Find the gaps.Fix what matters.Show the evidence.
With evidence you can show, not a certificate. Start with a free readiness check written for your sector. Then close the gaps in a working register, keep the evidence that each control works, and, when you are ready, have a named reviewer check it.
| Ref | Severity | Gap |
|---|---|---|
| GAP-ACC-01 | Critical | Shared logins protect personal records. |
| GAP-NOT-01 | High | No privacy notice is given at the point of collection. |
| GAP-XFR-01 | Medium | Where personal data is stored, including by vendors, is not known. |
| GAP-CON-05 | Low | The Consent Manager framework has not been considered. |
There is no turnover threshold, and we are not aware of any small-business exemption having been notified. Under legal review: Whether any exemption under s. 17(3) has been notified should be confirmed against the e-Gazette.
DPDP Act, 2023, ss. 3 and 17(3)The penalty for failing to take reasonable security safeguards to prevent a personal data breach can be up to ₹250 crore, set by the Board in proportion to the breach.
DPDP Act, 2023, s. 33 and Schedule, item 1Most remaining obligations take effect on 13 May 2027.
G.S.R. 843(E) and DPDP Rules, 2025, r. 1Six steps, from first answer to staying ready
Each step builds on the one before. The free check covers the first two. The rest happen in the workspace.
- AssessPractical questions about how your business handles data, written for your sector.Free readiness check
- IdentifyEvery control that applies, the open gaps, their severity, the law behind each and the first actions.Free readiness check
- RemediateEach gap becomes a task with an owner and a due date set by the law’s own dates.DPDP Remediation
- EvidenceThe policies, contracts and screenshots that show each control works, held against it.Evidence Room
- VerifyA named, qualified reviewer accepts or returns each control, and the result states the scope.Verified Assessment
- MonitorStale evidence, overdue work, changes in the law and when to reassess.Continuous Assurance
Written for how your sector actually collects data
Every assessment covers the core duties in the Act. Choose one of 8 sectors and you also get questions about the data, vendors and risks particular to it.
- Fintech
Lending, payments, wealth and insurance platforms. Covers KYC records, app permissions, partner lenders and recovery agents.
- SaaS
Software sold to other businesses. Covers acting on a customer's behalf, sub-processors, hosting locations and tenant access.
- Healthcare
Clinics, hospitals, labs, pharmacies and telemedicine. Covers patient records, report sharing, staff access and guardians.
- Education
Schools, colleges, coaching and education apps. Covers parental consent, learning platforms, marks and campus CCTV.
- E-commerce
Online stores, D2C brands and marketplace sellers. Covers marketing consent, tracking, couriers, payments and account deletion.
- Professional Services
Chartered accountants, law firms, company secretaries and consultants. Covers client files, third-party data, email and retention.
- Housing Societies and RWAs
Housing societies, resident welfare and apartment owners' associations. Covers resident registers, visitor logs, gate apps, CCTV and committee hand-over.
- Gems and Jewellery
Jewellery retailers, wholesalers and manufacturers. Covers KYC for high-value sales, occasion dates, savings schemes and CCTV.
Before you worry about compliance, answer a simpler question. Do you know what personal data you hold, and who can see it?
That is where the assessment starts. It does not ask you to know the law. It asks how your business already works, and works out the gaps from your answers.
Three roles the Act gives
Almost every duty in the Act depends on which role you play for a given set of data. The same organisation can play different roles for different data.
- Data Principal
- The person the data is about: a customer, patient, student, resident, employee or visitor. For a child, the parent or guardian acts for them.
- Data Fiduciary
- Whoever decides why and how the data is used. Usually your organisation. The fiduciary carries the duties: notice and consent where consent is the basis, security, breach reporting, answering requests and erasure.
- Data Processor
- Whoever handles the data on the fiduciary’s behalf and on its instructions, under a contract: for example the billing software or the cloud host. A payroll provider, courier or agency may be either, depending on who decides how the data is used.
A small example. A patient books at a dental clinic through an appointment app. The patient is the Data Principal. The clinic decides why it needs the booking details, so it is the Data Fiduciary. The company that runs the appointment app stores the bookings on the clinic’s instructions, so it is a Data Processor for them. If the patient also has an account on the company’s own app, or the company used the bookings to market its own services, it would be deciding a purpose of its own, and would be a Data Fiduciary for that data.
Each industry guide works through a case from its own sector.
The law arrives in stages
The roadmap in your result is built against these dates. Dates that have passed are marked.
-
11 August 2023In effect
DPDP Act, 2023 receives assent.
-
13 November 2025In effect
DPDP Rules, 2025 notified.
-
13 November 2026Upcoming
Consent Manager provisions take effect.
-
13 May 2027Upcoming
Remaining obligations take effect.
What the free result contains
Controls and applicability
The controls the assessment checks for an organisation like yours, and which do not apply, with the reason.
Open gaps and severity
Each gap with a reference, its severity, the section of the Act behind it and the fix in plain words.
Evidence state
Which controls are only self-declared, and what evidence would show each one works.
First actions
The handful of fixes to start with, critical first, then a roadmap against the dates the law takes effect.
Starter documents
A privacy notice, consent wording, a vendor checklist and a breach playbook, shaped by your answers.
A self-assessed score
Out of 100, as a quick summary. The gaps matter more than the number. How results work.
Worth saying plainly
- i
It is not a certificate. Nothing it produces is a certification, registration or government approval of any kind.
- ii
Every result says how far it goes. Self-Assessed means your answers. Evidence-Supported means evidence is attached. Expert-Verified names the reviewer and lists exactly which controls they accepted.
- iii
A high score is not a ruling. It means fewer open gaps by your own answers, not that a regulator would agree.
- iv
It does not replace a lawyer. The output is built to be reviewed by one before you rely on it.
- v
The question bank is in draft. It is awaiting review by a qualified data-protection lawyer, and every result says so until that review is complete.
Recent changes
Notices about new rules, dates and guidance appear here. Nothing has been posted yet; the key dates are the best place to start.
A gap list tells you what to fix, not which fix matters most for how your business runs. If it would help to talk it through, leave your details and someone will call.