Free readiness check

DPDP & GDPR readiness check
in twenty questions.

Six areas, twenty questions, scored yes, partly or no, because a binary answer to “do you have a retention schedule” is almost always a lie in one direction. You get a score per area and a named list of every gap. Nothing you answer leaves your browser.

Book a demo All free tools

Governance

An unowned programme is a programme that stops the week something else gets urgent.
SDF designation pulls in a DPO in India, an independent audit and periodic DPIAs.
A policy nobody has read since it was written is evidence of nothing.

Notice & consent

A privacy policy linked in the footer is not a notice under DPDP section 5.
The burden of proving notice and consent sits on you, not on the user.
Bundled consent fails GDPR Article 7 and DPDP alike.
One tap to accept and an email to support to withdraw is the classic finding.

Data mapping

Every other obligation depends on this one, and it is the one most often missing.
Named processors under a written agreement, not a list of logos.
A documented period with no deletion job is a documented breach.

Individual rights

Thirty days is short if the answer lives in six systems and a spreadsheet.
Say what the backup schedule is rather than claiming instant erasure.
DPDP requires a contact point who can answer questions about processing.

Security

Reasonable security safeguards under section 8(5) start here.
The cheapest control to implement and the first one an auditor checks.
Without this you cannot scope a breach, which makes notification guesswork.
An untested backup is a hypothesis.

Breach readiness

Notification obligations run from the moment you become aware, not from the moment you finish investigating.
DPDP requires notice to both, with no materiality threshold.
The first time you use it should not be the first time you use it.
A self-assessment is a map of what you believe, not of what your systems are doing. Treat a high score as a hypothesis worth testing with evidence.

Every gap above is a control with an owner and a due date once it lives in a programme. That is the difference between knowing and being ready.

Book a walkthrough

Stop generating documents. Start evidencing controls.

These tools write a document from what you tell them. The platform writes one from what your systems are actually doing, and keeps the proof behind it.

Book a demo Read the SDK docs