DPDPA readiness is frequently assessed against the text of the Act, which produces a legal analysis rather than an operational plan. This checklist works the other way: it asks what must be true in your systems for each obligation to be met.
Ninety-six checkpoints span data inventory, notice and consent, rights fulfilment, children's data, processor governance, security safeguards, breach response and Significant Data Fiduciary duties.
Each item states the evidence that would satisfy an auditor, which turns the checklist into a readiness assessment rather than a reading list.
Why it is structured the way it is, and the failure patterns it was designed around.
Not a table of statutory contrasts. The seven places where the two regimes diverge enough to change your data model, your consent screens and your engineering backlog.
A DPDPA-conformant notice set — customer, employee, vendor and website — with itemised processing tables and multilingual structure built in.
Most organisations discover their first real gap during an audit or an incident. The assessment surfaces it in fifteen minutes instead — scored, benchmarked and prioritised, with nothing to buy.
Built for
Kept current
Version 3.1, revised 14 July 2026. We update when a framework changes, when new rules are notified, or when an engagement teaches us something that improves it.
XLSX + PDF · 22 pages
What this will not do
A template cannot know your systems, test your controls or make the judgement calls that determine whether a programme holds up in an audit. Use it to move faster, not to skip the thinking — and treat any resource claiming to make you compliant on its own as a warning about its author.
The designation is discretionary, so the useful question is not whether you are one but what it would cost to be treated as one. Three additional duties, and why we tell large consumer platforms to assume it.
The Act set the principles. The Rules set the engineering requirements. Here is what changes in your systems — notice structure, breach clocks, and verifiable parental consent.
The consent artefacts themselves — itemised capture forms, withdrawal confirmations and parental verification flows, drafted to the DPDPA standard rather than adapted from a GDPR banner.
A working risk register with a pre-populated scenario library, quantified exposure model and treatment tracking — not an empty template.
Your position across privacy, security, governance, risk and AI accountability, scored against sector benchmarks rather than a generic scale.
The specific gaps that matter most for your sector and size, ordered by risk reduction rather than by framework clause number.
Where you stand against DPDPA, ISO 27001, ISO 42001 and SOC 2 — and which of them your buyers are most likely to ask for next.
No sales call required to see your results. Take it, read the output, and decide independently whether you want to talk to anyone.
