Take our free 3-minute check. Answer 12 questions and get a readiness score, a breakdown across six areas and a prioritised list of what to fix first, which you can download as a PDF.
Free self-assessment12 questions · about 3 minutes
–days to 13 Nov 2026 (Consent Manager rules)since 13 Nov 2026 (Consent Manager rules)
–days to 13 May 2027 (full compliance)since 13 May 2027 (full compliance)
INR 250 crmaximum penalty for security safeguard failures
Governance and accountability
Notice and consent
Rights and grievances
Security and breach readiness
Vendors and cross-border
Retention, erasure and children
Your answers stay in your browser. Nothing is sent to Quinfy. This tool gives general guidance, not legal advice.
Your DPDP readiness result
0out of 24
Where you stand, area by area
Key dates to plan around
2025年11月13日Data Protection Board in force (already live)
This result is general guidance based on your own answers and is not legal advice. Dates and requirements reflect public sources at the time of writing; please confirm with qualified counsel and the official MeitY notifications.
Governance and accountabilityNotice and consentRights and grievancesSecurity and breach readinessVendors and cross-borderRetention, erasure and children
Is one named senior person accountable for DPDP compliance, and is your leadership briefed on the obligations?The Act makes the organisation answerable for how personal data is handled. Someone senior needs to own it.Appoint a named DPDP owner with senior backing, brief the leadership team on duties and penalty exposure, and set a budget and a target date.
Do you have a map of every system, vendor and file store that holds personal data, including candidate and employee data?Think HRMS, email attachments, shared drives, vendor portals and backups.Build a data inventory: what personal data you hold, where it sits, who can access it, who it is shared with and why. Everything else depends on this.
Do people receive a clear, plain-language notice before you collect their data?It should say what you collect and why, how to exercise their rights, and how to complain to the Data Protection Board.Redraft your privacy notice as a standalone, itemised and plain-language notice, and show it at or before the point of collection.
Can you prove who consented to what, and can people withdraw consent as easily as they gave it?Consent must be free, specific, informed and unambiguous, given by a clear action, not bundled with unrelated terms.Move to digital, timestamped consent records tied to each purpose, add a simple withdrawal route, and make sure withdrawal reaches your vendors.
If someone asked what data you hold about them, or asked you to correct or erase it, could you respond within a set time?People gain rights to access, correction, completion, updating and erasure.Write a rights-request procedure with a named owner, a log and a response deadline, and test it with a mock request.
Is there a published grievance contact and a working complaints process?People are expected to use your grievance channel before approaching the Data Protection Board.Publish a grievance contact on your website and notices, record every complaint, and define a response timeline.
Are reasonable security safeguards in place and evidenced: encryption or masking, access control, monitoring and logs kept for at least a year?A failure to take reasonable safeguards carries the highest penalty under the Act, up to INR 250 crore.Run a security gap review against encryption, least-privilege access, monitoring and one-year log retention. Close the gaps and keep the evidence.
Do you have a tested breach plan to inform the Data Protection Board and affected people, including a detailed report within 72 hours?A plan that has never been rehearsed usually fails on the day.Document a breach response plan with named roles and templates for notifying the Board and individuals, and run a drill before May 2027.
Are your vendors and processors bound by contracts covering instructions, security, breach alerts and deletion?You remain responsible for personal data your vendors handle on your behalf.List every processor and sub-processor, then update contracts to cover processing only on your instructions, security, breach alerts and return or deletion of data.
Do you know where personal data travels outside India, and have you reviewed your key vendors' security assurance?For example overseas education checks, cloud hosting abroad, or global support teams. ISO 27001 or SOC 2 Type II reports help here.Map cross-border transfers, check them against any restrictions the Government notifies, and ask critical vendors for independent assurance such as ISO 27001 or SOC 2 Type II.
Do you have a retention schedule, and is data actually erased once the purpose has ended, including at your vendors?Keeping everything forever is no longer a safe default.Set a retention period for each data category, automate or schedule deletion, and get written confirmation of deletion from vendors.
Have you checked whether you handle children's data (under 18) or could be treated as a Significant Data Fiduciary, and planned for the extra duties?Answer Yes if you have checked and it either does not apply or is already handled. Extra duties can include verifiable parental consent, a Data Protection Officer in India, impact assessments and an independent audit.Check whether you process any data of under-18s and assess whether you could be notified as a Significant Data Fiduciary. Plan the additional duties that follow.
YesIn place, and I could show evidence if asked
PartlyStarted, incomplete or not documented
Not yet or not sureNot started, or I do not know
On trackYou have most building blocks in place. Close the remaining gaps, collect evidence and schedule an annual review.
Gaps to closeYou have made a start but there are real gaps. Prioritise the actions below and aim to finish core controls by 31 March 2027.
Significant work neededA structured programme is needed. Appoint an owner now and start with your data map, consent and security safeguards.
Not ready, start nowTreat this as urgent. Begin this month with an owner, a data inventory and a security review, and consider specialist support.
2025年11月13日Data Protection Board in force (already live)
Appoint an owner and share this result with your leadership team.Work through the full 30-point self-assessment in the Quinfy DPDP Compliance Readiness Toolkit.Start with the first three priority actions above, then re-take this check in 30 days.If you screen or hire at scale, ask your verification provider for its consent, retention and breach processes in writing.Question {n} of {total}Partly in placeNot yet in placeEvery area is in place. Keep your evidence file current and review it each year.Your PDF lists all {n} actions in priority order.Your PDF has been downloaded.Thank you, the Quinfy team will be in touch.We opened your browser's print dialog so you can choose 'Save as PDF'.Sorry, the PDF could not be created. Please try again, or use your browser's Print option.DPDP Readiness Check: your resultReadiness scoreArea by areaYour priority actionsKey datesSome commentators expect the final date could be brought forward. We suggest working to an internal target of 31 March 2027 for core controls.Next stepsThis result is general guidance based on your own answers and is not legal advice. Dates and requirements reflect public sources at the time of writing. Please confirm with qualified counsel and the official MeitY notifications.Quinfy Technology Pvt Ltd & Quinfy Inc. | Innovating with Integrity | quinfy.comPage {n} of {total}DPDP Readiness CheckIn force