Is your organisation ready for the DPDP Act? Find out before 13 May 2027.
A free DPDP compliance self-assessment, in 21 short sections, against the Digital Personal Data Protection Act, 2023 and the DPDP Rules. Answer honestly and you get a readiness score, your compliance gaps ranked by priority, the penalty ceilings they map to, and a phased roadmap to close them.
Your answers are never stored — the report link lasts 30 minutes
By Fintacy Solutions Private Limited
What you get
1An overall readiness score and band, plus a score for each of 11 areas
2Every “No” ranked by priority and penalty ceiling
3A phased 0–3 / 3–6 / 6–12 month roadmap
4A PDF you can share with your board
Key terms
DPDP Act key terms, in plain language.
What is a Data Fiduciary? A Data Principal? Personal data, processing, consent? These terms appear throughout the DPDP Act, the assessment and your report. Each card explains one in everyday words, and the Act’s exact wording is one tap away.
1 / 9
Personal data
Any information about a person who can be identified from it — either from the information itself or in relation to it. Data doesn’t need to carry a name to count; what matters is whether it can be tied to an identifiable individual.
For example. A customer’s name, phone number, email address, photograph or order history.
The Act applies to personal data in digital form, and to personal data collected on paper that is digitised afterwards (Section 3).
The Act’s exact wording
“personal data” means any data about an individual who is identifiable by or in relation to such data
Digital Personal Data Protection Act, 2023 — Section 22 / 9
Processing
Almost anything you do with digital personal data, using automated means wholly or partly: collecting it, recording, organising, structuring, storing, using, sharing, making it available, restricting it, and even erasing or destroying it. The Act says “includes”, so its list gives examples rather than a complete list.
For example. Keeping customer details in a CRM, emailing a file that contains them, running them through analytics, or deleting them when the retention period ends — each of these is processing.
The Act’s exact wording
“processing” in relation to personal data, means a wholly or partly automated operation or set of operations performed on digital personal data, and includes operations such as collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment or combination, indexing, sharing, disclosure by transmission, dissemination or otherwise making available, restriction, erasure or destruction
Digital Personal Data Protection Act, 2023 — Section 23 / 9
Data Fiduciary
The person who decides why personal data is processed (the purpose) and how (the means) — alone or together with others. “Person” is wide in the Act: it covers individuals, companies, firms, Hindu undivided families, associations and the State. If you decide why and how your customers’, employees’ or vendors’ data is used, you are a Data Fiduciary, and the Act’s core obligations fall on you.
A business that only handles personal data on someone else’s behalf is a Data Processor, which the Act defines separately.
The Act’s exact wording
“Data Fiduciary” means any person who alone or in conjunction with other persons determines the purpose and means of processing of personal data
Digital Personal Data Protection Act, 2023 — Section 24 / 9
Data Principal
The individual the personal data is about — your customer, employee, job applicant or website visitor. Where that individual is a child, the term includes the child’s parents or lawful guardian. Where the individual is a person with disability, it includes her lawful guardian acting on her behalf.
The Act’s exact wording
“Data Principal” means the individual to whom the personal data relates and where such individual is— (i) a child, includes the parents or lawful guardian of such a child; (ii) a person with disability, includes her lawful guardian, acting on her behalf
Digital Personal Data Protection Act, 2023 — Section 25 / 9
Child
Anyone who has not completed eighteen years of age — the Act draws the line at 18. Before processing a child’s personal data, a Data Fiduciary must obtain verifiable consent from the parent or lawful guardian. It must not process a child’s data in a way likely to harm the child’s well-being, and must not track or monitor children’s behaviour or direct targeted advertising at them (Section 9).
The same verifiable-consent rule applies to a person with disability who has a lawful guardian. The Rules can exempt certain classes of organisations and purposes from parts of Section 9.
The Act’s exact wording
“child” means an individual who has not completed the age of eighteen years
Digital Personal Data Protection Act, 2023 — Section 26 / 9
Specified purpose
The purpose mentioned in the notice you give the Data Principal — in everyday words, the reason you told the person you needed their data. It matters because consent has to be for the specified purpose and limited to the personal data necessary for it (Section 6).
For example. The Act’s own illustration: a telemedicine app asks for consent to process personal data to provide telemedicine and also to access the phone’s contact list. The contact list isn’t necessary for telemedicine, so the consent covers only the telemedicine purpose.
The Act’s exact wording
“specified purpose” means the purpose mentioned in the notice given by the Data Fiduciary to the Data Principal in accordance with the provisions of this Act and the rules made thereunder
Digital Personal Data Protection Act, 2023 — Section 27 / 9
Consent Manager
A person registered with the Data Protection Board who acts as a single point of contact so that a Data Principal can give, manage, review and withdraw her consent, through a platform that is accessible, transparent and interoperable.
This is a registered role. It is relevant to you only if you intend to offer that service — not every organisation needs to be one.
The Act’s exact wording
“Consent Manager” means a person registered with the Board, who acts as a single point of contact to enable a Data Principal to give, manage, review and withdraw her consent through an accessible, transparent and interoperable platform
Digital Personal Data Protection Act, 2023 — Section 28 / 9
Significant Data Fiduciary
A Data Fiduciary, or class of Data Fiduciaries, that the Central Government notifies under Section 10. The Government decides after assessing relevant factors, including the volume and sensitivity of personal data processed, risk to the rights of Data Principals, and the potential impact on the sovereignty and integrity of India, risk to electoral democracy, security of the State and public order. Significant Data Fiduciaries carry extra duties: appointing a Data Protection Officer and an independent data auditor, and carrying out periodic Data Protection Impact Assessments and audits.
You are one only if notified — size alone doesn’t make you one, and you can’t declare yourself one. Checklist items that say “if you are a Significant Data Fiduciary” apply only if you have been notified.
The Act’s exact wording
“Significant Data Fiduciary” means any Data Fiduciary or class of Data Fiduciaries as may be notified by the Central Government under section 10
Digital Personal Data Protection Act, 2023 — Section 29 / 9
Data Protection Officer
An individual appointed by a Significant Data Fiduciary under Section 10(2)(a). Under that section the Data Protection Officer must represent the Significant Data Fiduciary under the Act, be based in India, be an individual responsible to its Board of Directors or similar governing body, and be the point of contact for the grievance redressal mechanism under the Act.
In the Act, the formal Data Protection Officer role belongs to Significant Data Fiduciaries.
The Act’s exact wording
“Data Protection Officer” means an individual appointed by the Significant Data Fiduciary under clause (a) of sub-section (2) of section 10
Digital Personal Data Protection Act, 2023 — Section 2
The notes are plain-language explanations to help you read the Act; where they differ in any way, the Act’s own wording prevails. Source: the Digital Personal Data Protection Act, 2023 (No. 22 of 2023), Section 2 and the sections named on each card.
How it works
How the DPDP readiness check works.
1
Answer 21 short sections
Yes, No or Not Applicable for each point, or one click to mark a whole section. Nothing is pre-filled — the score is only as useful as your answers are candid.
2
Get your score
Higher-priority items weigh more. A “No” counts against you; “Not Applicable” is left out of the maths.
3
Act on the gaps
The report ranks your gaps, shows the penalty ceiling each maps to, and lays out a roadmap. Want help? Message us with the reference number.
About your organisation
Both fields are optional and only appear on your report.
Answer “Not Applicable” only where an item genuinely doesn't apply to you. A draft is kept in this browser (not on our servers) so you can pause and return; it is cleared once you generate your report.
The assessment
DPDP compliance checklist: 21 short sections across 11 areas
Loading the checklist…
0 of 54 answered
Questions
DPDP readiness check: common questions
What is the DPDP Act?
The Digital Personal Data Protection Act, 2023 (the DPDP Act) is India’s law on the processing of digital personal data. It places obligations on organisations that decide why and how personal data is used (Data Fiduciaries) and gives rights to the individuals the data is about (Data Principals). The DPDP Rules, 2025 set out the detailed requirements.
Who does the DPDP Act apply to?
It applies to the processing of digital personal data within India — including personal data collected on paper and digitised afterwards — and to processing outside India where it is connected with offering goods or services to people in India. It does not apply to personal data an individual processes for personal or domestic purposes.
What are the penalties under the DPDP Act?
The Schedule to the Act sets maximum penalties: up to ₹250 crore for failing to take reasonable security safeguards to prevent a personal data breach; up to ₹200 crore for failing to notify a breach, or for breaching the additional obligations for children’s data; up to ₹150 crore for breaching a Significant Data Fiduciary’s obligations; and up to ₹50 crore for any other breach. These are ceilings, not fixed fines — the Data Protection Board decides the actual amount.
When do the DPDP Rules come into force?
The DPDP Rules, 2025 were notified on 13 November 2025 and are being phased in. The Consent Manager provisions apply from 13 November 2026, and most of the substantive obligations — notice, consent, security safeguards, breach reporting and children’s data — from 13 May 2027.
Do you store my answers?
No. Your answers are used to build the report in memory and are never stored on our servers. The report is kept for 30 minutes so your link works, then purged. We're told only that a report was made (its reference number and score), never your name or organisation. If you choose “send me a copy”, the name, email or phone you give us, and your organisation's name, go to our team through our email and messaging providers so we can send the PDF and follow up. We use them for that only, and you can ask us to delete them at any time.
Is this legal advice?
No. It is a self-assessed maturity indicator based only on your answers, which we have not verified. Penalty figures are statutory ceilings, not predictions — the Data Protection Board decides the actual amount. Please consult a qualified professional before acting on it.
How is the score worked out?
Each item has a weight — High 3, Medium 2, Low 1. “Yes” earns the weight, “No” earns nothing but the weight still counts toward the maximum, and “Not Applicable” is excluded from both. 80% and above is Established, 50–79% Developing, below 50% Basic / Ad-hoc.
Why must every item be answered?
A skipped item would quietly inflate your score. If something doesn't apply to you, mark it Not Applicable — that is a deliberate answer, and it is removed from the calculation.
The law works through everyday situations. Here they are, retold as short stories, so you can see how it plays out. The first thirteen come from the Act’s own examples. The rest come from the Digital Personal Data Protection Rules, 2025, most of which apply from 13 May 2027.
Who's covered
The blogger who shared it herself
Meera writes a blog and, in one post, shares some personal details about herself on social media. Since she put it out there herself, the DPDP Act simply doesn’t apply to that publicly shared information.
Key terms
Notice
The bank and the video KYC
Arjun opens a bank account through the bank’s app and picks the live video call to complete his KYC. Before the bank asks for any of his details, it has to tell him exactly what it’s collecting and why.
Key terms
Notice
Agreed before the law existed
Neha signed up to a shopping app long before the Act came in. That doesn’t let the app off the hook: once the law starts, it still has to tell her, by email, an in-app message or some other effective way, what data it holds and why. Until she withdraws her consent, the app can carry on.
Key terms
Consent
The telemedicine app and the contact list
A telemedicine app asks Kabir to agree to two things: using his data to run his consultation, and going through his phone contacts. He taps “agree” to both. But his contacts aren’t needed to deliver a consultation, so his consent only covers the telemedicine part. Ask only for what you actually need.
Key terms
Consent
The waiver hidden in the fine print
Sana buys an insurance policy on an app. Tucked into what she agrees to is giving up her right to complain to the Data Protection Board. That part doesn’t stand — the waiver is invalid. Her consent to issue the policy is untouched.
Key terms
Consent
Changing your mind after you’ve paid
Vikram orders something on a shopping app and pays. Later he withdraws his consent. The app can stop him placing new orders, but it can’t stop using his details to deliver what he already ordered and paid for.
Key terms
Consent
When the helper has to stop too
A phone company hires another firm to email customers their bills. Zoya, a customer, had agreed to email bills, but she then switches to the company’s app and chooses to get bills only there. The phone company has to stop emailing her bills, and make sure the firm it hired stops too.
Key terms
Legitimate uses
The pharmacy receipt
Priya buys medicine and asks the pharmacy to text her a payment receipt, so she gives them her mobile number. The pharmacy can use her number for exactly that: sending the receipt.
Key terms
Legitimate uses
The broker who has to stop
Rohan messages a real estate broker asking for help finding a rental and shares his details. The broker can use them to find and send him listings. When Rohan later says he no longer needs help, the broker has to stop using his data.
Key terms
Legitimate uses
The maternity benefit
A pregnant woman signs up on a government app for a maternity benefits programme and gives her details for that. The government can also use that same data to check whether she qualifies for other benefits it runs.
Key terms
Erasure & retention
The car has been sold
Asha lists her old car on an online marketplace and gives her details for the sale. Once the car is sold, the marketplace has no reason to keep her personal data, so it shouldn’t.
Key terms
Erasure & retention
The bank that has to keep records
Imran closes his savings account. Banks are legally required to keep clients’ identity records for ten years after an account closes, so the bank can keep his details for that period even though he has left.
Key terms
Exemptions
The missed loan instalment
Kiran takes a loan and misses her monthly instalment. The bank can use her personal data to work out her financial position, meaning her assets and liabilities.
Key terms
Notice
A notice that stands on its own
A fitness app asks Nisha for consent. Its notice has to make sense by itself, not be buried in other terms. It lists exactly which data it wants (say her name, phone number and heart-rate readings), says what each is for and what the app will do with it, and gives a link and other ways to withdraw her consent as easily as she gave it, to use her rights, or to complain to the Data Protection Board.
Key terms
Security
Locking the door and keeping the log
A start-up keeps its customer records with an outside vendor. It encrypts or masks the data, controls who can get in, keeps logs so it can spot and investigate unauthorised access, and keeps backups so it can carry on if data is lost. It writes the same safeguards into its contract with the vendor, and it keeps those logs, and the personal data they relate to, for a year.
Key terms
Breach
The 72-hour clock
A small online shop finds that a file with customers’ emails and orders was exposed. It tells each affected customer, without delay and in plain words: what happened, what it could mean for them, what the shop is doing about it, what they can do to protect themselves, and who to contact. It tells the Data Protection Board straight away too, and within 72 hours sends the fuller picture: the facts and reasons, what has been done, and how customers were told. The Board can allow longer if the shop asks in writing.
Key terms
Keeping records
The e-book and the deleted account
Dev buys an e-book on an online platform. Once it is delivered, the reason for using his data is over. But even if he deletes his account, the platform still has to keep his order details, his personal data and the records of what it did (like the order confirmation, payment and delivery) for at least a year from the purchase.
Key terms
Keeping records
The cloud host
A company hosts its customer records with a cloud provider. As the one in charge of the data, the company has to make sure the provider also keeps the data and its records for at least a year before erasing them, unless another law says longer.
Key terms
Erasure
Three years of not logging in
A large online shop (two crore or more registered users in India) has not heard from Tanya in three years: no purchase, no login, no request. For most purposes it must now erase her data, unless a law says to keep it. At least 48 hours before it does, it warns her that it will, unless she logs in or gets in touch. The same three-year rule covers big online gaming platforms (fifty lakh or more users) and big social media platforms (two crore or more).
Key terms
Your rights
Who do I ask?
Pooja writes to a company asking what data it holds about her. Its reply has to include the contact details of the person who can answer her questions about how her data is used (its Data Protection Officer, if it has one). The same contact also has to be published prominently on its website or app.
Key terms
Your rights
Ninety days at most
Karan wants some of his data corrected. The company’s website shows how to make the request and what identifier it needs to find him, such as his registered email or mobile number. If he complains, the site also has to say how long a reply will take, and that cannot be more than ninety days. He can also nominate someone to act for him.
Key terms
Children
A child opens an account: mum is already a member
Ira, a child, wants an account on a platform and says her mother, Meena, is her parent. Meena is already a member and has shared her identity and age details before. Before the platform uses Ira’s data to set up the account, it has to check that it holds reliable identity and age details for Meena and that she is an identifiable adult. It works the same way if Meena opens the account for Ira.
Key terms
Children
A child opens an account: mum is new
This time Meena is not a member. Before setting up Ira’s account, the platform has to check that Meena is an identifiable adult, using identity and age details issued by an entity the law or the Government has entrusted with them, or a virtual token linked to those details. Meena can share such details voluntarily, for example through a Digital Locker service. Again, the same applies if Meena starts the account.
Key terms
Children
The school and its bus
A school tracks its pupils for its educational activities and their safety, and the transport operator it hires tracks the school bus’s location on the way to and from school. The usual parental-consent step and the ban on tracking children do not apply to them, but only for those purposes: the school for educational activities and children’s safety, and the bus operator for the children’s safety during the journey.
Key terms
Children
The clinic
A clinic uses a child’s health information to treat her. The usual parental-consent step and the ban on tracking children do not apply to it, but only as far as is necessary to protect her health.
Key terms
Children
The email-only account
A child signs up for an account that will only be used to send and receive email. The platform can create it without the usual parental-consent step, but it may use only what is needed to create that account, and the account may only be used for email.
Key terms
Guardians
Acting for someone who cannot decide alone
Rohit has a disability that means he cannot take legally binding decisions on his own. His sister says she is his lawful guardian. Before taking her consent for Rohit’s data, the platform has to check carefully that she was appointed by a court, by a designated authority or by a local-level committee, under the law on guardianship.
Key terms
Consent Manager
Two banks, one consent app: straight to the bank
Farah uses a consent platform run by a registered Consent Manager. A bank, B1, asks her through the platform for consent to use the data in her bank statement, which she keeps in her digital locker. She gives her consent straight to B1 and lets it see the statement.
Key terms
Consent Manager
Two banks, one consent app: through her own bank
Same request, different route. Farah’s statement sits with her other bank, B2. She uses the platform to pass her consent through B2 to B1, and tells B2 digitally to send her statement to B1. B2 then sends it.
Key terms
Research
The research study
A university team analyses personal data for research or statistics. The Act does not apply to that, but only if the work meets the Rules’ standards: it is lawful, limited to the data it needs, reasonably complete and accurate, kept only as long as required, and reasonably secured.
Key terms
1 / 30
These stories are simplified retellings for easy reading. Those about consent platforms, child accounts and keeping records follow the Rules’ own examples; the others are everyday illustrations of what a rule requires. They are not legal advice; please consult a qualified professional about your own situation.