DPDP gap assessment, scored by exposure
Forty-eight questions across nine areas of the DPDP Act. You get a weighted readiness score, a maturity level for each area, and a fix list ordered by what each gap is actually worth in penalties. No sign-up, and your score is yours the moment you finish.
- 48
- questions
- 9
- areas of the Act
- 250cr
- top exposure weighted
- 0
- to sign up
First, which obligations apply to you?
The Act asks more of some organisations than others. Three answers decide which of the 9 areas you are assessed against, so you are not marked down for duties you do not carry.
Do you process data of anyone under eighteen?
In India a child is anyone under eighteen. This switches on four extra questions and a 200 crore exposure.
Have you been notified as a Significant Data Fiduciary, or do you expect to be?
Notified by the government based on volume and sensitivity. Adds a DPO, an annual assessment and an independent audit.
Your answers are saved on this device rather than sent to us, so you can close the tab and come back. No sign-up to take it or to see your score. What we collect.
Nine areas, mapped to the Act
Each area names the section it comes from and the maximum penalty the Schedule attaches to a failure there. Two areas only appear if your answers say they apply to you.
Figures are statutory ceilings from the Schedule to the Act, referenced by section 33(1). They are maximums the Data Protection Board may impose, not predictions of any fine.
Notice and transparency
Section 5
up to ₹50 crore
Consent and its lifecycle
Sections 6 and 7
up to ₹50 crore
Data principal rights
Sections 11 to 14
up to ₹50 crore
Security safeguards
Section 8(5)
up to ₹250 crore
Breach response
Section 8(6)
up to ₹200 crore
Retention and erasure
Section 8(7)
up to ₹50 crore
Governance and third parties
Section 8
up to ₹50 crore
Children's data
Section 9
up to ₹200 crore
Significant Data Fiduciary duties
Section 10
up to ₹150 crore
Built to be useful on a Monday morning
Most free checkers ask everyone the same twenty questions, score every answer equally, and want your email before showing the result. This one does none of those things.
It scopes to you first
Three questions decide which areas you are measured against, so you are not marked down for duties you do not carry, such as the extra obligations that only apply to children's data or to a Significant Data Fiduciary.
It is weighted by what a failure costs
A gap in security safeguards carries a 250 crore ceiling. A gap in a residual area carries 50 crore. The score reflects that, so the number moves in proportion to real exposure rather than counting questions equally.
It asks what would prove it
Every question names the artefact an auditor would ask you to produce. Answering that you have something in place but cannot evidence it scores differently from being able to show it.
You can finish it without telling us anything
No sign-up, and your answers are saved on your device rather than sent to us, so you can close the tab and pick it up later. We ask for an email address at one point only: if you want the full report and the whole fix list sent to you.
Looking for something quicker? Thefive question readiness checkgives a rough score in under a minute. Thepenalty calculatorshows the statutory ceilings on their own.
This assessment is educational and does not constitute legal advice. It is a self-assessment against the text of the Act and is not an audit, a certification, or a substitute for advice on your specific circumstances.