How results work

The assessment is deterministic: the same answers always give the same result. It uses no artificial intelligence, generates no text and sends nothing anywhere. Every rule is written down here.

A result is read in this order: which controls apply, which are open gaps and how severe each is, what evidence supports the controls in place, and only then the readiness indicator, which is a navigation aid and not a legal conclusion.

The control framework

Every sector uses the same 66 common controls in 20 modules, and each sector adds controls of its own inside the same modules. A control is one practice the DPDP Act, 2023 or the DPDP Rules, 2025 expect. Each records its legal reference, the date its duty takes effect (kept separately from its text), an owner role, the effort to fix it, the evidence that would show it and the fix if it is missing.

The twenty modules
Module	Common controls
01 Organisation and role mapping Whether you decide how data is used, or process it for someone else.	2
02 Data inventory and purpose What personal data you hold, why, and whether you need all of it.	4
03 Notice and transparency What people are told when their data is collected.	4
04 Consent and lawful basis The basis for each use of data, and how consent is taken and recorded.	5
05 Data Principal rights Answering requests to see, correct or erase data.	4
06 Children and guardians Data about anyone under 18, and adults who act through a lawful guardian.	4
07 Data quality Accuracy where data is used for decisions or passed to another business.	2
08 Retention and deletion How long data is kept, and how it is erased.	4
09 Security safeguards Encryption, backups, devices, websites and monitoring.	5
10 Breach response Knowing what to do, and whom to tell, when data is leaked or lost.	3
11 Processors and vendors Outside businesses that handle personal data for you.	4
12 Data sharing and disclosure Giving data to other businesses or authorities for their own use.	3
13 Transfer and storage location Where data is stored, including outside India.	2
14 Records and evidence Logs and records that show what was done.	2
15 Grievance handling A published contact, and complaints answered on time.	2
16 Consent withdrawal Letting people withdraw consent, and acting on it.	2
17 Access control Who can open personal data, and how that is controlled.	4
18 Incident testing Trying backups, breach plans and access reviews before they are needed.	3
19 Policy and training Written rules, and staff who know them.	3
20 Governance and accountability Who owns data protection, and how progress is overseen.	4

Answers

Each question is answered with a code, never free text:

Yes: The control is in place. 100% attainment.
Partly: Started but not finished. 50%. Offered only where “partly” makes sense.
No: Not in place. 0%.
Not sure: Counts as 0% until it is resolved, and is listed under “Still to resolve”. Offered only where someone might genuinely not know.
Not applicable: Offered only where the rules allow it: to settle a “Not sure” in your profile, such as whether you hold children’s data. Sent anywhere else, it is treated as Not sure and flagged. It never silently improves the result.

A question left unanswered counts as Not sure. Some questions are asked only after an earlier answer: a plan must exist before it can be rehearsed, so with no plan the rehearsal counts as No without being asked.

Applicability

A control is left out only for a stated reason, and every one left out is listed in the result:

Your profile: for example, controls for children’s data apply only if you hold data about anyone under 18, or are not sure.
An answer about how you work: for example, vendor controls apply only if an outside business handles personal data for you.
Your sector: for example, the exemption for clinical establishments and educational institutions is checked only for those sectors.
A permitted “Not applicable” answer, as above.

Severity

Each control has a criticality and a weight. Of the common controls, 8 are critical, 32 high, 21 medium and 5 low. A control that is not fully in place becomes a gap whose severity depends on the criticality and the answer:

Control	Weight	Answered No or Not sure	Answered Partly
Critical control	5	Critical	High
High control	3	High	Medium
Medium control	2	Medium	Low
Low control	1	Low	Low

Scroll the table sideways to see every column.

The readiness indicator

The score is the weighted share of attainment across the controls that apply: each control’s weight times its attainment, divided by the total weight, rounded to a whole number out of 100. Controls that do not apply are left out of both sides; nothing else is.

Score	Band	Meaning
80 to 100	Largely ready	Few open gaps by your own answers. Close what remains and keep the evidence that each control works.
55 to 79	Partly ready	Real gaps remain, but there is time to close them before 13 May 2027 if work starts now.
0 to 54	Not yet ready	Core controls are not yet in place by your own answers. Most of these duties apply from 13 May 2027. Start with the critical gaps, in the areas where the Act sets the highest maximum penalties.

Many low-risk Yes answers must not hide a critical gap, so the band is then held down, whatever the score:

At least one critical gap is open. A high score elsewhere cannot offset it. The band is at most Not yet ready.
Two or more high gaps are open. The band is at most Partly ready.
Six or more medium gaps are open. The band is at most Partly ready.

Critical and high gaps are always shown separately from the score. If more than a fifth of the controls that apply are unanswered or not known, the result is marked incomplete.

The roadmap

Critical gaps, and unknown answers on critical or high controls, are Now.
Other high and medium gaps whose duty takes effect on a future date go before that date.
High gaps whose duty is already in force, or has no fixed date, are Next 90 days.
Medium gaps whose duty is in force, or has no fixed date, are Within six months.
Low gaps are Ongoing.

Commencement: 11 August 2023, dPDP Act, 2023 receives assent. 13 November 2025, dPDP Rules, 2025 notified (DPDP Rules, 2025, r. 1(2)). 13 November 2026, consent Manager provisions take effect (DPDP Rules, 2025, r. 1(3)). 13 May 2027, remaining obligations take effect (DPDP Rules, 2025, r. 1(4)).

Evidence states

Each control answered Yes or Partly has an evidence state, from weakest to strongest. Each control also sets the level it needs.

Level	Means
Claimed	Answered as in place. Nothing attached shows it.
Documented	A written policy, procedure, notice or contract exists.
Implemented	Something shows it working: a screenshot of a setting, a log, a register.
Tested	A record shows it was tried and worked: a restore test, a breach drill, an access review.
Verified	A named, qualified reviewer accepted the evidence.

Evidence past its review date stops counting. In the workspace each control also shows a status:

Status	Means
Not started	Answered No or Not sure, with no work recorded.
In progress	Answered Partly, or a remediation task for it is under way.
In place · self-declared	Answered Yes; claimed, with nothing attached.
Documented · self-assessed	Current evidence shows it is documented. Implemented and tested read the same way.
Review due	All its evidence has passed its review date.
Reviewer asked for more	A reviewer looked at the evidence and asked for more.
Expert-verified	A named, qualified reviewer accepted its evidence, and the evidence is still current.

Result states

The result as a whole has one of three states. None of them is a certificate of compliance, and none is issued or approved by any government body.

Self-Assessed: Based on your answers. The free check is always Self-Assessed.
Evidence-Supported: In the workspace, every control answered as in place has current evidence at the level it needs. Nobody outside your organisation has checked it.
Expert-Verified: A named reviewer, whose qualification is shown, checked the evidence and accepted controls. The plain label is used only when every control answered as in place was accepted; otherwise the label itself carries the scope, for example Expert-Verified for 4 of 12 controls. The result always states the reviewer and the date, and the controls not accepted remain self-assessed.

What the result is not

Unless it is Expert-Verified, the result rests on your own answers and evidence. Even an Expert-Verified result covers only the controls the reviewer accepted, on the date of the review. No result is a certificate, a registration or an approval, and the readiness indicator is not a ruling that a regulator would agree with. The question bank is a draft awaiting review by a qualified data-protection lawyer, and every result says so until that review is complete.

Framework version 2026.10-draft.3.