Our resources provide the essential tools, guides, and insights to help your business stay ahead of data privacy regulations. From practical templates to expert articles, we ensure you have everything you need to navigate compliance with confidence.
Table of content
Last Updated: 2026-10-14 ~ DPDP Consultants
How compliant is your organisation with India's
Digital Personal Data Protection Act, 2023? Not in theory. Not based on what
your legal team believes. In practice, right now, today.
Most companies answer this question with vague
reassurances: "We have a privacy policy." "We updated our terms
and conditions." "Our legal team is handling it." But when you
drill into the specifics, the gaps become alarming. The privacy policy was last
updated two years ago. The consent notice does not list specific data
categories. There is no mechanism for Data Principals to exercise their rights.
The Grievance Officer exists only on paper. Vendor contracts have no data processing
clauses. And nobody knows where all the personal data actually resides.
The DPDP Act, 2023, and the DPDP Rules, 2025,
create a comprehensive framework of obligations for every entity that processes
digital personal data of individuals in India. The enforcement timeline is
clear. The penalties are significant, reaching up to Rs 250 crore for a Data
Fiduciary. And the Data Protection Board of India accepts complaints directly
from individuals, without requiring a lawyer or a fee.
This blog is a self-assessment tool. It provides
25 specific checkpoints, grouped into five categories, covering every major
compliance obligation under the DPDPA. For each checkpoint, you score your
organisation: Yes (fully implemented, 2 points), Partial (in progress or
incomplete, 1 point), or No (not started, 0 points). Your total score out of 50
tells you exactly where you stand and what you need to prioritise.
Be honest with yourself. This health check is
only useful if you answer based on what actually exists in your organisation
today, not what is planned, budgeted, or "almost done."
For each of the 25 checkpoints, evaluate your
organisation's current state and assign a score:
•
Yes (2 points):
The requirement is fully implemented, documented, and operational. It is not
just a policy on paper; it is actively working in your systems and processes.
•
Partial (1
point): The requirement is partially addressed. You may have started
implementation but it is incomplete, or you have a policy but no operational
process to back it up, or it covers some systems but not all.
•
No (0 points):
The requirement has not been addressed at all. There is no policy, no process,
no system, and no plan in motion.
Add up your scores across all 25 checkpoints.
Your total (out of 50) indicates your compliance posture:
•
40 to 50 points:
Strong compliance posture. You have built a solid foundation. Focus on
continuous improvement, monitoring, and staying current with regulatory
updates.
•
25 to 39 points:
Gaps to address urgently. You have made progress but significant areas need
attention before enforcement deadlines. Prioritise the checkpoints where you
scored 0 or 1.
•
0 to 24 points:
Significant risk exposure. Your organisation is substantially non-compliant.
You need a structured compliance programme immediately. Every day without
action increases your exposure to penalties, Data Protection Board complaints,
and reputational damage.
Category A: Consent and Notice (Points 1 to 5)
Consent is the cornerstone of the DPDPA. Without
lawful, informed, specific consent (or a valid legitimate use), no processing
of personal data is permitted. These five checkpoints assess whether your
consent architecture meets the law's requirements.
|
# |
Checkpoint |
Yes (2) |
Partial (1) |
No (0) |
|
1 |
Consent
Notice Provided Before Data Collection |
Clear, itemised notice in plain
language provided before or at the time of data collection, listing each data
category and purpose |
Notice exists but is vague, bundled, or
not provided before or at the time of collection |
No consent notice provided, or it is
buried in generic terms and conditions |
|
2 |
Consent Is Free, Specific, Informed,
and Unconditional |
Separate consent for each purpose;
service access is not conditional on consenting to unnecessary processing |
Some consent granularity exists but
certain purposes are still bundled; partial conditionality |
Single 'I Agree' button for all
purposes; service access refused if any consent is declined |
|
3 |
Consent
Notice Available in Required Languages |
Notice available in English or any
other 22 scheduled languages of India as required which the Data Principals
can easily read and understand |
Notice available only in one language
which is mentioned under the 22 scheduled languages but the Data Principals cannot read or
understand |
Notice available only in one local
language which doesn’t fall under the 22 scheduled languages |
|
4 |
Mechanism to Withdraw Consent |
Easy, accessible withdrawal mechanism
(as simple as giving consent); consequences communicated before action |
Withdrawal option exists but is
difficult to find or involves multiple steps beyond what giving consent
required |
No withdrawal mechanism available;
users must email or call to withdraw consent |
|
5 |
Consent
Records Maintained |
Timestamped records of consent given,
purposes consented to, version of notice shown, and any withdrawals |
Some consent records exist but are
incomplete, not timestamped, or not centrally maintained |
No records of consent are maintained;
unable to demonstrate valid consent was obtained |
A company that scores 0 on any checkpoint in
this category is processing personal data without a lawful basis. This is the
most fundamental compliance requirement under the DPDPA, and it is also the
most common area of non-compliance. Many organisations have a privacy policy
but no compliant consent notice. They have a single 'I Agree' button but no
granular consent mechanism. They collect consent but maintain no records to
prove it.
Category B: Data Principal Rights (Points 6 to 10)
The DPDPA grants Data Principals (individuals
whose data is processed) a set of legally enforceable rights. These checkpoints
assess whether your organisation can actually fulfil these rights when a
request arrives.
|
# |
Checkpoint |
Yes (2) |
Partial (1) |
No (0) |
|
6 |
Published
Rights Request Mechanism |
Dedicated page on website/app with
clear forms for access, correction, erasure, grievance, and nomination
requests |
Some mechanism exists (email address,
generic contact form) but not a dedicated, structured rights request system |
No published mechanism for Data
Principals to exercise their rights |
|
7 |
Right to Access Fulfilled |
Can compile and deliver a summary of
all personal data held, processing purposes, and all entities data was shared
with, within defined timelines |
Can provide partial data from primary
systems but cannot cover all databases, vendors, and third parties |
Cannot locate or compile an
individual's data across systems; no process for access requests |
|
8 |
Right
to Correction and Erasure Fulfilled |
Can correct data across all systems and
propagate erasure to every database, vendor, and backup, with documented
legal exceptions |
Can correct/erase in primary systems
but cannot ensure correction/erasure across all processors, vendors, or
backup systems |
No process for correction or erasure
requests; data cannot be traced across all systems |
|
9 |
Right to Withdraw Consent
Operationalised |
Withdrawal mechanism as easy as giving
consent; processing stops upon withdrawal; consequences communicated; records
updated |
Withdrawal option exists but processing
does not stop immediately or does not propagate to all processors |
No operational mechanism for consent
withdrawal; no process to stop processing upon withdrawal |
|
10 |
Grievance
Redressal Mechanism Operational |
Named Grievance Officer with published
contact details, structured complaint process, response within defined
timelines, resolution within 90 days |
Grievance Officer appointed but lacks
tools, authority, or defined process; timelines not tracked |
No Grievance Officer appointed, or
appointed only on paper with no operational mechanism |
Data Principal rights are not optional features.
They are legal mandates. If a Data Principal exercises their rights and your
organisation cannot respond within the prescribed timelines, the individual can
escalate directly to the Data Protection Board of India, no lawyer or fee
required. Your score in this category tells you whether you can survive that
first request.
Category C: Security and Breach Response (Points 11 to 15)
Rule 6 of the DPDP Rules, 2025, requires Data
Fiduciaries to implement reasonable security safeguards to prevent personal
data breaches. Rule 7 mandates breach notification. These checkpoints assess
whether your security and breach response capabilities meet the legal standard.
|
# |
Checkpoint |
Yes (2) |
Partial (1) |
No (0) |
|
11 |
Encryption
of Personal Data |
All personal data encrypted both at
rest and in transit across all systems, databases, backups, and communication
channels |
Encryption implemented for some systems
or only in transit but not at rest, or not covering all data stores |
No encryption of personal data, or
encryption applied inconsistently with significant gaps |
|
12 |
Access Controls Implemented |
Role-based access controls restricting
personal data access to authorised personnel only; access logs maintained;
regular reviews conducted |
Access controls exist for primary
systems but not all data stores; access reviews are infrequent or incomplete |
No formal access controls; personal
data accessible to employees who do not need it |
|
13 |
Data
Masking and Anonymisation |
Data masking, pseudonymisation, or
anonymisation applied where appropriate to reduce risk; clear policy on when
and how to apply these techniques |
Some data masking in place but not
consistently applied across environments (dev, test, analytics) |
No data masking or anonymisation
practices; full personal data used in all environments including testing |
|
14 |
Breach Detection and Notification
Process |
Defined breach detection mechanisms,
incident response plan, ability to notify the Data Protection Board and
affected Data Principals within 72 hours |
Incident response plan exists but has
not been tested; notification timelines not clearly defined or rehearsed |
No breach detection mechanism; no
incident response plan; no process for notifying the Board or individuals |
|
15 |
Security
Logs Retained for One Year |
System logs, processing logs, and
associated traffic data retained for minimum one year for detection,
investigation, and remediation as required by Rule 6 |
Some logs retained but not
comprehensively across all systems; retention period inconsistent |
No systematic log retention; unable to
investigate or provide evidence in case of a breach inquiry |
The maximum penalty under the DPDPA, Rs 250
crore, applies to failure to implement reasonable security safeguards resulting
in a personal data breach. This is not a theoretical risk. Every organisation
processes personal data, and every organisation is a potential target for data
breaches. Your score in this category directly correlates with your security
risk.
Category D: Governance and Accountability (Points 16 to 20)
Compliance is not a one-time project. It
requires ongoing governance structures, defined roles, training, and continuous
monitoring. These checkpoints assess whether your organisation has the
governance framework to sustain compliance.
|
# |
Checkpoint |
Yes (2) |
Partial (1) |
No (0) |
|
16 |
Data
Protection Officer / Contact Person Appointed |
DPO or designated contact person
appointed with clear authority, adequate resources, and published contact
details as required |
Contact person designated but lacks
authority, resources, or visibility; contact details not published |
No DPO or contact person appointed for
data protection matters |
|
17 |
Data Inventory and Data Flow Map |
Comprehensive inventory of all personal
data: what is collected, where it is stored, purposes, retention periods,
third parties it is shared with, and cross-border transfers |
Partial inventory exists covering
primary systems but not all departments, vendors, or legacy systems |
No data inventory; organisation cannot
answer where personal data resides across its systems |
|
18 |
Defined
Data Retention and Erasure Policy |
Written retention policy specifying
retention periods for each data category, legal basis for retention, and
automated or scheduled erasure when the purpose is fulfilled |
Retention policy exists in general
terms but does not cover all data categories or lacks scheduled erasure
processes |
No retention policy; data retained
indefinitely with no defined deletion schedules |
|
19 |
Employee Awareness and Training
Programme |
Regular DPDPA awareness training for
all employees who handle personal data; training records maintainance;
refresher sessions conducted periodically |
Some training conducted but not
comprehensive, not regular, and not covering all relevant employees |
No data protection training; employees
unaware of DPDPA obligations and their responsibilities |
|
20 |
Data
Protection Impact Assessment (DPIA) |
DPIAs conducted for high-risk
processing activities; results documented and acted upon; process defined for
triggering DPIAs for new projects or changes |
DPIAs conducted for some activities but
not systematically; no defined trigger process for new projects |
No DPIAs conducted; high-risk
processing activities not assessed for data protection impact |
Organisations that score well in Categories A to
C but poorly in Category D typically have project-based compliance rather than
sustainable compliance. They implemented consent notices and security controls
but lack the governance structures to maintain, monitor, and adapt them as the
organisation and regulatory landscape evolve. When the DPDPA is amended, when
new rules are notified, or when the organisation launches a new product, the
absence of governance means the compliance gaps reopen immediately.
Category E: Third-Party Management and Documentation (Points 21 to 25)
Your compliance is only as strong as your
weakest vendor. If you share personal data with a third-party processor,
analytics provider, cloud vendor, or marketing partner that suffers a breach or
mishandles data, your organisation is accountable. These checkpoints assess
whether your third-party ecosystem is covered.
|
# |
Checkpoint |
Yes (2) |
Partial (1) |
No (0) |
|
21 |
Data
Processing Agreements with All Processors |
Written agreements with every Data
Processor specifying data categories, processing purposes, security
obligations, breach notification requirements, and audit rights |
Agreements exist with some processors
but not all; agreements lack specific DPDPA-required clauses |
No data processing agreements; personal
data shared with vendors based on informal arrangements |
|
22 |
Third-Party Security Assessment |
Periodic security assessments of all
Data Processors and third parties handling personal data; documented results
and remediation tracking |
Assessments conducted for some third
parties but not all; no periodic reassessment cycle |
No third-party security assessments; no
visibility into how vendors protect your Data Principals' data |
|
23 |
Cross-Border
Data Transfer Compliance |
Personal data transfers only to
countries not on the restricted list; privacy notice discloses the countries
data is transferred to; contractual safeguards in place |
Some cross-border transfers documented
but not all; privacy notice does not fully disclose transfer destinations |
No awareness of cross-border data
flows; no contractual safeguards for international transfers |
|
24 |
Children's Data Protection Measures |
Verifiable parental consent mechanism
for processing data of individuals under 18; no behavioural monitoring or
targeted advertising directed at children |
Some age verification in place but
verifiable parental consent mechanism is not robust; tracking policies
unclear |
No age verification; no parental
consent mechanism; children's data processed without any additional
safeguards |
|
25 |
Compliance
Documentation and Audit Trail |
Complete documentation of all
compliance measures: consent records, rights request logs, breach response
records, DPIA reports, training records, vendor assessments, and policy
versions |
Some documentation exists but is
fragmented, incomplete, or not centrally maintained |
No compliance documentation; unable to
demonstrate compliance to the Data Protection Board if required |
Documentation is the bridge between compliance
and evidence of compliance. Without it, even a genuinely compliant organisation
looks non-compliant to the Data Protection Board. When the Board investigates a
complaint, it asks for records: consent logs, rights request processing
records, breach notifications, DPIA reports, vendor agreements, and training
records. If these documents do not exist, the Board has no basis to conclude
that the organisation met its obligations.
Your Compliance Scorecard Summary
Use the table below to record your scores across
all five categories and calculate your total compliance score.
|
Category |
Checkpoints |
Max Score |
Your Score |
|
A:
Consent and Notice |
1
to 5 |
10 |
______
/ 10 |
|
B: Data Principal Rights |
6 to 10 |
10 |
______ / 10 |
|
C:
Security and Breach Response |
11
to 15 |
10 |
______
/ 10 |
|
D: Governance and Accountability |
16 to 20 |
10 |
______ / 10 |
|
E:
Third-Party and Documentation |
21
to 25 |
10 |
______
/ 10 |
|
TOTAL |
1 to 25 |
50 |
______ / 50 |
Interpreting Your Score
40 to 50 points: Your organisation has a strong
compliance foundation. Focus on continuous improvement, staying current with
regulatory updates, conducting regular internal audits, and refreshing employee
training. Consider engaging an external auditor for independent validation.
25 to 39 points: Your organisation has made
progress but has gaps that create compliance risk. Identify every checkpoint
where you scored 0 or 1 and create a prioritised remediation plan. Focus first
on Category A (consent) and Category C (security), as these carry the highest
penalty exposure. Engage professional support to close the gaps before
enforcement deadlines.
0 to 24 points: Your organisation is
substantially non-compliant with the DPDPA. This level of exposure puts you at
risk of penalties up to Rs 250 crore, Data Protection Board complaints,
reputational damage, and loss of customer trust. You need a structured,
comprehensive compliance programme immediately. Do not attempt to address this
piecemeal; engage experienced DPDPA consultants who can build the entire
compliance infrastructure.
Wherever you scored on this health check, DPDP
Consultants provides the expertise and technology to move your organisation to
full compliance.
Gap Assessment
We conduct a comprehensive assessment against
every requirement of the DPDPA and the DPDP Rules, 2025, covering all 25
checkpoints in this health check and more. The assessment produces a detailed
gap report with a prioritised remediation roadmap tailored to your
organisation's size, sector, and risk profile.
Privacy Framework Implementation
We design and implement the complete compliance
infrastructure: consent notices, granular consent mechanisms, rights request
portals, data inventories, retention policies, breach response plans, DPIA
frameworks, and documentation systems.
Consent Management
Our Consent Management platform captures,
tracks, and manages consent across all touchpoints with granular consent
options, multilingual support, version tracking, withdrawal mechanisms, and
timestamped consent records that serve as evidence of compliance.
DPO as a Service
We provide an experienced Data Protection
Officer who oversees your entire compliance programme, manages Data Principal
requests, handles breach notifications, liaises with the Data Protection Board,
and ensures ongoing compliance as regulations evolve.
Grievance Redressal System
We implement a structured grievance redressal
mechanism with a dedicated portal, automated acknowledgements, case tracking,
timeline monitoring, escalation alerts, and a complete audit trail for every
complaint.
Third-Party Assessment
We assess every vendor, partner, and Data
Processor in your ecosystem to ensure they meet your compliance obligations,
have appropriate data processing agreements, implement adequate security
safeguards, and can support your Data Principal request and breach notification
requirements.
Awareness Programme
We deliver customised DPDPA awareness training
programmes for your employees, covering their specific roles and
responsibilities in handling personal data, recognising data breaches,
processing Data Principal requests, and maintaining compliance in their daily
operations.
Frequently Asked Questions (FAQs)
Q: When do the DPDPA compliance
obligations take effect?
The DPDP Rules, 2025, were notified on 14
November 2025. The substantive compliance obligations for Data Fiduciaries,
including consent management, Data Principal rights, breach notification, and
security safeguards, become fully enforceable by May 2027. However, companies
should not wait until the deadline. Building a compliance infrastructure takes
time, and early movers gain a competitive advantage in customer trust and
regulatory goodwill.
Q: Does this health check apply to
all businesses in India?
Yes. The DPDPA applies to every entity that
processes digital personal data of individuals in India, regardless of the
entity's size or sector. Whether you are a startup, an SME, or a large
enterprise, if you collect personal data through a website, app, or any digital
channel, these 25 checkpoints apply to you. The scale and complexity of
implementation will vary, but the obligations are universal.
Q: What are the penalties for
non-compliance?
Penalties under the DPDPA for a Data Fiduciary
range up to Rs 250 crore for failure to implement reasonable security
safeguards resulting in a personal data breach. Non-compliance with Data
Fiduciary obligations (including consent, Data Principal rights, and notice
requirements) attracts penalties up to Rs 50 crore. Violations related to
children's data can attract penalties up to Rs 200 crore. Failure to notify the
Board and affected Data Principals of a breach can attract penalties up to Rs
200 crore.
Q: What additional obligations do
Significant Data Fiduciaries have?
Significant Data Fiduciaries (SDFs), as
designated by the Central Government based on data volume and sensitivity, must
appoint a Data Protection Officer resident in India, appoint an independent
Data Auditor, conduct annual Data Protection Impact Assessments, and conduct
annual algorithmic audits. These are additional requirements on top of the 25
checkpoints in this health check.
Q: Can we use this health check as
evidence of compliance?
This health check is a self-assessment tool, not
a formal audit or certification. However, the process of completing it and
documenting your scores, gaps, and remediation plans contributes to your
compliance documentation. If the Data Protection Board investigates a
complaint, demonstrating that you conducted regular self-assessments and
actively worked to address identified gaps is evidence of good faith compliance
efforts.
Q: How often should we conduct
this health check?
At minimum, conduct a full assessment annually.
Additionally, reassess whenever there is a significant change: launching a new
product that collects personal data, engaging a new Data Processor, expanding
into new geographies, or when the DPDPA or its rules are amended. Regular
assessment ensures compliance does not degrade over time.
Q: What is the difference between
a Data Fiduciary and a Data Processor under the DPDPA?
A Data Fiduciary determines the purpose and
means of processing personal data. A Data Processor processes personal data on
behalf of the Data Fiduciary. The Data Fiduciary bears primary accountability
for compliance, including ensuring that its Data Processors meet the required
security and processing standards through contractual agreements. If a Data
Processor causes a breach, the Data Fiduciary remains accountable to the Data
Principal and the Data Protection Board.
Q: Does the DPDPA apply to data
collected before the Act came into effect?
Yes. The DPDPA applies to personal data
processed before the Act came into force. Data Fiduciaries must provide a
consent notice to Data Principals for data already in their possession "as
soon as it is reasonably practicable." This means your existing databases,
CRM records, and historical customer data are all covered. Your data inventory
(Checkpoint 17) must include all personal data, not just data collected after
the Act.
Know Your Score. Close Your Gaps. Build Compliance.
This health check tells you where
you stand. DPDP Consultants takes you where you need to be. From Gap
Assessments and Privacy Framework Implementation to Consent Management, DPO as
a Service, Grievance Redressal, Third-Party Assessments, and Awareness Programmes,
we build your complete DPDPA compliance infrastructure.
Contact us today:
Website: www.dpdpconsultants.com
Email: info@dpdpconsultants.com | Toll-free: 1800-571-1333
Compliance is not a destination. It is an ongoing
commitment to the people whose data you hold.
Disclaimer: This
document is prepared by DPDP Consultants for informational purposes only. It
does not constitute legal advice and should not be relied upon as a substitute
for professional legal counsel. The information contained herein is based on
the Digital Personal Data Protection Act, 2023, and the DPDP Rules, 2025, as of
October 2026. Laws, regulations, and their interpretations may change. Readers
should consult qualified legal professionals for advice specific to their
circumstances. DPDP Consultants assumes no liability for any actions taken or
not taken based on the contents of this document.
