That is a design claim, so here is the proof rather than the promise. This page has no analytics on the assessment, no form auto-submit and no network call when you answer a question.
A single browser localStorage key on this device. Not a cookie, so it is never attached to a request.
Nothing. The only time data reaches us is if you fill in the enquiry form and press send, or attach the CSV yourself.
Nothing at all. There is no account, no identifier and no server-side record of your assessment.
Generated in your browser and saved straight to your device. It is never uploaded.
vedhacon.dpdp.v1
Nothing stored yet.
Prefer to verify yourself? Open developer tools, then Application, then Local Storage. You will see the one key above and no network activity as you answer.
Notice, consent, Data Fiduciary duties, SDF obligations and breach intimation, explained.
See how we implement itWe scope against the laws that actually apply to you, then sequence the work by risk.
Start the assessmentWhat must be operational before the substantive obligations commence in 2027.
Read the briefingAnswer the gap assessment and get a prioritised remediation roadmap instantly.
Start the assessmentTrack 01 assumes no prior knowledge of governance, risk and compliance.
Start Track 01Every Data Fiduciary in India now has a fixed date and a real penalty attached to it. This page gives you the working tools: score your gap against 52 statutory obligations, read what all 44 sections actually require of you, and take away a phased plan that lands before 13 May 2027.
Fifty-two questions, each tied to a section of the Act or a rule you can be penalised under, including the Consent Manager and enforcement-readiness themes below. Answer honestly, mark anything that does not apply to you, and the score adjusts. Your answers stay in this browser and are never transmitted.
Rule 4 is the first substantive obligation to commence, six months ahead of everything else. It is also the one most organisations wrongly assume does not apply to them.
A registered intermediary through which a Data Principal can give, review, manage and withdraw consent in one place, defined at Section 2(g) and governed by Rule 4.
Rule 4 is the only rule commencing on that date. Registration and the obligations attached to it begin then, a full six months before the rest of the Rules bite.
Either you become a Consent Manager, which is a regulated activity with a net worth test, or you interact with one. Most organisations are in the second position and still have work to do.
These answers count towards your overall readiness score above and stay in your browser.
A short structured assessment of your business model against the First Schedule, ending in a written, defensible decision your board can sign.
We prepare the Board application, the net worth evidence, the technical description and the governance framework the First Schedule asks for.
We restructure your consent store so it can be read, exported and reconciled by a Consent Manager, rather than trapped in application logs.
We map every downstream system a withdrawal must reach, then build and test the propagation so withdrawal is as easy as giving consent, as Section 6(4) requires.
Template and negotiate the Consent Manager agreement, covering duties, audit access, breach reporting and exit.
We run a simulated registration and a simulated withdrawal in the quarter before 13 November 2026, so the first live one is not the first one.
On 13 May 2027 the remaining Rules apply and the Act becomes enforceable in full. The question is not whether you know the law, but whether you can evidence compliance with it on that date.
Rules 3 and 5 to 16, plus 22 and 23. Notice, Consent Manager duties, State processing, security safeguards, breach intimation, erasure, contact publication, children, exemptions, SDF duties, rights and cross-border conditions.
Inquire into a complaint and impose penalties up to Rs 250 crore per contravention. Section 33(2) makes documented, prompt mitigation a real mitigating factor.
Not a policy folder. A running control environment with evidence, an owner per obligation, and a tested breach runbook on both the six-hour and seventy-two hour clocks.
These answers count towards your overall readiness score above and stay in your browser.
We validate your self-assessment with evidence sampling, because the gap between believed and demonstrable compliance is where penalties live.
Workstreams, owners, dependencies and budget, working backwards from the deadline rather than forwards from today.
Notices, consent flows, RoPA, retention schedules, DPIAs, breach runbooks and the grievance mechanism, delivered as working artefacts.
Every control ships with the evidence an auditor or the Board would ask for, captured at the time rather than reconstructed later.
Readiness decays. We re-score you each quarter and reopen only what moved, so the programme stays honest.
A one-page position your board and, if needed, the Data Protection Board can read without translation.
The Schedule to the Act sets a separate ceiling for each category of failure, and the Board can impose them for the same incident. Tick what could realistically go wrong today and see the statutory ceiling you are carrying, with the provision cited for every line.
Figures are the statutory maximum per instance. The Board sets the actual amount under S. 33(2), weighing the nature, gravity and duration of the breach, whether you mitigated it, and your conduct afterwards. Repeat instances can be assessed separately.
Significant Data Fiduciary status is not something you opt into. The Central Government notifies a Data Fiduciary, or a class of them, under S. 10(1) on the factors below. If you are designated, four additional duties attach and a separate ₹150 crore penalty category opens. Answer honestly — this is the same screen we run in a scoping call.
Most summaries stop at the headline duties. This is the full instrument, section by section, with what each one demands of you on the left and what we build for you on the right. Search it, filter it by chapter, and switch between the three instruments.
The Act commences in phases by Government notification; different provisions may start on different dates.
Ch 1 · PreliminaryDefines Data Principal, Data Fiduciary, Data Processor, personal data, processing, consent manager and more.
Ch 1 · PreliminaryApplies to digital personal data processed in India, and to processing outside India connected with offering goods or services to Data Principals in India.
Ch 1 · PreliminaryProcessing is lawful only on consent or a legitimate use. No other ground exists.
Ch 2 · Obligations of Data FiduciaryA clear, itemised notice must accompany or precede the consent request, in English or any Eighth Schedule language.
Ch 2 · Obligations of Data FiduciaryConsent must be free, specific, informed, unconditional, unambiguous, with clear affirmative action, and as easy to withdraw as to give.
Ch 2 · Obligations of Data FiduciarySets out the specific legitimate uses, including voluntary provision, State functions, medical emergency and employment purposes.
Ch 2 · Obligations of Data FiduciaryAccountability for processing by processors, data accuracy, security safeguards, breach handling, erasure and grievance redressal.
Ch 2 · Obligations of Data FiduciaryVerifiable parental consent required; no tracking, behavioural monitoring or targeted advertising directed at children.
Ch 2 · Obligations of Data FiduciaryAppoint a DPO in India, appoint an independent data auditor, conduct periodic DPIAs and audits.
Ch 2 · Obligations of Data FiduciaryData Principals may obtain a summary of personal data processed and the identities of recipients.
Ch 3 · Rights and Duties of Data PrincipalRight to correction, completion, updating and erasure of personal data.
Ch 3 · Rights and Duties of Data PrincipalData Fiduciary must provide a readily available grievance mechanism and respond within a prescribed period.
Ch 3 · Rights and Duties of Data PrincipalData Principals may nominate another individual to exercise rights in the event of death or incapacity.
Ch 3 · Rights and Duties of Data PrincipalData Principals must not impersonate, suppress information or register false grievances.
Ch 3 · Rights and Duties of Data PrincipalThe Central Government may restrict transfer of personal data to notified territories.
Ch 4 · Special provisionsSets out exemptions including enforcement of legal rights, judicial functions, and processing of non-resident data under foreign contract.
Ch 4 · Special provisionsThe Government may amend the Schedule of penalties, subject to limits.
Ch 4 · Special provisionsEstablishes the Data Protection Board of India.
Ch 5 · Data Protection Board of IndiaComposition, qualifications and expertise requirements for the Board.
Ch 5 · Data Protection Board of IndiaTerms of service for Chairperson and Members.
Ch 5 · Data Protection Board of IndiaGrounds on which a Member may be removed.
Ch 5 · Data Protection Board of IndiaResignation and vacancy procedure.
Ch 5 · Data Protection Board of IndiaBoard proceedings and validity of acts.
Ch 5 · Data Protection Board of IndiaBoard may appoint officers and employees.
Ch 5 · Data Protection Board of IndiaMembers and officers deemed public servants.
Ch 5 · Data Protection Board of IndiaThe Board directs remedial measures, inquires into breaches and imposes penalties.
Ch 6 · Powers, functions and procedureBoard procedure on complaints, inquiry and natural justice; functions as a digital office.
Ch 6 · Powers, functions and procedureAppeals against Board orders lie to the TDSAT within 60 days.
Ch 7 · Appeal and alternate dispute resolutionTribunal orders execute as a civil court decree.
Ch 7 · Appeal and alternate dispute resolutionThe Board may refer a complaint for mediation or other dispute resolution.
Ch 7 · Appeal and alternate dispute resolutionA person may give a voluntary undertaking to the Board, which bars further proceedings on that matter.
Ch 7 · Appeal and alternate dispute resolutionPenalties up to 250 crore rupees per the Schedule, determined after inquiry.
Ch 8 · Penalties and adjudicationPenalties credited to the Consolidated Fund.
Ch 8 · Penalties and adjudicationProtects good-faith acts of the Board and Government.
Ch 9 · MiscellaneousThe Government may require information from the Board or any Data Fiduciary.
Ch 9 · MiscellaneousBlocking of access on repeated penalty, in the interests of the general public.
Ch 9 · MiscellaneousThe Act is in addition to and not in derogation of other laws.
Ch 9 · MiscellaneousNo civil court may hear matters the Board is empowered to decide.
Ch 9 · MiscellaneousEmpowers the Government to make rules, giving effect to the DPDP Rules.
Ch 9 · MiscellaneousRules must be laid before Parliament.
Ch 9 · MiscellaneousGovernment may remove difficulties within three years of commencement.
Ch 9 · MiscellaneousOmits Section 43A of the IT Act.
Ch 9 · MiscellaneousAmends the Telecom Regulatory Authority of India Act and the Right to Information Act.
Ch 9 · MiscellaneousTiered commencement. Rules 1, 2, 17 to 21 applied on notification (13 Nov 2025). Rule 4 applies from 13 Nov 2026. Rules 3, 5 to 16, 22 and 23 apply from 13 May 2027.
The notice must be standalone, in clear plain language, itemising the personal data and purpose, and giving the withdrawal and grievance links.
Consent Managers must register with the Board and meet stated conditions, including a net worth threshold.
Standards for processing for subsidy, benefit, service, certificate, licence or permit.
Encryption, obfuscation, masking, access control, logging and monitoring, backups, and contractual obligations on processors.
Affected Data Principals told without delay in plain language; the Board notified without delay; a detailed report filed with the Board within 72 hours.
Erasure once the purpose is no longer served. Schedule III sets a three-year limit for large e-commerce, online gaming and social media intermediaries, with 48 hours advance intimation to the Data Principal.
Publish contact details of the DPO or person answering processing questions on the website and in every notice.
Verifiable parental or guardian consent, with due diligence on identity and age.
Exemptions for specified classes including healthcare and educational institutions for stated purposes.
Annual DPIA and audit, algorithmic due diligence, and localisation of specified personal data.
Publish the means to exercise rights, the identifiers required, and the response timelines.
Conditions on making personal data available to a foreign State or its instrumentality.
Board appointment machinery.
Complaint procedure, digital office functioning, and appeal process to the Appellate Tribunal.
The Government may call for information from a Data Fiduciary or intermediary.
Omitted by Section 43 of the DPDP Act. Contracts and policies still citing it are now stale.
Reasonable security practices for sensitive personal data; sector contracts still reference them widely.
Criminal liability for capturing or transmitting images of a private area without consent.
Powers to direct interception, monitoring or decryption, with compliance duties on intermediaries.
Blocking directions, which interact with Section 37 of the DPDP Act.
Six-hour cyber incident reporting, 180-day log retention in India, and KYC obligations for specified service providers.
Criminal liability for disclosure of personal information in breach of a lawful contract.
Due diligence obligations under the IT Rules 2021 as a condition of safe harbour.
Roughly twenty-eight weeks of build, then a steady state. Start now and you finish with room to spare. Start in 2027 and you are negotiating with the Board rather than preparing for it.
We find the personal data you hold and the duties it attracts, so the rest of the programme is scoped on evidence rather than guesswork.
We write the controls that the Act and the Rules actually ask for, in language your business and your auditor can both use.
Controls stop being documents. We build the mechanisms, wire them into your systems, and prove they work.
Compliance is a state you maintain, not a project you finish. We keep the evidence current and the Board answerable.
Once you have run the gap assessment above, this builds a one-page summary in the language a board actually responds to: where you stand, what it exposes you to, what happens next and by when. It prints clean to PDF. Everything is generated in this browser from your own answers.
Run the gap assessment first. Your board summary builds itself as you answer.
Prepared for internal governance review
—
—
—
Generated from a self-assessment against the DPDP Act 2023 and the DPDP Rules 2025. It records management's own view of readiness and is not a legal opinion or an independent audit.
We scope on the size of your estate and the duties that actually attach to you, not on headcount bands. Tell us where you are and we will come back with a fixed proposal.
A fixed-scope engagement that tells you exactly where you stand and what it will take. You get a defensible gap report rather than a sales pitch.
The full build. We design the controls, put them into your systems and leave you with evidence that stands up to an auditor or the Board.
Named DPO capacity, annual DPIA and audit, and someone accountable when the Board writes to you. For organisations where privacy failure is a board-level risk.
Built by people who run governance, risk and compliance for a living, not by a template vendor.
We write the policy and then wire the control, so the two do not drift apart six months later.
If you also carry GDPR, CCPA or ISO obligations, we map them once rather than running parallel programmes.
Every control ships with the artefact that proves it, ready for an auditor or the Data Protection Board.
Our knowledge pages are free and deliberately thorough. Read the law first, decide afterwards whether you want a hand implementing it.
Scope, key definitions and who it binds.
ReadSections 4 to 10, in the order you must satisfy them.
ReadAccess, correction, erasure, grievance and nomination.
ReadWhat to report, to whom, and inside what clock.
ReadThe Schedule, tier by tier, with what triggers each.
ReadEvery defined term, searchable.
ReadAny person who alone or with others determines the purpose and means of processing digital personal data. It is the Indian equivalent of a controller. If you decide why and how personal data is processed, you are a Data Fiduciary and the duties in Sections 4 to 10 apply to you directly.
The DPDP Rules 2025 were notified on 13 November 2025 with a tiered commencement. Rules 1, 2 and 17 to 21 applied immediately. Rule 4, covering Consent Manager registration, applies from 13 November 2026. The substantive obligations in Rules 3 and 5 to 16, along with Rules 22 and 23, apply from 13 May 2027.
The Schedule to the Act sets penalties up to Rs 250 crore for failure to maintain reasonable security safeguards, up to Rs 200 crore for failing to notify a breach and for breach of childrens data obligations, up to Rs 150 crore for breach of Significant Data Fiduciary duties, and up to Rs 50 crore for any other contravention.
Affected Data Principals must be informed without delay in plain language, and the Data Protection Board must be notified without delay with a detailed report inside seventy-two hours. Separately, CERT-In directions require reporting of specified incidents within six hours, so most organisations run both clocks together.
Section 44(2) omits Section 43A of the IT Act, which carried the SPDI Rules. The rest of the IT Act 2000 stays in force, including Section 66E on privacy violation, Section 69 and 69A powers, Section 70B for CERT-In, Section 72A on disclosure in breach of contract, and Section 79 intermediary due diligence.
The Central Government notifies Significant Data Fiduciaries based on volume and sensitivity of personal data, risk to Data Principals, risk to electoral democracy, security of the State and public order. Once notified, you must appoint an India-based Data Protection Officer, commission an independent data auditor, and carry out an annual Data Protection Impact Assessment.
Each of the 41 questions maps to a statutory hook in the Act or the Rules. You answer Yes, Partly or No, and can mark a question not applicable. Yes scores two points, Partly scores one, No scores zero, and not applicable is removed from the denominator, so the percentage always reflects only the obligations that genuinely apply to you.
The Act makes the Data Fiduciary accountable, and nothing we do changes that. What we can change is how much of it you have to hold in your own head, and how exposed you are on the day someone asks you to prove it.
One accountable consultant leads your programme end to end. You will know who is answering when the Board writes, and so will they.
Most advisers hand you a gap list and leave. We write the notices, build the consent flows, stand up the RoPA and test the breach runbook with your teams.
Priced per milestone before we start. No hourly drift, no surprise variation once the discovery finds more than expected.
Every plan is built backwards from 13 May 2027 with slack designed in, so a slipped dependency does not become a missed statutory date.
Each control ships with its proof attached, in the form Section 33(2) and Rule 12 would expect, so mitigation is demonstrable rather than asserted.
Readiness decays as systems change. Quarterly re-scoring and an on-call line mean you are not alone the first time something goes wrong.
We hold the plan, the dependencies and the calendar. You get a one-page position when it changes, not a spreadsheet to police.
Your team stops guessing. Ambiguous questions come to us and come back with a written, reasoned answer you can file as evidence.
If a breach lands at 2am, the runbook is already written, rehearsed and owned. The six-hour clock is not the moment to start reading Rule 7.
Built and run by working governance, risk and compliance practitioners, not generalist consultants reading the Act for the first time.
GDPR, CCPA and CPRA, PIPL and the DPDP Act side by side, so a global estate gets one coherent control set instead of four conflicting ones.
CERT-In six-hour reporting, Section 70B log retention and intermediary due diligence handled together with DPDP, because they did not go away.
The GRC Academy and community exist so your team can eventually run this without us. That is the intended outcome.
If you have run the assessment above, mention your score and we will open the conversation from there. No obligation, and no answers leave your browser unless you choose to include them.
We use what you send only to answer you. Read our privacy notice.