Free tool

Find your biggest DPDPA gaps in about 3 minutes

Answer up to 15 plain-language questions about how your business handles personal data. We name the three areas of the Digital Personal Data Protection Act most worth your attention first, with the section of the Act next to each.

  • Your answers stay in your browser until you ask for the report.
  • No score or grade, just where to look first.
  • The obligations in these areas apply from 13 May 2027.

Question 1 of about 14

Do you collect or use personal data, and roughly how many people in India does it cover?

Personal data is anything about an identifiable person: names, phone numbers, emails, IDs, order history, employee records (S.2(t)). The Act covers digital data, and paper data you later digitise (S.3(a)). It also reaches a company based abroad that offers goods or services to people in India (S.3(b)). Data you use only for personal or household purposes is outside it. If you only process data about people outside India for foreign clients, S.17(1)(d) exempts you from most of the Act, but not from S.8(1) and S.8(5).

This tool is not legal advice. It points to areas to review and does not assess whether you comply. Section references are to the Digital Personal Data Protection Act, 2023, and the Digital Personal Data Protection Rules, 2025.

What the Gap Identifier checks

The Gap Identifier covers the duties the DPDP Act and the DPDP Rules, 2025 place on a company that handles personal data. Each question checks one area. Your answer marks that area as in place, partly in place, not in place, or not sure.

You see up to 15 questions. The first asks whether you hold personal data about people in India; the second, whether you decide what is collected or only process it for clients. The rest follow from those two answers: a company that only processes data for clients sees 7 questions, most companies see 14, and a company holding data on more than 10 lakh people sees 15.

The areas it covers

  • Your role under the Act S.2(i), S.2(k), S.3, S.8(1)–(2)
  • Notice when you ask for data S.5, Rule 3
  • Consent and withdrawal S.6(1)–(6), S.6(10)
  • Choosing the right basis for each use S.4(1), S.7
  • Children and persons with disability S.9, Rule 10, Rule 11, Rule 12
  • Security safeguards S.8(5), Rule 6(1)(a)–(g)
  • Personal data breach response S.8(6), S.2(u), Rule 7
  • Retention and erasure S.8(7)–(8), Rule 8
  • Contracts with Processors S.8(1)–(2), Rule 6(1)(f)
  • Published contact and grievance redress S.8(9)–(10), S.13, Rule 9, Rule 14(3)
  • Handling requests from people S.11, S.12, S.14, Rule 14
  • Transfers outside India S.16, Rule 15
  • Significant Data Fiduciary duties S.10, Rule 13 asked only of companies holding data on more than 10 lakh people

How it picks your three

Areas you said are not in place come first, then the ones you weren't sure about, then the ones only partly in place. Within each group, the area with the higher maximum penalty in the Schedule to the Act comes first. If fewer than three areas have a gap, the list is filled with areas to verify.

What it doesn't do

It gives no score and does not decide whether you comply. It shows where to look first. The emailed report adds, for every area on your list, what the law requires, what "in place" looks like, and the engineering steps.

The DPDPA checklist has the full list, with what "in place" looks like for each obligation.

What a result looks like

Here is the result for a sample company that holds data on fewer than 10,000 people, uses one tick-box for every consent, has two or three of the four basic safeguards, and would work out a breach response on the day.

  1. Personal data breach response

    Not in place

    You told us this isn't in place yet.

    If personal data is exposed, altered or lost, you must tell each affected person and the Data Protection Board without delay, and send the Board a detailed report within 72 hours, or within a longer period the Board allows on a written request.

    Act: S.8(6), S.2(u), Rule 7 Applies from 13 May 2027

  2. Security safeguards

    Partly in place

    You told us this is only partly in place.

    You must take reasonable security safeguards to prevent a personal data breach, and Rule 6 sets a minimum list.

    Act: S.8(5), Rule 6(1)(a)–(g) Applies from 13 May 2027

  3. Consent and withdrawal

    Partly in place

    You told us this is only partly in place.

    Consent must be specific, clearly given and as easy to withdraw as to give, and you must be able to prove you got it.

    Act: S.6(1)–(6), S.6(10) Applies from 13 May 2027

Sample answers, not a real company. Your result depends on your answers.

Frequently asked questions

How long does the DPDP Gap Identifier take?

About 3 minutes. You answer up to 15 plain-language questions about how your business handles personal data.

What do I get at the end?

The three areas of the Digital Personal Data Protection Act most worth your attention first, with the section of the Act next to each. No score or grade, just where to look first.

Does the tool store my answers?

Your answers stay in your browser until you ask for the report. If you ask for the report by email: We'll use your email and your answers only to send you this gap report. We keep them for 12 months, or until you delete them with the link in the report or by writing to privacy@statechecksecurity.com. If you have a complaint, write to us first; if we don't resolve it, you can complain to the Data Protection Board of India.

Is the DPDP Gap Identifier legal advice?

No. This tool is not legal advice. It points to areas to review and does not assess whether you comply.

When do the obligations in these areas apply?

The obligations in these areas apply from 13 May 2027.

Who is the Gap Identifier for?

Any company working to meet the DPDP Act, whatever its size: founders, operations leads, engineers and compliance teams, in India or abroad if you offer goods or services to people in India. The questions use plain words, with the section of the Act next to each legal term.

Does the DPDP Act apply to my company?

The first question checks. The Act covers digital personal data processed in India, including paper records you digitise later, and processing abroad connected with offering goods or services to people in India (S.3(a)–(b)). It sets no size threshold: a Data Fiduciary is "any person" that decides why and how personal data is processed (S.2(i)).

What does the Gap Identifier check?

Thirteen areas of the DPDP Act and the DPDP Rules, 2025: your role, notice, consent and withdrawal, the basis for each use, children's data, security safeguards, personal data breach response, retention and erasure, processor contracts, your published contact and grievance process, requests from people, transfers outside India, and Significant Data Fiduciary duties. The last is asked only of companies holding data on more than 10 lakh people.

How does it choose the three areas?

Areas you said are not in place come first, then the ones you weren't sure about, then the ones only partly in place. Within each group, the area with the higher maximum penalty in the Schedule to the Act comes first.

We only process data for other companies. Does it still work?

Yes. A company that only processes personal data on its clients' instructions is a Data Processor (S.2(k)) and sees 7 questions. The Act puts the duties on the Data Fiduciary, which stays responsible for what its processors do (S.8(1)), so the result explains how each duty reaches you through your clients' contracts.

What is in the emailed report?

For every area on your list, not just the top three: what the law requires, what "in place" looks like, the engineering steps and related reading.