Section 5, Rule 3
Notice and Transparency
- No clear notice at the point of collection
- Withdrawal and complaint routes not surfaced in the notice
- Notice not offered in English or an Eighth Schedule language
Do you know your DPDPA number?
20+ questions, each citing the section it tests. Your 0 to 100 score is on screen when you finish.
- Free score
- No login
- No card
- Score on screen when you finish
To see it: name, company, work email.
- Highest penalty in the Schedule may extend to
- Rs 250 Cr
- For a breach of the security-safeguards duty. Section 33(1) and the Schedule, entry 1. A ceiling is not a fixed fine.
- Substantive duties and penalty schedule commence
- 13 May 2027
- The IT Secretary has confirmed there is no grace period.
- Days to 13 May 2027
- The Consent Manager framework has a separate date: 13 Nov 2026.
In the news: the DPDP Act and Rules
Built to be checked, not believed.
The readiness assessment of Delta Data Labs, a DPDPA compliance delivery firm.
The Rules ask for more than paper. Obligation by obligation.
These are the gaps the assessment looks for, grouped under the sections and rules their pillar tests.
Sections 6 to 7
Consent Management
- Consent is bundled or not affirmative
- Withdrawal does not stop processing or trigger erasure
- No auditable consent record
- Legitimate-use basis undocumented
- No verifiable parental consent for children's data (if flagged)
Sections 11 to 14, Rule 14
Data Principal Rights
- Right to access not operational
- Correction and erasure not actionable
- No tracked grievance redressal
- Right to nominate not supported
Section 8(6), Rule 7
Breach Preparedness
- No tested breach notification process
- Cannot detect a breach independently
- No breach escalation ownership
Section 8(7) to (8), Rule 8
Retention and Erasure
- Data kept beyond its purpose
- No documented retention schedule
- Processor erasure not enforced
Sections 8 and 10, Rules 6 and 13
Governance and Accountability
- Security safeguards not evidenced
- Processor contracts not DPDPA-aligned
- Not prepared for Significant Data Fiduciary duties
The actual assessment
Try one question now.
A real question from the assessment, with the section it tests.
Breach Preparedness · Section 8(6), Rule 7
If you discovered a personal data breach right now, could you notify the Data Protection Board and every affected Data Principal in the prescribed form and manner, without delay?
Maturity on this question
?
Pick the answer closest to where you are today.
Get my free score
One of 20+ questions. Free score, no login, no card.
DPDPA Readiness Report
Every finding, with the DPDPA section behind it and the DPDP Rule where one applies, sequenced into 30, 60, and 90 day horizons.
Cover and score
Executive summary
Pillar analysis
30, 60, 90 day roadmap
Enforcement timeline
Every finding, gap by gap
See your score free. Pay only for the plan.
You decide after you have seen your number.
Readiness score
Rs 0
Asks for your name, company and work email. No login, no card.
- Your 0 to 100 readiness score
- Your risk band
- A breakdown across all six pillars
- Your indicative position against your sector
- Up to your top 3 gaps, ranked by impact on your score
Full readiness report
Optional, after your scoreRs 999
+ 18% GST, Rs 1,179 all-in. A single payment, nothing recurring.
- Your full 0 to 100 score with per-pillar commentary
- All findings, gap by gap, with your maturity level on each
- The DPDPA section behind every finding, and the DPDP Rule where one applies
- Operational remediation for each gap, sequenced into 30, 60, and 90 day horizons
- Your position against the indicative sector range
- Enforcement obligations mapped to the Nov 2026 and May 2027 milestones
- A Significant Data Fiduciary addendum under Section 10 when flagged
You pay nothing until after your score is on screen, and only if you choose the full report.
The questions a careful buyer asks.
What do you ask for, and why?
A few questions about your organisation, then your name, company and work email. We ask your sector and size so we can benchmark you correctly. Phone is optional. No login, no card to see your score.
Are the sector ranges measured?
Sector ranges are our own estimates, labelled indicative. They are not measured data.
Is this legal advice?
No. It is a readiness indication based on self-reported answers. It is not legal advice and does not constitute a compliance certification. It scores what you tell it, so it is only as good as your answers. Use it to see where to look first, then take advice on what you find.
What do you store about me?
We store your name, work email and company, your phone if you give one, and your answers. Our hosting and email providers process them for us.
Why do you ask for a work email?
Benchmark reports are issued to organisations, so personal addresses such as Gmail are not accepted. The same address is where we send your summary.
What is in the paid report?
The full report is Rs 999 + 18% GST, Rs 1,179 all-in, a single payment, nothing recurring. It has your full 0 to 100 score with per-pillar commentary; all findings, gap by gap, with your maturity level on each; the DPDPA section behind every finding, and the DPDP Rule where one applies; operational remediation for each gap, sequenced into 30, 60, and 90 day horizons; your position against the indicative sector range; and, when flagged, a Significant Data Fiduciary addendum under Section 10. Your score is free first. You decide after.
When do the penalties start?
The penalty schedule commences on 13 May 2027, together with every substantive duty. The highest penalty in the Schedule may extend to Rs 250 Cr (Section 33(1) and the Schedule, entry 1), for a breach of the duty to take reasonable security safeguards. Other breaches carry lower ceilings. A ceiling is not a fixed fine, and the Board imposes a penalty only after an inquiry, a hearing and a finding that the breach is significant. The IT Secretary has confirmed there is no grace period. The Consent Manager framework has a separate date: 13 Nov 2026.
What is dpdpa.ai?
dpdpa.ai is the readiness assessment of Delta Data Labs, a DPDPA compliance delivery firm. It gives you an indication of how exposed you are and, if you want help closing the gaps, it is how we start that conversation. The readiness assessment is free, and so is your score.
Know your number before your board asks, or the regulator does.
- Free score
- No login
- No card
- Score on screen when you finish
To see it: name, company, work email.
Which sector best describes your organisation?