DPDP & GDPR readiness check
in twenty questions.
Six areas, twenty questions, scored yes, partly or no, because a binary answer to “do you have a retention schedule” is almost always a lie in one direction. You get a score per area and a named list of every gap. Nothing you answer leaves your browser.
Every gap above is a control with an owner and a due date once it lives in a programme. That is the difference between knowing and being ready.
What the six areas are measuring
The questions are not arbitrary. Each area maps to a cluster of obligations that recurs across every regime we cover, which is why one honest pass answers a surprising amount of what DPDP, the GDPR and SOC 2 each want to know.
| Area | Why it is scored first | Where it shows up |
|---|---|---|
| Governance | An unowned programme stops the week something else becomes urgent | DPDP s.10 (SDF duties) · GDPR Art. 37-39 · SOC 2 CC1 |
| Notice & consent | The burden of proving notice and consent sits on you, not the individual | DPDP s.5-6 · GDPR Art. 7, 13 · ePrivacy |
| Data mapping | Every other obligation depends on knowing what you hold and where | DPDP s.8 · GDPR Art. 30 · SOC 2 CC3 |
| Individual rights | Statutory clocks run whether or not you can find the data | DPDP s.11-14 · GDPR Art. 15-22 · CCPA |
| Security | "Reasonable security safeguards" is the largest penalty entry in the DPDP Schedule | DPDP s.8(5) · GDPR Art. 32 · SOC 2 CC6 |
| Breach readiness | Notification runs from awareness, not from the end of the investigation | DPDP s.8(6) · GDPR Art. 33-34 · SOC 2 CC7 |
Why 'partly' is an option
Most readiness quizzes ask yes or no, and most answers are neither. A company with a retention schedule written down and nothing enforcing it is not compliant, but it is not starting from zero either: it has done the thinking and not the plumbing. Collapsing that into a binary either flatters the score or destroys it, and both readings send you to the wrong next task.
Scoring partial credit at one half also makes the arithmetic honest in a specific way: an area full of half-answers lands near 50%, which is exactly where it belongs. Documented-but-unenforced is halfway, not nearly there.
Where the score comes from, and what it is not
The score is unweighted: every question counts once within its area, and every area counts equally toward the overall figure. That is deliberate. Weighting would bury the fact that a single missing control (no access logging, say) can make several other answers unprovable.
What it is not is an assurance result. This is a self-assessment: a map of what you believe about your own systems. The gap between belief and reality is precisely where findings live, and it is usually widest in security and data mapping, because those are the areas where the honest answer requires checking rather than remembering. Treat a high score as a hypothesis worth testing with evidence, not as a result.
What auditors actually ask for
Every area above eventually resolves to an artefact someone wants to see. These are the ones requested most often, in roughly the order they get asked:
- A data inventory showing categories, systems, purposes and retention. Nothing else can be verified without it
- The processor list with a signed agreement per entry
- Evidence that access review happened, with a date and a reviewer, not a screenshot of the permissions screen
- One completed rights request end to end, showing the clock was met
- An incident response plan with a drill record, because an untested plan is a document rather than a capability
- A restore test, dated. Backups that have never been restored are an assumption
Notice how many of those are about dates and evidence rather than policy text. That is the consistent difference between a programme that passes and one that does not: the passing one can show when each thing happened and who did it.
What to do with a low score
Start with data mapping and notice, in that order, regardless of which area scored worst. Mapping is upstream of nearly everything: you cannot set a retention period for data you have not inventoried, answer an access request against systems you have not listed, or scope a breach across an unknown estate. Notice comes second because it is cheap, visible, and the one obligation where the burden of proof is explicitly yours.
Security and breach readiness usually score lowest and feel most urgent, but work there is wasted if you cannot say what data the controls are protecting. If you want the same obligations priced rather than scored, the penalty calculator attaches the statutory maxima to them, and coverage shows how one control set answers several regimes at once.
The things people ask us
Is this an audit or a certification?
Neither. It is a structured self-assessment: a map of what you believe about your own systems. An audit tests those beliefs against evidence, and the gap between the two is where findings live. Use the score to prioritise, not to make a claim to anyone else.
How is the score calculated?
Each question scores 1 for yes, 0.5 for partly and 0 for no. Every question counts equally within its area, and every area counts equally toward the overall percentage. It is deliberately unweighted, so a single missing control cannot be hidden behind strength elsewhere.
What counts as 'partly'?
Documented but not enforced, or done once but not on a schedule. A retention policy with no deletion job, an access review that happened last year, an incident plan nobody has rehearsed. Half credit reflects real progress without pretending the control is operating.
What is a good score?
Above 80% means the foundations are in place and the remaining gaps are the ones a reviewer will find first. Between 50 and 80 usually means the thinking is done and the evidence is not. Below 50 is early, and the answer is almost always to start with data mapping rather than with security.
Does this cover SOC 2 and ISO 27001 as well as privacy?
Partly. The governance, security and breach areas overlap substantially with SOC 2 Common Criteria and ISO 27001 Annex A, which is the point of a shared control set. It is not a substitute for a full readiness assessment against either framework, which tests each criterion individually.
Where do my answers go?
Nowhere. The assessment runs entirely in your browser. Nothing is transmitted, stored or logged, and there is no email gate on the result, which also means we cannot retrieve it for you later, so save or screenshot anything you want to keep.
Stop generating documents. Start evidencing controls.
These tools write a document from what you tell them. The platform writes one from what your systems are actually doing, and keeps the proof behind it.