DPDP readiness review
Know where you really stand, with evidence.
The free check is self-assessed: it scores what you tell it, and cannot verify it. A readiness review checks the evidence behind each answer, so you get a baseline you can plan, budget and report against.
No fee for the first conversation.
Why it matters
Self-assessments tend to be optimistic in the same places: a policy that exists but nobody follows, a breach procedure that was written but never tried, a vendor contract that predates the Act. A review finds those gaps before a customer, an auditor or the Data Protection Board does.
What we cover
Evidence check
We ask to see the policy, record, log or setting behind each Yes, and mark what we could and could not confirm.
People and ownership
Who is accountable for data protection, who they report to, and whether leadership has seen the picture.
Security safeguards
We review the evidence for your technical and organisational safeguards: access control, encryption, logging, vendor access. We review and advise; we do not test or build systems.
Training and awareness
What staff are told, how often, and whether anyone can show it happened.
Monitoring and review
How you would know a control had stopped working, and who would check.
What you receive
- A verified score and gap list, using the same 54-point checklist as the free check, so the two compare directly
- Gaps ranked by priority and by the penalty ceiling they map to
- A phased roadmap with an owner and a target date against each action
- A one-page summary for your board or leadership
Typical timeline. About 2 to 4 weeks, depending on your size and how quickly documents arrive.
How it works
- 01
Scoping call
We agree what is in scope: entities, systems and teams.
- 02
Evidence review
You share policies, records and settings; we test each answer against them.
- 03
Findings
We walk you through what held up and what did not.
- 04
Roadmap
You receive the report, the ranked gaps and an owner-and-date plan.
Who it is for
- You have taken the free check and want the result verified
- A customer, investor or auditor is asking you questions about data protection
- Leadership wants one defensible view before 13 May 2027, when most of the Rules take effect
What it does not include
- Penetration testing or other technical security testing
- A legal opinion
- A "DPDP certificate". The Act does not provide for one, so we neither issue nor imply one
- Building or configuring your systems
Questions
How is this different from the free check?
The free check scores your own answers and cannot verify them. The review checks them against your documents and settings, so the score is one you can rely on.
Do you need access to our customers' personal data?
No. We review policies, records and system settings, not the personal data itself.
Can it be done remotely?
Mostly. Most of the work is reviewing documents and screens together; a site visit is optional.
What does it cost?
It depends on size and scope, so we quote after a short scoping call. No fee for the first conversation.
Other DPDP services
- Notices, consent and grievancePlain-language notices, consent flows you can prove, and a grievance route people can actually use.
- Data mapping and retentionKnow what personal data you hold, where it flows, who else touches it, and when it gets deleted.
- Data principal rights and breach readinessA way to answer rights requests on time, and a breach plan with a real contact list that has been tried.
General advisory, not legal advice or a legal opinion. Where a point needs a lawyer’s view, we will say so. Last reviewed 6 October 2026.