Our own DPDP readiness · assessed 22 September 2026

How we practise the DPDP Act on our own website

We advise on data protection, so we ran the same 54-point check we offer you on ourselves, and we publish the result, including what we have not yet done.

50%

49 of 98 points

Developing

22done, with evidence

23not yet, each with a next step

9not applicable to us, each with a reason

What this covers. This website, the two free tools (the GST Health Report and the DPDP Readiness Check), the blog and the enquiry form. It does not cover how we handle client engagement data, which sits under our engagement terms. Answers are our own and have not been independently audited. A “yes” means we can point to something real; anything we cannot show is a “no”.

What we changed to get here

Nothing on any page loads from another company. Fonts are hosted here, there are no analytics or tags, and an automated test fails if a page ever loads something from a third party.
The tools tell us who you are only if you ask us to. Running a tool sends us an anonymous note (reference and score). Only a visitor who asks for a copy gives us their details.
Consent is asked for, never assumed, and recorded. Unticked box, refused by the server if missing, recorded with the time and the notice version.
You control the copy we hold. A live countdown on each report and a "Delete this report now" button.
The words on the site match what actually happens. Claims about storage and sharing are checked by tests, so a false promise cannot slip back in.
Staff sign-in is protected against guessing. Failed attempts are rate-limited per person and site-wide.

Where we stand, area by area

Governance & Dedicated Team

58%

Policy Documents

58%

Procedures & SOPs

100%

Training & Awareness

13%

Documentation & Records

90%

Technology & Systems Controls

17%

Vendor & Third-Party Oversight

25%

Incident & Breach Management Readiness

38%

Monitoring, Audit & Review

57%

Board/Leadership Oversight

Children's Data & Persons with Disability

n/a

What we have not done yet

Every “no”, most important first, with the next step.

High Role-based access control implemented.
Editing screens use one shared admin password and one role, not role-based access. Next: Move to per-person accounts with separate roles.
High Encryption/masking of personal data at rest and in transit.
The files you upload and the answers you give are held in memory only and never written to disk. The security log (item 32) now writes IP addresses to disk, and we have not yet confirmed encryption at rest for that with the hosting provider, or HTTPS end to end. Next: Confirm HTTPS and the provider's disk encryption, and record it in the vendor register.
High Breach response team identified with a live contact tree.
The response roles are defined, but the names and phone numbers in the contact tree are still to be filled in. Next: The partners fill in and keep current the contact tree.
High Accountable owner/leader for data protection formally designated.
A privacy contact is published, but the partners have not yet formally designated one accountable owner. Next: The partners designate the accountable owner and record it.
High Internal Data Protection Policy approved by leadership.
The procedures are written as drafts; the partners have not yet approved them. Next: The partners review and approve the procedures; approval is recorded in the notice history.
High Periodic reporting to Board/leadership on data protection posture.
There is no regular report on data protection to the partners yet. Next: Report at each half-yearly self-check.
Medium Logging & monitoring for unauthorised access.
Admin sign-in attempts and report/lead events are now logged for a year (Rule 6(1)(e)), but nobody reviews the log, and nobody is alerted on a lock-out. Next: Set up a periodic review of the security log, and an alert to the privacy contact on repeated sign-in failures.
Medium Data backup & recovery capability.
Reports are deliberately not stored, but blog posts and uploads have no backup routine. Next: Set a regular backup of the data folder and test a restore.
Medium Role-specific training for the breach-response team.
The breach-response roles are defined but have not been trained. Next: Train the people named in the contact tree, and run the first drill.
Medium Tabletop/simulation drill conducted at least once.
No table-top drill has been run yet. Next: Run one, and record it in the breach log.
Medium Cross-functional data protection committee/working group established.
We are a small partnership; no separate working group exists. Next: The partners decide whether a committee is proportionate, and record the decision.
Medium Data Classification Policy (sensitive vs. personal vs. public).
The record of processing lists what each activity holds, but there is no formal classification policy. Next: Write a short data-classification policy (public, personal, sensitive) and link it to the record.
Medium Induction training for new hires.
There is no induction briefing on data protection yet. Next: Write a short briefing for anyone given access to the site's data or editing screens.
Medium Periodic refresher for customer-facing/HR/IT staff.
No refresher training is scheduled yet. Next: Add a refresher to the half-yearly self-check.
Medium Central contract repository with data-processing clauses.
The providers are registered, but their terms are not yet collected in one place. Next: Collect and file each provider's terms.
Medium Vendor risk assessment before onboarding.
The checklist exists; the current providers have not yet been assessed against it. Next: Assess each current provider and record it in the register.
Medium Periodic vendor compliance review/audit.
The first half-yearly review of providers has not yet been held. Next: Hold the first review at the next self-check.
Medium Management review of program effectiveness.
No management review has been held yet. Next: The first half-yearly self-check is that review; the partners attend it.
Medium Budget/resourcing sign-off for the program.
No budget or resourcing has been signed off for the programme. Next: The partners agree and record the time and cost.
Medium Leadership accountability documented (minutes, sign-off).
Leadership accountability is not yet recorded in the partners' minutes. Next: Record it when the policies are approved.
Low Org-wide awareness communications.
There is no internal awareness communication yet. Next: Send a short note to the team when the procedures are approved.
Low Policy version history & approval records.
Versions are recorded, but approval by the partners has not yet been recorded. Next: Record the partners' approval in the notice history when the policies are signed off.
Low Key risk indicators/metrics tracked over time.
No metrics are tracked yet. Next: Track requests received, time to respond, and deletions done, at each review.

The full answer sheet

All 54 items, with the evidence behind each “yes”.

Governance & Dedicated Team 3 of 6 done

Not yet	Accountable owner/leader for data protection formally designated. A privacy contact is published, but the partners have not yet formally designated one accountable owner. Next: The partners designate the accountable owner and record it.
Yes	DPO appointed (if Significant Data Fiduciary) or point-of-contact designated otherwise. A privacy contact is named on the notice, able to answer questions (Section 8(9)). We are not a Significant Data Fiduciary, so no Data Protection Officer is required. Evidence: Privacy notice
Not yet	Cross-functional data protection committee/working group established. We are a small partnership; no separate working group exists. Next: The partners decide whether a committee is proportionate, and record the decision.
Yes	Defined escalation path from operational level to leadership. Escalation runs from the privacy contact to any partner, the same day for anything that may be a breach. Evidence: Procedure 0: programme, roles and review cadence; Procedure 2: breach response
Yes	Roles & responsibilities documented (a RACI, not just a job title). Responsibilities for each activity are set out by role in a RACI table. Evidence: Procedure 0: programme, roles and review cadence
Not applicable	Independent data auditor appointed, distinct from the DPO (Sec 10(2)(b), where Significant Data Fiduciary). We have not been notified as a Significant Data Fiduciary, so an independent data auditor is not required.

Policy Documents 3 of 6 done

Yes	External-facing Privacy Policy published and current. Published, versioned, and linked from every page. Evidence: Privacy notice
Not yet	Internal Data Protection Policy approved by leadership. The procedures are written as drafts; the partners have not yet approved them. Next: The partners review and approve the procedures; approval is recorded in the notice history.
Yes	Data Retention & Erasure Policy. Retention periods are set (30 minutes for reports, up to 12 months for leads) and published, with a written deletion routine. Evidence: Privacy notice; Procedure 3: retention and deletion
Not yet	Data Classification Policy (sensitive vs. personal vs. public). The record of processing lists what each activity holds, but there is no formal classification policy. Next: Write a short data-classification policy (public, personal, sensitive) and link it to the record.
Yes	Vendor/Third-Party Data Processing Policy. A written policy governs which providers we use, what they may receive, and how they are added and removed. Evidence: Procedure 4: vendors and processors
Not applicable	Children's Data Policy, where applicable. The tools are for organisations, not children, and the notice says so.

Procedures & SOPs 6 of 6 done

Yes	Consent capture & withdrawal SOP. An unticked consent box on every form; the server refuses a request without it; withdrawal is by email; each consent is recorded with the notice version. Evidence: Privacy notice; Procedure 1: rights requests; Consent enforced by the server
Yes	DSAR/rights-request handling SOP with defined timelines. Written steps with a 30-day promise, a log, and reply templates. Evidence: Procedure 1: rights requests
Yes	Breach detection & notification SOP. Written steps from detection to notifying the Board and the people affected, with templates. Evidence: Procedure 2: breach response
Yes	Vendor onboarding & offboarding data-protection checklist. Checklists for adding and for removing a provider. Evidence: Procedure 4: vendors and processors
Yes	Retention/erasure execution SOP. A monthly routine deletes expired leads, with a log; reports delete themselves after 30 minutes. Evidence: Procedure 3: retention and deletion
Yes	New product/feature privacy-review SOP ('privacy by design' gate). An eleven-question review is answered before any change that touches personal data ships. Evidence: Procedure 5: privacy review before a change

Training & Awareness 1 of 5 done

Not yet	Induction training for new hires. There is no induction briefing on data protection yet. Next: Write a short briefing for anyone given access to the site's data or editing screens.
Not yet	Periodic refresher for customer-facing/HR/IT staff. No refresher training is scheduled yet. Next: Add a refresher to the half-yearly self-check.
Not yet	Role-specific training for the breach-response team. The breach-response roles are defined but have not been trained. Next: Train the people named in the contact tree, and run the first drill.
Not yet	Org-wide awareness communications. There is no internal awareness communication yet. Next: Send a short note to the team when the procedures are approved.
Yes	Data Principals are informed of their Sec 15 duties via notice/terms of use/in-app messaging. The notice explains a person's duties under Section 15 of the Act, in plain language. Evidence: Privacy notice

Documentation & Records 3 of 5 done

Yes	Live Record of Processing Activities (RoPA) maintained. A record of the eight processing activities on this site, reviewed with every change. Evidence: Procedure 6: record of processing
Yes	Consent logs maintained and retrievable. Each consent is recorded with its time and notice version in the alert we receive, and can be found again by searching the chat or mailbox for the report's reference. Evidence: Consent enforced by the server; Procedure 6: record of processing
Yes	Audit trail proving notice/consent was actually given. The consent record names the version of the notice the person saw, and each version's text and date are kept. Evidence: Procedure 7: notice versions; Consent enforced by the server
Not applicable	DPIA reports for high-risk processing, where applicable. There is no high-risk processing: no children's data, no profiling, no large-scale sensitive data.
Not yet	Policy version history & approval records. Versions are recorded, but approval by the partners has not yet been recorded. Next: Record the partners' approval in the notice history when the policies are signed off.

Technology & Systems Controls 1 of 5 done

Not yet	Role-based access control implemented. Editing screens use one shared admin password and one role, not role-based access. Next: Move to per-person accounts with separate roles.
Not yet	Encryption/masking of personal data at rest and in transit. The files you upload and the answers you give are held in memory only and never written to disk. The security log (item 32) now writes IP addresses to disk, and we have not yet confirmed encryption at rest for that with the hosting provider, or HTTPS end to end. Next: Confirm HTTPS and the provider's disk encryption, and record it in the vendor register.
Yes	Consent management tooling in place. Consent capture is versioned, enforced by the server, and tested. Evidence: Consent enforced by the server
Not yet	Logging & monitoring for unauthorised access. Admin sign-in attempts and report/lead events are now logged for a year (Rule 6(1)(e)), but nobody reviews the log, and nobody is alerted on a lock-out. Next: Set up a periodic review of the security log, and an alert to the privacy contact on repeated sign-in failures. Evidence: Security & access log; Procedure 3: retention and deletion
Not yet	Data backup & recovery capability. Reports are deliberately not stored, but blog posts and uploads have no backup routine. Next: Set a regular backup of the data folder and test a restore.

Vendor & Third-Party Oversight 1 of 4 done

Not yet	Central contract repository with data-processing clauses. The providers are registered, but their terms are not yet collected in one place. Next: Collect and file each provider's terms.
Not yet	Vendor risk assessment before onboarding. The checklist exists; the current providers have not yet been assessed against it. Next: Assess each current provider and record it in the register.
Not yet	Periodic vendor compliance review/audit. The first half-yearly review of providers has not yet been held. Next: Hold the first review at the next self-check.
Yes	Cross-border transfer tracking for vendors. The register records where each provider's servers are; Telegram is flagged as outside India. Evidence: Procedure 4: vendors and processors

Incident & Breach Management Readiness 2 of 4 done

Not yet	Breach response team identified with a live contact tree. The response roles are defined, but the names and phone numbers in the contact tree are still to be filled in. Next: The partners fill in and keep current the contact tree.
Yes	Pre-drafted notification templates (Board + Data Principal). Drafted notifications for the Board and for the people affected. Evidence: Procedure 2: breach response
Not yet	Tabletop/simulation drill conducted at least once. No table-top drill has been run yet. Next: Run one, and record it in the breach log.
Yes	Post-incident review process defined. A review within 14 days of any breach, recorded in the log. Evidence: Procedure 2: breach response

Monitoring, Audit & Review 2 of 5 done

Yes	Internal audit cadence defined (annual/half-yearly). A half-yearly self-check using this same tool, published here. Evidence: Procedure 0: programme, roles and review cadence
Not yet	Management review of program effectiveness. No management review has been held yet. Next: The first half-yearly self-check is that review; the partners attend it.
Yes	Process to update policies when the law/rules change. The privacy contact watches for changes in the law and the Rules; the partners decide what changes within 30 days. Evidence: Procedure 0: programme, roles and review cadence
Not yet	Key risk indicators/metrics tracked over time. No metrics are tracked yet. Next: Track requests received, time to respond, and deletions done, at each review.
Not applicable	Algorithmic/technical measures periodically risk-assessed for impact on Data Principal rights (Rule 13(3)). We make no automated decisions about people, and we are not a Significant Data Fiduciary.

Board/Leadership Oversight 0 of 4 done

Not yet	Periodic reporting to Board/leadership on data protection posture. There is no regular report on data protection to the partners yet. Next: Report at each half-yearly self-check.
Not yet	Budget/resourcing sign-off for the program. No budget or resourcing has been signed off for the programme. Next: The partners agree and record the time and cost.
Not yet	Leadership accountability documented (minutes, sign-off). Leadership accountability is not yet recorded in the partners' minutes. Next: Record it when the policies are approved.
Not applicable	Process exists to track and honour terms of any voluntary undertaking given to the Board. We have given no voluntary undertaking to the Data Protection Board.

Children's Data & Persons with Disability 0 of 4 done

Not applicable	Mechanism exists to identify/flag likely child users of the product or service. The tools are for organisations and are not directed at children.
Not applicable	Verifiable parental/lawful-guardian consent SOP and supporting technology in place. We do not process children's personal data.
Not applicable	Control in place to prevent behavioural monitoring or targeted advertising directed at children. We use no tracking, analytics or behavioural monitoring at all, and no advertising.
Not applicable	Guardian-verification procedure exists for Data Principals with a lawful guardian. The tools do not involve people with a lawful guardian.

This page is our own self-assessment, published for transparency. It is not a legal opinion or a certification. See our privacy notice.