DPDP readiness check Ten questions based on the Digital Personal Data Protection Rules, 2025. Most company duties start about 13 May 2027. Your answers stay in your browser: nothing is sent or stored. This is a planning aid, not legal advice and not a compliance certificate.
1. Before collecting personal data, do you show a notice that lists the data you collect and why, in plain language, with a link to withdraw consent? (Rule 3)
2. Is consent asked for before non-essential cookies, trackers and marketing, and can people say no and withdraw later? (Sections 6 and 7 of the Act)
3. Can you show when and what each person agreed to? (Act, Section 6)
4. Is personal data protected by encryption or masking, access controls, activity logs and backups, and are processors bound by contract to do the same? (Rule 6)
5. Do you keep logs of access to personal data for at least one year? (Rules 6(1)(e) and 8(3))
6. If personal data were leaked tomorrow, do you have a written plan to tell each affected person without delay, tell the Board without delay and send the Board a detailed report within 72 hours? (Rule 7)
7. Do you publish how people can see, correct or erase their data and a contact who can answer questions, and reply to complaints within 90 days at most? (Rules 9 and 14)
8. Do you delete personal data when its purpose is finished and warn the person at least 48 hours before (where Rule 8 applies to you)? (Rule 8)
9. If you handle data of anyone under 18, do you get verifiable parental consent first? (Rule 10)
10. Do you know which systems hold personal data, what kind, and why? (Supports Rules 6, 8, 14)
Answer all questions (0/10)