How ready are you for the DPDP Act?
Answer plain-English questions about how your organisation handles personal data. Get an instant score out of 100, see your gaps ranked by legal risk, and see exactly how to close each one.
- No sign-up to see your score
- Based on the Act and the 2025 Rules
- We ask about your organisation, not you
Your answers save as you go, in this browser tab. Allow functional cookies if you want to finish on a later visit.
Where you stand, what is most at risk, what to do next.
A score out of 100
With a maturity band from Critical to Advanced. Missing a critical control caps the score, so the basics come first.
Area-by-area breakdown
Consent, notices, rights, security, breach, vendors and more, each weighted by what the Act penalises most.
Gaps ranked by risk
Every gap with its section of the Act, a plain-language fix, and the maximum penalty it exposes you to.
How to close each gap
The ConsentEra module that closes it, and a 30-60-90 day roadmap you can take to your leadership or Board.
13 areas. Every duty in the Act.
Each area maps to sections of the Act and the Rules. Areas that do not apply to you, such as children's data for a B2B business, are skipped and removed from your score.
-
Governance & accountability
Someone owns data protection, people know the rules, and leadership can see the risk.
s.8(1), s.8(9), R.9 · weight 6
-
Data inventory & records
You know what personal data you hold, where it lives, why you have it and who gets it.
s.5, s.8(1), s.8(3) · weight 10
-
Lawful basis & purpose
Every use of personal data rests on consent or a legitimate use, and stays within its purpose.
s.4, s.6, s.7 · weight 7
-
Privacy notice
People are told clearly what you collect, why, and how to use their rights, in a language they read.
s.5, R.3 · weight 9
-
Consent & withdrawal
Consent is free, specific, clear and provable, and withdrawing is as easy as giving it.
s.6, R.3 · weight 12
-
Children & persons with disabilityIf relevant
Verified parental or guardian consent, and no tracking or targeting of children.
s.9, R.10–12 · weight 8
-
Rights & grievances
People can see, correct and erase their data, nominate someone, and complain, and you respond on time.
s.11–14, R.14 · weight 10
-
Retention & erasure
Data is deleted when its purpose ends or consent is withdrawn, and you can show it.
s.8(7), s.8(8), R.8 · weight 8
-
Security safeguards
Reasonable safeguards to prevent a breach. This is the Act's highest-penalty duty.
s.8(5), R.6 · weight 12
-
Breach management
You can detect a personal data breach and tell the Board and the people affected, on time.
s.8(6), R.7 · weight 10
-
Processors & vendorsIf relevant
Vendors who process data for you do so only under a contract, and you stay in control.
s.8(1), s.8(2), s.8(7) · weight 6
-
Cross-border transfersIf relevant
You know where data goes outside India, and it goes only where the law allows.
s.16, R.15 · weight 2
-
Significant Data Fiduciary dutiesIf applicable
Extra duties if you are, or could be, notified as a Significant Data Fiduciary.
s.10, R.13
-
Beyond complianceOptional
Security and trust maturity: ISO 27001 and 27701, CERT-In 6-hour reporting, MFA, recovery, and your sector regulator's rules. Scored separately.
NIST CSF 2.0 · ISO/IEC 27001 · CERT-In Directions 2022
Transparent, explainable scoring.
No black box. Every number in your result can be traced back to your answers.
- Each answer scores. Yes counts 100%, Partly 50%, and No or Not sure 0%. “Doesn't apply” is left out of the score.
- Critical controls count double. These are the controls every other duty depends on, such as a named contact, proof of consent and a breach plan.
- Areas are weighted by risk. Consent and security weigh most, following the Act's penalty Schedule, where security failures reach ₹250 crore.
- Missing basics cap the score. One or two critical gaps cap it at 59. Three or more, or no named person responsible, cap it at 39.
- Gaps are ranked by priority. Priority is the area's weight × criticality × how far you are from “Yes” × the penalty tier.
Before you start.
Is it really free?
Yes, all of it. Your score, the breakdown by area, every gap with its fix, the 30-60-90 day roadmap and the PDF are yours without giving us any details. If you would like a specialist to go through it with you, the review call is free too.
Is this legal advice?
No. It is a structured self-assessment against the DPDP Act, 2023 and the DPDP Rules, 2025, built so that a business owner can complete it alone and a DPO can rely on its logic. For a validated view, book the free review call and a specialist will go through your answers with you.
What happens to my answers?
Your answers are about your organisation's practices, not about you, and they stay in your browser. Without your cookie consent we only count anonymous daily totals, such as how many assessments were completed, with no identifier. If you allow analytics cookies, we record how you move through the assessment under a random visitor id. If you allow functional cookies, your answers are remembered for 30 days so you can finish later. If you book a review call, we receive your answers under your reference code (GA-…). We never ask for your name here: you tell us who you are only if you send our contact form, and once you quote your reference there, your answers and visits become linked to your enquiry.
How long do you keep it, and can I have it deleted?
Assessments, visit records and our notes on an enquiry are deleted automatically 13 months after the last activity; anonymous daily totals are kept for 25 months. To see or delete what we hold, or to raise a grievance, write to us at the address on our contact page quoting your reference code: we erase the assessment and every visit linked to it. Withdrawing your cookie consent in the site footer removes the ids and saved answers from your browser at once.
How long does it take?
The quick check is 20 questions or fewer and takes about 5 minutes. The full assessment covers up to 57 controls in about 15 minutes, because questions that do not apply to you are skipped. You can stop and continue later at any point.
When do the DPDP obligations apply?
The DPDP Rules were notified on 13 November 2025. The Consent Manager regime starts on 13 November 2026, and almost every Data Fiduciary obligation, together with the penalties of up to ₹250 crore, applies from 13 May 2027.
What is a Significant Data Fiduciary?
An organisation the government notifies because of the volume or sensitivity of the data it processes, or the risk to people's rights. It carries extra duties: an India-based DPO, an annual DPIA and audit, and algorithmic due diligence. The assessment adds these questions only if they may apply to you.