Readiness self-check

How DPDP-ready are your systems?

Twenty questions, about ten minutes. Answer for the systems that hold the most personal data.

This check looks at your systems and processes. It is not a legal assessment and does not tell you whether you comply with the law.

About you · not scored
Knowing your data

01Do you have a current list of the personal data you hold, and where it is stored?

02Do you know which third parties receive personal data from you?

03Do your development and test systems use masked or dummy data rather than real customer data?

Notice and consent

04Do you show people a clear notice of what you collect and why, when you ask for their consent?

05Do you keep a record of each person’s consent, with the date and purpose?

06When someone withdraws consent, does processing stop in every system, including SMS and email marketing?

Rights requests

07Can people ask to see, correct or erase their data through a defined channel?

08Do you verify a person’s identity before acting on such a request?

09Do you publish a contact for data-protection grievances, and track responses?

Retention

10Have you defined how long each kind of personal data is kept?

11Is data deleted or archived automatically when that period ends, including copies and backups?

Security

12Is access to personal data limited by role, with no shared logins?

13Is personal data encrypted when stored and when sent between systems?

14Do you log who accesses or changes personal data, and keep those logs?

15Has your application code been reviewed for security weaknesses in the last 12 months?

Breach readiness

16Would you detect unusual access or a bulk export of personal data within hours?

17Do you have a written plan for who does what in a data breach?

18Have you rehearsed that plan in the last 12 months?

Ownership

19Is one named person responsible for DPDP in your business?

20Do your contracts with vendors who handle personal data include data-protection terms?

0 of 20 answered