DPDP Act 2023 Self-Assessment

Step 1 of 3

Section A — Consent Management

Q1. Does your organisation obtain free, specific, informed, and unambiguous consent before processing personal data?

Yes — documented, granular consent obtained before collection Partially — consent obtained but not always specific or documented Rarely — consent is implied or bundled with T&Cs No — we do not have a formal consent mechanism

Q2. Can individuals withdraw consent easily, and does withdrawal stop data processing promptly?

Yes — withdrawal is as easy as giving consent; processing stops within 72 hours Yes — withdrawal is possible but may take some days Partially — withdrawal exists but is difficult or poorly communicated No — no withdrawal mechanism exists

Section B — Data Fiduciary Obligations

Q3. Does your organisation publish a clear and accessible Privacy Notice explaining the purpose of data collection?

Yes — detailed privacy notice with purpose limitation, updated regularly Partially — privacy notice exists but is outdated or hard to find Minimal — basic terms only, no purpose-specific notice No — no privacy notice available

Q4. Do you collect only the minimum personal data necessary for the stated purpose (data minimisation)?

Yes — data collected is strictly limited to what is needed Mostly — some excess data is collected but reviewed periodically No — we collect extensive data "for future use" Unsure — we have no data minimisation policy

Section C — Data Principal Rights

Q5. Can individuals access, correct, or erase their personal data upon request within a reasonable timeframe?

Yes — self-service portal or process exists; fulfilled within 30 days Partially — requests are fulfilled but may take longer than 30 days Rarely — handled on a case-by-case basis with no formal process No — no mechanism for rights requests

Q6. Do you have a Data Grievance Redressal Officer appointed and is their contact information published?

Yes — DPO appointed, contact published, and complaints resolved within 30 days Partially — officer appointed but not clearly communicated to users No — no dedicated officer; complaints go to general support Not applicable / unsure

Section D — Data Breach Management

Q7. Do you have a documented Data Breach Response Plan and can you notify affected individuals and authorities promptly?

Yes — IRP exists, tested annually, breach notification within 72 hours Partially — plan exists but not regularly tested Minimal — informal process only No — no breach response plan

Q8. Are access controls and security measures in place to protect personal data from unauthorised access?

Yes — encryption, MFA, RBAC, and regular audits implemented Partially — basic controls exist, but no formal security programme Minimal — passwords only, no encryption No — no security controls for personal data

Section E — Children's Data

Q9. If you process data of children (under 18), do you obtain verifiable parental consent?

Yes — age verification and parental consent are built into onboarding Partially — we ask for age but do not verify parental consent We do not process children's data (not applicable) No — no age verification or parental consent mechanism

Section F — Cross-Border Data Transfer

Q10. If you transfer personal data outside India, is it only to countries approved by the Central Government?

Yes — we check the permitted countries list before any transfer Partially — some transfers tracked, others ad hoc We transfer data internationally but have no compliance process No cross-border transfers (not applicable)

Q11. Do you maintain a Register of third-party Data Processors and do you have Data Processing Agreements (DPAs) with them?

Yes — complete register, signed DPAs with all processors Partially — some processors listed, DPAs missing for some Minimal — we are aware of processors but have no formal agreements No — no register or DPAs

Section G — Staff Awareness

Q12. Are employees trained on DPDP Act 2023 obligations and data handling best practices?

Yes — mandatory annual DPDP training with documentation Partially — some staff trained, not company-wide Minimal — awareness only, no formal training No — no DPDP training

Get Your Results

Enter your details to receive your personalised DPDP compliance report.

I consent to securely share my assessment results with LLM Advocates for evaluation purposes.

Your DPDP Compliance Score

Speak with a DPDP Expert →

DPDP Act 2023Self-Assessment