DPDP Act Compliance Assessment

About this service

Any business that collects personal data of people in India — customers, users or employees — is a Data Fiduciary under the Digital Personal Data Protection Act, 2023. An advocate reviews what personal data you collect, why, where it is stored, who it is shared with and how long it is kept, and compares that with the Act and the DPDP Rules, 2025: notice and consent, purpose limitation, security safeguards, breach intimation, retention and erasure, children's data and the rights of Data Principals. You receive a written gap report with a prioritised action list. Scope is for one business entity with one website or app; group companies and larger systems are quoted separately.

What you get

• Data-mapping questionnaire and one review call
• Review of your website/app forms, privacy policy and vendor list
• Written gap report against the DPDP Act and Rules
• Prioritised action list with responsibilities
• One follow-up call to walk through the report

How it works

1. 1

   Questionnaire

   You fill in what data you collect, where it goes and why.

2. 2

   Review call

   The advocate walks through your forms, systems and vendors with you.

3. 3

   Gap report

   A written report of where you fall short of the Act and what to fix first.

4. 4

   Walk-through

   A follow-up call to explain the report and the next steps.

Documents you will need

• Company incorporation details and GST number
• Current privacy policy, terms and consent forms (if any)
• List of tools and vendors that handle personal data (CRM, payments, cloud, SMS)
• Completed data-mapping questionnaire (we send it)

Scans or clear photographs are fine. The lawyer handling your matter will tell you if anything else is needed once they have seen your papers.