Check DPDP Readiness

Free assessment

Check your DPDP readiness score

Find out in about 10 minutes. Answer 25 simple questions and receive a DPDP readiness score, your key risk areas and a recommended next step—instantly and free.

Start the Assessment
  • Est. 2012
  • 100+ organisations served
  • Bengaluru-based support
Check your DPDP readiness score
Free assessment
DPDP Readiness Scorecard illustration
Since 2012Trusted by 100+ organisations

How it works

25 questions. 10 domains. One clear score.

Answer each question honestly for your organisation as it is today. Choose Yes if the control is in place across the organisation, Partly if it is in place for some systems or people, and No or Not sure otherwise.

You will instantly receive a 0–100 readiness score, a breakdown across ten weighted domains, your top priority areas and a recommended next step.

Your score bands

  • 0–39 High priority
  • 40–59 Needs improvement
  • 60–79 Good baseline
  • 80–100 Stronger readiness

0 of 25 answered

Data & asset visibility

Weight: 10 of 100 points

1. We maintain an up-to-date inventory of laptops, servers, cloud services and applications.

2. We know which systems store customer and employee personal data.

3. Personal data is deleted or archived when it is no longer needed.

Identity & access

Weight: 15 of 100 points

4. Multi-factor authentication (MFA) is enabled for email, VPN and critical applications.

5. Administrator / privileged accounts are limited, separate from daily-use accounts and reviewed.

6. Access is removed promptly when employees leave or change roles.

Endpoint & patch management

Weight: 10 of 100 points

7. Every laptop, desktop and server runs centrally managed endpoint protection (antivirus / EDR).

8. Operating system and software updates are applied within an agreed timeframe.

9. Laptops that hold business data are encrypted.

Network security

Weight: 10 of 100 points

10. Our firewall is supported, updated and its rules are reviewed at least twice a year.

11. Guest, staff and server networks are separated, and remote access uses secure VPN or ZTNA.

Backup & recovery

Weight: 10 of 100 points

12. Critical systems and data are backed up automatically.

13. At least one backup copy is offline, immutable or otherwise isolated from ransomware.

14. We have successfully tested a restore in the last three months.

Cloud / SaaS / email

Weight: 10 of 100 points

15. Email is protected by filtering, and SPF, DKIM and DMARC are configured for our domain.

16. Sharing settings in cloud drives (e.g. Microsoft 365, Google, Zoho) are controlled.

17. Data in cloud / SaaS applications is backed up or recoverable.

Application security / VAPT

Weight: 10 of 100 points

18. Websites and applications that collect personal data have been security tested in the last 12 months.

19. Findings from security testing are tracked until they are fixed.

Monitoring & logging

Weight: 10 of 100 points

20. Security logs (logins, firewall, endpoint alerts) are collected and retained.

21. Someone reviews security alerts and acts on them promptly.

Incident response

Weight: 10 of 100 points

22. We have a documented incident response plan with named contacts.

23. We know how we would notify affected people and the Data Protection Board after a personal-data breach.

Vendor / governance / awareness

Weight: 5 of 100 points

24. Employees receive regular security and data-protection awareness training.

25. Vendors who handle our personal data are assessed and bound by data-protection terms.