Free DPDP readiness check

Is your company ready for India's DPDP law? Find out in 3 minutes.

Answer 12 plain-language questions about how you handle customer and employee data. Get a readiness score, your biggest gaps, and what to fix first. No sign-up needed to see your result.

Start the check What the law asks

For founders, HR, IT and compliance heads of SMEs

13 May 2027Most DPDP Rules obligations apply to every business from this date

72 hoursTo send the Data Protection Board a detailed report after a personal data breach

Up to ₹250 croreMaximum penalty for failing to take reasonable security safeguards

What the DPDP law asks of every business

The Digital Personal Data Protection Act, 2023 and the DPDP Rules notified in November 2025 apply to any business that handles personal data of people in India, including employees.

Tell people clearlyA plain notice listing the data you collect, why, and how to withdraw consent or complain.

Get and honour consentConsent that is specific and as easy to withdraw as to give, and deletion once it is withdrawn.

Protect the dataReasonable security safeguards such as encryption, access control and logs kept for at least a year.

Report breachesInform the Data Protection Board and affected people, with a detailed report within 72 hours.

Respect rightsLet people access, correct and erase their data, and nominate someone to act for them.

Hold vendors to itYour processors, from payroll to cloud, must protect the data under a contract with you.

This check is a general self-assessment, not legal advice. For your specific obligations, consult your legal adviser.

More free checks: POSH, new labour codes, payroll, GST, TDS and MSME payments, CERT-In, company law and workplace →