What does this readiness check measure?

It covers the duties most small businesses face under the DPDP Act, 2023 and DPDP Rules, 2025: knowing your data, notice and consent, security, breach readiness, vendors, retention and individual rights. Each answer scores 2, 1 or 0.

How is the score calculated?

Yes scores 2, Partly scores 1 and No scores 0, out of 30. 24 or more is green, 14 to 23 is amber, and below 14 is red. Every Partly or No answer appears in your action list.

Is the result legal advice?

No. It is an indicative self-assessment. A Health Check reviews your actual systems, notices and contracts before you rely on the result.

When do these duties apply?

Most duties under the DPDP Rules, 2025 apply from 13 May 2027. Starting now leaves time for data mapping and vendor reviews, which usually take longest.

Do you store my answers?

Your answers stay in your browser unless you choose to send them with the enquiry form, in which case we use them only to respond to you.

DPDP Act, 2023 · Self-assessment

DPDP readiness check for small businesses

Answer 15 questions about how your business handles personal data. You will see a red, amber or green score out of 30 and a prioritised list of gaps to fix before most DPDP duties apply on 13 May 2027.

0 of 15 answered

Know your data

Do you have a list of the personal data you collect (customers, staff, leads) and where each set is stored?

Is every category of personal data linked to a clear business purpose?

Do you know which outside apps and vendors hold your personal data (Tally, Zoho, payroll, CRM, WhatsApp API, web developer)?

Notice and consent

Do your website forms, app and onboarding show a clear privacy notice in plain language?

Is consent for marketing (WhatsApp, SMS, email) taken separately from billing or delivery?

Can you show when and how each customer gave consent, and honour withdrawals quickly?

If you serve children (schools, coaching, kids’ products), do you obtain verifiable parental consent?

Security

Is access to customer and employee data limited to staff who need it, with individual logins?

Are devices and backups protected (passwords, encryption, tested backups, updated software)?

Do your key systems keep access logs that you retain for at least a year?

Breach readiness

Do you have a written plan for a data breach, including who informs affected people and the Data Protection Board?

Vendors and contracts

Do contracts with vendors that handle your data include data protection and breach terms?

If large customers send you data protection questionnaires, can you answer them with evidence?

Rights and retention

Do you have a retention schedule that also respects GST, income-tax and company-law record periods?

Have you published a contact for data questions and a way to handle access, correction and erasure requests?

Answer all 15 questions to see your score.

Get the full DPDP readiness checklist by email

We email the readiness checklist (PDF) and reply within one business day. If you have completed the check, your score is included so we can discuss the right next step.

Next: see how SME Advisory runs DPDP compliance for small businesses, or read the 12-step DPDP checklist for MSMEs.

About this readiness check

Scope of services and important information

This page describes services offered by RTA & Associates, Chartered Accountants. It is published for general information and does not constitute tax, legal, financial or investment advice, nor an offer or solicitation to provide services in any jurisdiction where we are not qualified to do so.

Any engagement is governed by a separate written engagement letter, which sets out the scope of work, the deliverables, the fees and the limits of our responsibility. Nothing on this page forms part of that engagement or varies its terms.

Descriptions of timelines, processes, costs and outcomes are indicative and depend on your specific circumstances and on third parties — regulators, exchanges, banks and counterparties — whose timelines we do not control. Statutory and regulatory requirements change; the current position should be confirmed before you act.

We are Chartered Accountants. Where a matter requires legal advice, advice on the law of a country other than India, or a regulated investment recommendation, we will say so and you should take advice from an appropriately qualified and licensed adviser in the relevant field and jurisdiction.