DPDP compliance checker
Fifteen questions on notice, consent, children’s data, security, breaches, retention, rights and processors. See each gap with the section or rule behind it and the date it applies.
Last updated 22 October 2026
What does the DPDP compliance checker tell you?
The checker asks 15 yes, partly or no questions across eight areas of the DPDP Act, 2023 and DPDP Rules, 2025. It lists each gap with the section or rule it comes from and the date that rule applies, mostly 13 May 2027, and shows how many areas you cover. Nothing is stored or sent.
Where does your business stand on DPDP compliance?
Answer each question for how your business works today. Choose Partly when a control exists for some systems or customers but not all, and Not applicable only where the question allows it. Your result appears once every question is answered.
Your result
0 of 15 questions answered
Answer every question to see your gaps and readiness.
Your answers stay in this browser tab and are never stored or sent; only the one-time sign-up form is. This is a self-check, not a legal audit.
How does the DPDP compliance checker work?
Each question tests one duty that the Digital Personal Data Protection Act, 2023 (official text) places on a Data Fiduciary, as detailed by the DPDP Rules, 2025 (G.S.R. 846(E)). A No or Partly becomes a gap, listed with what to fix, the section and rule it comes from, and when that rule applies.
The readiness figure counts areas, not points: an area is covered only when every question in it is Yes or Not applicable, and areas where everything is Not applicable drop out of the total. A score such as “6 of 8 areas covered” is deliberately rough; a percentage would suggest a precision a self-check cannot have.
| Area | Question checks | Act and Rules |
|---|---|---|
| Notice and consent | Give a notice with or before every consent request | Act s. 5(1); Rules, rule 3(a) and (b) |
| Notice and consent | Offer the notice and the consent request in English or any Eighth Schedule language, in clear and plain language, and give the contact details of the person who answers rights requests | Act s. 5(3) and s. 6(3); Rules, rule 3 |
| Notice and consent | Make withdrawal as easy as giving consent, describe how to do it in the notice, and stop processing (and make your processors stop) within a reasonable time after withdrawal | Act s. 6(4) and s. 6(6); Rules, rule 3(c)(i) |
| Notice and consent | For consent given before commencement, send a notice as soon as reasonably practicable describing the personal data, the purpose, how to exercise rights and how to complain to the Board | Act s. 5(2); Rules, rule 3 |
| Children’s data | Before processing a child’s personal data, obtain verifiable consent of the parent, checking the parent is an identifiable adult using reliable identity and age details you hold or details (or a virtual token) provided voluntarily | Act s. 9(1); Rules, rule 10 |
| Children’s data | Stop tracking, behavioural monitoring and targeted advertising directed at children, and any processing likely to harm a child’s well-being, unless a Fourth Schedule exemption covers you | Act s. 9(2) and s. 9(3); Rules, rule 12 and Fourth Schedule |
| Security safeguards | Put the minimum safeguards in place: encryption, obfuscation, masking or virtual tokens; access control on computer resources; and measures such as backups for continued processing | Act s. 8(5); Rules, rule 6(1)(a), (b), (d) and (g) |
| Security safeguards | Log and monitor access to personal data so unauthorised access can be detected and investigated, and keep logs and the related personal data for one year unless another law says otherwise | Act s. 8(5); Rules, rule 6(1)(c) and (e), rule 8(3) |
| Breach readiness | Write a breach plan: intimate each affected person without delay (what happened, likely consequences, mitigation, steps they can take, a contact), intimate the Board without delay, and file the detailed report within 72 hours of becoming aware | Act s. 8(6); Rules, rule 7 |
| Retention and erasure | Set retention schedules: erase data when the purpose is served or consent is withdrawn unless a law requires retention, have processors erase it, and if you are in a Third Schedule class, warn people at least 48 hours before erasure | Act s. 8(7) and s. 8(8); Rules, rule 8 and Third Schedule |
| Rights and grievances | Publish the means for making rights requests and the identifier (such as a username, customer number or email) you need, and handle requests for access, correction, erasure and nomination | Act ss. 11, 12 and 14; Rules, rule 14(1), (2) and (4) |
| Rights and grievances | Set up an effective grievance mechanism, publish your response period (not more than ninety days) on your website or app, and put measures in place to meet it | Act s. 8(10) and s. 13; Rules, rule 14(3) |
| Rights and grievances | Publish that business contact prominently on your website or app, and include it in every response to a rights request | Act s. 8(9); Rules, rule 9 |
| Processors | Engage processors only under a valid contract, include security safeguard obligations in it, and remember you stay responsible for what processors do on your behalf | Act s. 8(1), 8(2) and 8(5); Rules, rule 6(1)(f) |
| Significant Data Fiduciary indicators | Plan for the added duties: an India-based DPO responsible to the board, an independent data auditor, a DPIA and audit every twelve months with significant observations reported to the Board, and due diligence on algorithmic software | Act s. 10; Rules, rule 13 |
What does the checker not do?
- It is not a legal audit. It relies on your answers and does not inspect your systems, notices, contracts or logs.
- It does not cover every duty. It leaves out, for example, cross-border transfer requirements under rule 15, the exemptions in section 17 and the State’s legitimate uses in section 7.
- It cannot decide whether you are a Significant Data Fiduciary. Under section 10, the Central Government notifies them after assessing factors such as the volume and sensitivity of personal data.
- It does not store or send anything. Close the tab and your answers are gone.
For the full list of duties, use the DPDP compliance checklist.
When does each part of the DPDP Rules apply?
Rule 1 of the DPDP Rules, 2025 sets three commencement dates, counted from publication in the Gazette on 13 November 2025 (Rules; PIB release). A separate notification the same day, G.S.R. 843(E) (Gazette), brings the Act’s own sections in on the same three dates: the duties of Data Fiduciaries, the rights of Data Principals and the penalties all apply from 13 May 2027.
| Date | Rules in force | What they cover |
|---|---|---|
| 13 November 2025 (publication) | Rules 1, 2 and 17 to 21 | Definitions; appointment, pay and procedure of the Data Protection Board; the Board as a digital office |
| 13 November 2026 (one year after) | Rule 4 | Registration and obligations of Consent Managers |
| 13 May 2027 (eighteen months after) | Rules 3, 5 to 16, 22 and 23 | Notice, security safeguards, breach intimation, retention and erasure, contact details, data of children and of persons with disability, Significant Data Fiduciaries, rights, transfers, research exemption, appeals, calls for information |
What is Perimattic building for DPDP compliance?
The Perimattic DPDP Compliance Suite is planned software to help Indian businesses close the gaps this checker finds. The plan includes:
- A personal-data inventory: what you collect, where it lives and why.
- A notice builder for rule 3 notices in English and Eighth Schedule languages.
- Consent capture and records, with withdrawal as easy as giving consent.
- Rights requests and grievances with response-time tracking.
- A breach response workflow for intimations to people and reports to the Board under rule 7.
- Retention and erasure schedules under rule 8, including the 48-hour pre-erasure intimation.
- Verifiable parental consent under rule 10, and a processor and vendor register.
Status: The Perimattic DPDP Compliance Suite is in development; none of this is available to use yet. Sign up to follow the build.
General guidance, not legal advice. Checked against the DPDP Act, 2023 and DPDP Rules, 2025 on 22 October 2026.
More on DPDP compliance
The DPDP compliance checker, answered
Is the DPDP compliance checker a legal audit?
No. It is a self-check based on your own answers, compared with the duties in the DPDP Act, 2023 and the DPDP Rules, 2025. It does not look at your systems, contracts or documents, and it cannot tell you whether you will be notified as a Significant Data Fiduciary. Use it to find where to start, then confirm with a lawyer.
Does the checker store or send my answers?
No. The checker runs entirely in your browser. Answers live in the page while it is open and disappear when you close or reload it. There is no tracking of what you select. Seeing the result needs a one-time free sign-up, and only that sign-up form is sent, never your answers.
When do the DPDP obligations start to apply?
The DPDP Rules, 2025 were published on 13 November 2025. Under rule 1, the rules on notice, security, breach intimation, retention, children’s data, Significant Data Fiduciaries and rights come into force eighteen months later, on 13 May 2027. Rule 4 on Consent Managers applies from 13 November 2026.
Want DPDP compliance built around how your business handles data?
Sign up to tell us what personal data you handle, follow the build and be first to try the DPDP Compliance Suite when it opens.
Sign up