How ready are you for the DPDP Act?

Do you give a clear notice before or at the time of collecting personal data, listing what you collect and why?

Is your notice available in English and the Eighth Schedule languages you serve?

Is consent free, specific, informed, and unconditional — never bundled into terms of service?

Can a person withdraw consent as easily as they gave it?

Do you collect only the data actually needed for the stated purpose?

Do you delete personal data once the purpose is served or consent is withdrawn?

Do you have a written retention schedule per data category?

Can a person request a summary of their data and who it was shared with?

Can a person get their data corrected, completed, or erased?

Have you published a grievance redressal mechanism with a response timeline?

Do you support nomination, so a nominee can exercise rights on death or incapacity?

Do you verify age and obtain verifiable parental consent for users under 18?

Have you disabled behavioural advertising and tracking directed at children?

Are reasonable security safeguards in place — encryption at rest and in transit, access control, logging?

Can you notify the Data Protection Board and affected persons promptly after a breach?

Have you run a breach drill in the last 12 months?

Do you have written contracts with every processor handling data on your behalf?

Do you maintain a current record of processing activities and data flows?

If you may be a Significant Data Fiduciary, have you considered a DPO in India, DPIAs, and audits?

Do you know which countries your personal data is transferred to?