule 1).
Are my answers stored?
No. The quiz runs in your browser and nothing you select is sent anywhere.
Your DPDP plan, starting today
Core obligations for data fiduciaries begin on 13 May 2027.
Core obligations begin