India’s data protection law has moved. Has your business?
Ten minutes. A few honest answers about how your business actually handles customer data. A clearer picture of where you stand, before someone else asks you first.
A practical readiness check for the Digital Personal Data Protection Act, 2023, built for Indian business owners, not for lawyers reading it for fun.
Opens in a new tab. Free. No sign-up. About ten minutes.
What to expect
- Free, with no account or sign-up
- Takes about ten minutes
- Your answers stay in this browser tab
- Guidance to work from, not legal advice
The law did not arrive on one day
It arrived in stages, and the stages are not over. The DPDP Act became law in 2023, but stayed dormant until the Rules were notified in November 2025. Two more milestones are still ahead, and this is the timeline the readiness check itself is built against.
This is not a countdown to a single deadline. It is the calendar the whole assessment is built against: understand it, and prepare sensibly.
Before you worry about compliance, answer a simpler question. Do you actually know what customer data your business holds, and who can see it?
Most business owners cannot answer that in one sentence, and that is the honest starting point. The check does not ask you to know the law. It asks practical questions about how your business already works, one module at a time, and works out where the gaps are from your answers.
Six things, at the end of ten minutes
Nothing here is invented for this page. This is exactly what the assessment produces once you finish.
Readiness score
A single score out of 100, worked out from how your answers weigh against the areas the Act treats as most serious.
Plain-language gap report
Every open item, explained in the same ordinary words the questions used, not legal phrasing you need translated.
Priority and severity
Gaps ordered by how seriously the Act treats them, so you know what to fix first and what can wait.
A practical roadmap
Your gaps sequenced against the real dates: now, before November 2026, and before 13 May 2027.
Starter documents
Four working drafts, your business name already filled in: a privacy notice, consent wording, a vendor checklist and a breach playbook.
Act & Rules reference library
A plain-language digest of the whole Act and the Rules, chapter by chapter, to come back to whenever you need it.
Five steps, nothing more
Tell us about the business and how it collects customer details.
Answer practical questions about how the business actually handles data.
See where the gaps are, in plain words, ordered by severity.
Get a roadmap for what to address, and by when.
Take the output to your lawyer or your internal team.
Built around how real Indian businesses collect data
The check is not written for one industry. These are the categories the assessment itself asks you to choose from.
If your business collects a customer’s name, phone number or email through any digital channel, the Act applies regardless of sector, turnover or size. There is no small-business exemption.
Worth saying plainly, so you can trust the rest
It is not a legal certificate. Nothing it produces is a certification, registration or approval of any kind.
It does not certify compliance. A high score means fewer open gaps by your own answers, not a guarantee a regulator would agree.
It does not replace a data-protection lawyer. The output is designed for a lawyer to review before you rely on it, not instead of one.
It is a practical first assessment. A place to start with clear eyes, not the last word on where your business stands.
The highest statutory penalty ceiling under the Act, for a failure to take reasonable security safeguards that leads to a personal data breach. It is a maximum set by the Schedule to the Act, not a prediction, and it says more about how seriously the law treats security than about what is likely to happen to any one business. The sensible response to a law with real consequences is simply to know where you stand.
What has changed recently
A gap list tells you what to fix. It does not know which of those matters most for how your business actually runs. If that would help, talk it through with someone, free of charge, once you have your result.
Leave your details and someone will call
This is the same enquiry desk the readiness check itself uses. No separate mailing list, no sales pitch, just a conversation about your result if you want one.
Most people who write in have already run the check and want to talk through what it found. You do not have to finish it first though; if you would rather understand the law before you start, that is a fair reason to write in too.
Tell us when it suits you to talk, and in which timezone. We default to Indian Standard Time, but you can pick another if that fits you better.
Everything here goes to the same place the check’s own “get help” button does. Nobody outside sees it.