DPDP Readiness Check for Indian Businesses
Answer 21 quick questions to see how ready your business is for India’s Digital Personal Data Protection Act and the DPDP Rules, 2025. You get a score, a prioritised gap list and a PDF report.
Takes about 5 minutes. Your answers stay in your browser; nothing is sent to us.
DPDP Readiness Report
DPDP Act: common questions
Does the DPDP Act apply to my small business?
Yes, if you handle digital personal data of people in India, such as customer, employee or website visitor data. There is no general exemption for small businesses. The government can exempt some startups from certain duties by notification.
When do I have to comply?
The DPDP Rules were notified on 13 November 2025 with a phased start. Most duties for businesses, including notices, consent, security safeguards, breach reporting and rights requests, start on 13 May 2027. That leaves limited time to map data, update forms and fix security gaps.
What happens after a personal data breach?
Under Rule 7 you must inform the Data Protection Board and each affected person without delay, and send the Board a detailed report within 72 hours. Separately, CERT-In’s 2022 directions already require many cyber incidents to be reported within six hours.
Is this check legal advice?
No. It is a practical self-assessment based on the Act, the Rules and published guidance. For a formal gap assessment, policies and security fixes, talk to us.