Compliance Assessment

DPDPA Compliance Scorecard

Answer 25 questions to assess your readiness for India's data protection law and receive a tailored compliance summary.

Progress0 / 30

0 %

In relation to that personal data, does your organisation act as a Data Fiduciary, a Data Processor, or both?

A Data Fiduciary determines the purpose and means of processing; a Data Processor processes personal data on behalf of, and under the instructions of, a Data Fiduciary. Obligations differ materially by role.

Data Fiduciary

Data Processor

Both, depending on the activity

Unsure of our role

Does your organisation collect or process the personal data of identifiable individuals — for example, employees, vendors, customers, or website visitors?

Personal data is any data about an individual who is identifiable by or in relation to such data. This determines whether the Act applies.

We collect or process personal data

We process only limited or incidental personal data

We do not collect or process personal data

Unsure

Does your organisation transfer personal data outside India, and do you monitor which destinations are restricted?

The Act permits cross-border transfers except to countries restricted by Government notification. General data localisation is not required, but restricted destinations and any sector-specific limits must be tracked.

We transfer personal data cross-border and monitor restricted-destination notifications

We transfer personal data cross-border but do not actively monitor restrictions

We do not transfer personal data outside India

Unsure

Does your organisation process the personal data of children (individuals under 18) or of persons with disabilities who have a lawful guardian?

This includes dependents of employees and data processed through education, gaming, healthcare, or similar services. It triggers heightened obligations.

We process such personal data

Possibly, though our services are not directed at them

We do not process such personal data

Unsure