Free · No login · About 15 minutes
Ready for the DPDP Act? See where you stand, with time to spare.
A self assessment built around India's Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025. Answer 53 short points and receive a readiness score, your gaps ranked by priority and penalty ceiling, and a phased plan you can start this week.
- No account, no OTP, no card
- Your answers stay in your browser and are never sent to Tekpro
- Offered by Tekkonnectpro IT Services (Tekpro), Bengaluru
Key terms
The DPDP vocabulary, in plain words
The Act uses a handful of terms again and again. Pick one to see what it means for your business and a quick example.
How it works
Three steps, no paperwork
Answer honestly
Choose Yes, No or N/A for each point. Nothing is pre filled, so the score is only as useful as your candour.
Get your score
Higher priority points count for more. A No counts against you. N/A is left out of the maths.
Act on the gaps
Your report ranks the gaps, shows the penalty ceiling each one maps to, and sorts the fixes into a phased plan.
The assessment
53 points across 15 areas
Both organisation fields are optional and appear only on your report. Choose N/A only where a point genuinely does not apply to you. A draft is kept in this browser so you can pause and return.
Your report
Your DPDP readiness report
After the check
How Tekpro can help you close the gaps
Many of the DPDP duties with the largest penalty ceilings are infrastructure work: security, logging, backups, retention and where data lives. Tekpro can manage these on the platform you already use.
- Amazon Web Services
- Microsoft Azure
- Google Cloud
- DigitalOcean
| DPDP area | What Tekpro can do |
|---|---|
| Know your data | Inventory where personal data sits across accounts and subscriptions, and use native scanners such as Amazon Macie, Microsoft Purview and Google Sensitive Data Protection to find it. |
| Security safeguards | Encryption at rest and in transit with managed keys, role based access with MFA, network isolation, patching and vulnerability scans. |
| Logging and detection | Audit logs of who accessed what, kept for at least a year, with alerts for unusual access. |
| Backups and recovery | Scheduled backups, copies held in a separate account or region, and restore tests. |
| Breach readiness | Log evidence and alerting so you can meet the 72 hour report, plus runbooks and practice drills. |
| Retention and erasure | Lifecycle rules that delete or archive data on schedule, including copies in backups and logs. |
| Where data lives | Keeping data in Indian regions and mapping any personal data that leaves India. |
| Vendor contracts | Tekpro works as your processor, with safeguards and breach duties written into the agreement. |
Notice and consent wording, policies and legal advice sit outside infrastructure and are best handled with your legal adviser. Tekpro can help with these areas, which does not by itself guarantee compliance.
Penalties
What is at stake, and why it is avoidable
The Act sets maximum penalties by type of breach. These are ceilings, and the Data Protection Board decides the actual amount. The good news is that the biggest ceilings sit on things you can fix with sound operations: security, breach response and children's data.
| Maximum penalty | What triggers it |
|---|---|
| Up to ₹250 crore | Failing to take reasonable security safeguards to prevent a personal data breach |
| Up to ₹200 crore | Failing to notify the Board and affected people of a breach, or breaching the additional duties for children's data |
| Up to ₹150 crore | Breaching the extra duties of a Significant Data Fiduciary |
| Up to ₹50 crore | Any other breach of the Act or the Rules |
In real life
Everyday situations, retold simply
The law works through ordinary moments. These short stories are simplified illustrations of what a rule asks of a business.
Questions
Common questions
Who does the DPDP Act apply to?
It applies to processing of digital personal data inside India, including data collected on paper and digitised later. It also reaches processing outside India when it is connected to offering goods or services to people in India. Personal or domestic use by an individual is outside it.
We only process data for our clients. Does it still apply to us?
Yes, in a different way. A business that processes data on behalf of another is a Data Processor. The client, as Data Fiduciary, stays accountable and will push security and breach duties down to you through contracts. Area 9 of this checklist covers that relationship.
Do you store my answers?
No. The page works entirely in your browser. A draft is saved in this browser only so you can return to it, and nothing is sent to Tekpro or anyone else. Use the Clear button to remove it.
How is the score worked out?
Each point has a weight: High counts 3, Medium 2, Low 1. A Yes earns the weight. A No earns nothing but the weight still counts toward the maximum. N/A is excluded from both. 80% and above is Established, 50 to 79% is Developing, and below 50% is Basic.
Why must every point be answered?
A skipped point would quietly inflate your score. If something does not apply, mark N/A. That is a deliberate answer and it is removed from the calculation.
Is this legal advice?
No. It is a self assessed maturity indicator based only on your unverified answers. Please consult a qualified professional before acting on it.