DPDP Act compliance gap assessment

DPDP Act Gap Assessment Service: Find Your Compliance Gaps Before 13 May 2027

See where your data practices fall short of the DPDP Act and Rules, which gaps carry the highest penalty ceilings, and what to fix first. Every finding is tied to a section or rule, and the plan is dated to the dates in the law.

Assess my requirements Try the free readiness check

Section and rule on every finding
Dated to 13 May 2027
Delivered by partners
Evidence you can show

What is a DPDP Act gap assessment?

A DPDP Act gap assessment compares how your organisation collects, uses, shares, secures and deletes personal data against the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025. It lists each gap with the section or rule it relates to, ranks the gaps by risk, and gives a dated plan to 13 May 2027.

Is it required?: The Act does not set it as a filing, but it holds you accountable for compliance (s.8(1)) and for reasonable security safeguards (s.8(5)). A gap assessment is how you find and evidence what is missing before 13 May 2027. Significant Data Fiduciaries also owe a periodic DPIA and independent audit (s.10(2), Rule 13).
Is it a certificate?: It is better than that: dated evidence of what you reviewed and fixed. We found no DPDP certification scheme in the Act or Rules.
Who delivers it?: Independent specialist delivery partners. We scope first, then introduce a partner only when you ask.
What do you get?: A domain scorecard, a findings register, risk ranking by penalty ceiling, and a dated plan.
Where do I start?: Assess my requirements, or take the free readiness check first.

Last checked: 22 October 2026. Reviewed by Team DPDP Act India. Informational, not legal advice.

In short
Why now
What it is
What we test
Penalty ceilings
Process
Deliverables
Sample
Do it yourself
Who it is for
GDPR and ISO
After
Who delivers
Start
FAQ

Why now

Three dates set the clock

The Act and Rules start in stages. A gap assessment tells you what is missing before the core duties and the penalty provisions begin.

13 Nov 2025

In force

Definitions, the Data Protection Board provisions, and Rules 1, 2 and 17 to 21 are in force.

13 Nov 2026

Consent managers

Consent manager provisions start: s.6(9), s.27(1)(d) and Rule 4.

13 May 2027

Core duties and penalties

Notice, consent, the s.8 duties, children, rights, Significant Data Fiduciary duties and s.33 penalties start. Rules 3 and 5 to 16 start with them.

Status checks, last checked 22 October 2026. We found no official notification designating a Significant Data Fiduciary, and none naming the Board's Chairperson or Members (MeitY invited applications in a notice dated 6 May 2026). A February 2026 proposal reported in the press to shorten the window has not been followed by an official amendment we could find. Sources are listed at the end. Re-check before you rely on this.

What it is

A gap assessment, and what it is not

People mix up four different pieces of work. The table shows where a gap assessment sits. Not sure which one you need? See the DPDP compliance assessment overview.

Work	Question it answers	Output	Legal standing
Readiness check	Roughly where do we stand?	Instant score and top gaps, self-serve	Your starting point
Gap assessment (this page)	What is missing against the Act and Rules, and in what order do we fix it?	Findings register, risk ranking, dated plan	Your proof of reasonable steps (s.8(1), s.8(5))
Privacy audit	Do the controls we built actually work?	Tested findings with evidence	Mandatory for SDFs (s.10(2)(b)); good practice for others
DPIA	What risks does this processing create for people?	Impact assessment report	Mandatory for SDFs (s.10(2)(c), Rule 13); good practice for others
Compliance certificate	Are we certified under the DPDP Act?	No such certificate exists	No scheme found

Penalties are ceilings, not predictions. Under s.33, a penalty follows only after the Board concludes an inquiry, finds a significant breach and hears the fiduciary. A gap assessment shows where your exposure sits, so you can fix the highest ceilings first. It does not calculate a fine.

What we test

Twelve areas, each tied to the law

The checklist follows the Act and Rules, not a generic privacy template. Each area is tested against evidence you can show.

DPDP gap assessment

Data inventoryMethod, supports every duty

Notices.5, Rule 3

Consents.6, Rule 3

Legitimate usess.7

Rights and grievancess.11 to 14, Rule 14

Governance and SDF checks.8(9), 8(10), s.10

Security safeguardss.8(5), Rule 6

Breach responses.8(6), Rule 7

Retention and erasures.8(7), Rule 8

Processors and vendorss.8(1), 8(2)

Children's datas.9, Rules 10, 12

Transfers and sector rulesRule 15

Area	Law	What we test	Evidence we ask for	Penalty ceiling
Data inventory	Not a stand-alone legal duty; it supports the duties in ss.5 to 8	Do you know what personal data you hold, where it flows and why you hold it?	Data inventory or RoPA, system list, flow diagrams	Not applicable
Notice	s.5(1), Rule 3	Does every consent request come with a notice that lists the data and purpose, how to exercise rights, and how to complain to the Board?	Notice text, sign-up forms, app screens	Rs 50 crore
Consent	s.6, Rule 3	Is consent free, specific, informed and given by a clear action, is withdrawal as easy as giving it, and can you prove it?	Consent screens, consent log, withdrawal path	Rs 50 crore
Legitimate uses	s.7	Does every use of data without consent fit one of the listed legitimate uses?	Purpose register, HR and service workflows	Rs 50 crore
Rights and grievance	ss.11 to 14, Rule 14	Is there a published way to make requests, a working grievance process, and a published response time of up to 90 days?	Request log, grievance page, response SOP	Rs 50 crore
Governance and SDF check	s.8(9), s.8(10), s.10, Rule 13	Is a DPO contact (if applicable) or another person published, who owns compliance, and could SDF duties apply to you?	Website contact page, role list, user and data volumes	Rs 50 crore; Rs 150 crore for s.10 duties
Security safeguards	s.8(5), Rule 6	Are the minimum measures in place: encryption or masking, access control, logs and monitoring, backups and one-year log retention?	Security policy, configurations, access reviews, backup tests	Rs 250 crore
Breach response	s.8(6), Rule 7	Can you inform affected Data Principals and the Board without delay, and send the Board a detailed report within 72 hours?	Incident runbook, contact tree, past incident records	Rs 200 crore
Retention and erasure	s.8(7), Rule 8	Is data erased when consent is withdrawn or the purpose is served, unless a law requires you to keep it, and do logs meet the retention rules?	Retention schedule, deletion records	Rs 50 crore
Processors and vendors	s.8(1), s.8(2), Rule 6	Do valid contracts bind each processor, and do safeguards and erasure flow down to them?	Vendor list, signed contracts	Rs 50 crore
Children's data	s.9, Rules 10 and 12	Is verifiable parental consent in place, with no tracking, behavioural monitoring or targeted advertising aimed at children, unless an exemption applies?	Age and parent flows, ad and analytics setup	Rs 200 crore
Transfers and sector rules	Rule 15 and sector rules	Do transfers outside India meet any requirement the Government specifies, and have stricter sector rules (for example RBI) been identified?	Transfer list, sector rule list	Rs 50 crore

Risk ranking

Where the penalty ceilings sit

We rank each finding by the ceiling attached to the provision it relates to, then by effort to fix. These are maximums set in the Act's Schedule, applied only after a Board inquiry.

Security safeguardss.8(5)
Rs 250 crore
Breach notifications.8(6)
Rs 200 crore
Children's datas.9
Rs 200 crore
Significant Data Fiduciary dutiess.10
Rs 150 crore
Any other provisionnotice, consent, rights, processors and more
Rs 50 crore

Source: Schedule to the Act. Penalty amounts are maximums. Whether a breach is significant, and the amount, is for the Board to decide after an inquiry (s.33).

Process

Five steps from scope to plan

Timeline depends on size, systems and vendors. It is confirmed on the scoping call, before you commit.

Scope

Confirm entities, products, data types, systems and vendors, and whether children's data or SDF duties may apply.

Collect

You share documents and screenshots. Short interviews with product, security, HR and legal owners.

Test

Each area is tested against the Act and Rules, and we note the evidence we saw.

Rank

Findings are rated High, Medium or Low by provision, penalty ceiling and effort.

Plan

A dated roadmap with owners, and a walkthrough call to agree the first fixes.

What we ask you for

Notices, consent screens and the privacy policy
A list of systems, vendors and where personal data sits
Vendor and processor contracts
Security, incident and retention policies, if they exist
Names of the people who own product, security, HR and legal

What affects scope

Number of legal entities and products
Number of systems and vendors that touch personal data
Children's data, or large user volumes that may point to SDF duties
Sector rules, for example lending or health
How much documentation already exists

Deliverables

What you receive

Four outputs you can hand to a board, an auditor or a client who asks for proof.

Domain scorecard

A rating for each of the twelve areas, so leadership sees the picture in one view.

Gap findings register

Every finding with its provision, evidence seen, risk rating, owner and fix.

Risk ranking

Findings ordered by penalty ceiling and effort, so the first fixes are clear.

Dated roadmap

Actions placed against 13 Nov 2026 and 13 May 2027, with owners.

Sample

What the output looks like

This is an illustration of the format, not a real organisation and not a client result.

Domain scorecard

Illustrative scores out of 100. Sample only.

Notice

Partial

Consent

Partial

Rights

Gap

Security

Strong

Breach

Gap

Retention

Partial

Processors

Partial

Children

Gap

How to read it

Strong: evidence seen, minor tidy-ups only.
Partial: something exists but evidence or coverage is incomplete.
Gap: missing, or not working in practice.

Ratings come from evidence, not from self-declared answers alone.

Sample findings register (illustrative)

ID	Area	Finding	Provision	Penalty ceiling	Priority	Suggested fix
G-01	Notice	Consent form does not say how to withdraw consent or how to complain to the Board.	s.5(1), Rule 3	Rs 50 crore	High	Rewrite the notice with the required items and link it from every form.
G-02	Security	Logs are kept for three months and no backup restore test exists.	s.8(5), Rule 6	Rs 250 crore	High	Set one-year log retention and schedule restore tests.
G-03	Breach	No named owner and no process to send the Board a report within 72 hours.	s.8(6), Rule 7	Rs 200 crore	High	Name an owner, write the runbook and rehearse it once.
G-04	Processors	Two vendor contracts do not require safeguards or erasure on request.	s.8(2), Rule 6	Rs 50 crore	Medium	Add contract terms and track signature.
G-05	Rights	No published way to make a request and no published response time.	Rule 14(1), 14(3)	Rs 50 crore	Medium	Publish the request route and a response time of up to 90 days.
G-06	Children	Sign-up has no age check or parental consent route.	s.9, Rule 10	Rs 200 crore	High	Add an age gate and a verifiable parental consent method.

Who it is for

Who benefits most, and where to start

SaaS and IT firms

Customer data, vendors and security evidence that enterprise buyers ask for.

Fintech and NBFCs

DPDP duties sit on top of RBI rules, and the stricter rule applies.

Healthcare providers

Health records, consent and retention across clinics and labs.

E-commerce and consumer apps

Large user volumes, marketing consent and rights requests.

EdTech and schools

Children's data, parental consent and the tracking ban in s.9(3).

Overseas firms with Indian users

The Act reaches processing outside India when you offer goods or services to people in India (s.3).

Early stage? Start here

You have not mapped any data yet. Begin with the free readiness check and a data inventory. The gap assessment then gives you the full, evidenced picture.
Check scope first: processing for purely personal or domestic purposes sits outside the Act (s.3). Everything else is in scope.

Common mistakes we see

Treating the assessment as a certificate.
Writing policies before mapping the data.
Ignoring vendors, although you stay responsible for processors (s.8(1)).
Assuming every business needs a DPO.
Adding up penalty ceilings as if they were fines.

Do it yourself

How to run a DPDP gap analysis yourself in six steps

A small team can run a first pass in-house. The steps below follow the Act and Rules. An outside review is worth it when evidence is thin, the scope is large, or a client or investor wants an independent view.

1
List what you hold
Write down each kind of personal data, where it is stored, who can see it, which vendors get it and why you collect it. A spreadsheet is enough to start.
2
Match each use to a legal ground
For every purpose, record whether you rely on consent (s.6) or a legitimate use (s.7). If neither fits, that is a gap.
3
Check notice and consent screens
Open every form and app screen. Does the notice list the data, the purpose, how to exercise rights and how to complain to the Board (s.5, Rule 3)? Can a person withdraw as easily as they agreed?
4
Test the s.8 duties
Check security measures against Rule 6, the breach path against Rule 7 (Board report within 72 hours), retention and erasure against Rule 8, and processor contracts against s.8(2).
5
Check rights, grievance and children
Is there a published request route, a grievance process and a response time of up to 90 days (Rule 14)? If children use your service, test s.9 and Rules 10 and 12.
6
Record, rank and date
Log each gap with the section, the evidence you saw, and an owner. Rank by penalty ceiling, then by effort. Put a date against each fix.

Where an in-house pass falls short. Teams tend to rate their own controls generously and miss vendor and flow gaps. An independent review tests the evidence, not the intent. The free readiness check is a quick way to start.

GDPR and ISO 27001

If you already follow GDPR or ISO 27001, what is different?

Existing work helps, but it does not close the gap on its own. Check these differences first. This is a summary for planning, not legal advice.

Topic	GDPR	DPDP Act and Rules
Legal grounds	Six lawful bases, including contract and legitimate interests.	Consent (s.6) or the listed legitimate uses (s.7). No general legitimate interests ground.
Breach reporting	Notify the authority within 72 hours of becoming aware, unless unlikely to cause risk.	Inform each affected Data Principal without delay, and send the Board a detailed report within 72 hours (s.8(6), Rule 7).
DPO and impact assessment	DPO and DPIA are required in defined cases.	Required only for Significant Data Fiduciaries (s.10). Other fiduciaries publish a contact person (s.8(9)).
Children	Digital consent age is 16, which member states may lower to 13.	A child is anyone under 18. Verifiable parental consent applies (s.9, Rule 10).
Individual rights	Includes a right to data portability.	Access, correction and erasure, grievance redress and nomination (ss.11 to 14). No portability right.
Maximum penalty	Up to EUR 20 million or 4% of worldwide turnover.	Up to Rs 250 crore for the highest tier (Schedule, s.33).
Certification	Certification mechanisms exist (Art. 42).	No certification scheme found in the Act or Rules, as of 22 October 2026.

What ISO 27001 already gives you

A base for security safeguards under s.8(5) and Rule 6, such as access control, logging and backups.
Incident handling you can extend to the Board report.

What it does not cover

Notice, consent and withdrawal, rights requests and the grievance process.
Children's data, erasure rules and processor duties under the Act.
An ISO certificate is not a DPDP certificate, and none exists.

After the assessment

A plan that runs to 13 May 2027

Finding gaps is the start. The plan places each fix against the dates in the law. This sequencing is practical advice, not a legal requirement.

Month 1: high-risk gaps

Security safeguards, the breach runbook, and notices. These carry the highest ceilings and are the quickest to evidence.

Months 2 to 4: vendors and flows

Processor contracts, consent records, withdrawal and rights handling, and the retention schedule.

By 13 May 2027: evidence in place

Children's flows, grievance response time, logs and records you can show if the Board asks.

Next step after the plan: DPDP implementation turns findings into working controls. A DPO decision guide is on dpoindia.in.

Who delivers

Independent delivery partners, introduced only when you ask

We run the front door. Assessments are carried out by our panel of independent specialist delivery partners. We do not carry them out in-house.

1You talk to us firstA short call to understand your business, systems and timeline.

2We scope, you decideYou see what the assessment will cover before you commit to anything.

3Introduction after your consentA partner is introduced only after the call, and only if you agree.

What to ask any partner before you sign

Which sections and rules will the report cite?
Can we see a redacted sample report?
Who signs the report, and what are their credentials? Ask for it in writing.
Is an NDA signed before documents are shared?
How is our evidence stored, and when is it deleted?

What stays yours

The findings register and plan belong to you.
Fixing the gaps is a separate decision. Use your own team or any provider.
No credential or certificate is promised on a partner's behalf by this page.

The assessment is a compliance review, not a legal opinion. Ask your own counsel to confirm any legal conclusion.

Start here

Assess my requirements

Tell us about your business on a short call, or take the free two-minute readiness check first. You will know what a gap assessment would cover for you before you commit to anything.

No fixed package. Scope first.
Partner introduced only after your consent.
Plan dated to 13 Nov 2026 and 13 May 2027.

Book a free 30-minute call Take the readiness check Send an enquiry

By sector

Sector guides that feed the assessment

FAQ

DPDP gap assessment questions

What is a DPDPA gap assessment?

A DPDP Act (also written DPDPA) gap assessment is a structured review that compares your current data practices with the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025. It lists each shortfall with the section or rule it relates to, ranks the gaps by risk, and gives a dated plan to close them.

What does a DPDP gap assessment checklist cover?

Twelve areas: data inventory, notice, consent, legitimate uses, Data Principal rights and grievance, governance and the SDF check, security safeguards, breach response, retention and erasure, processors and vendors, children's data, and transfers and sector rules. Each area is tested against evidence, not only policy text.

What is meant by gap assessment?

A gap assessment measures the distance between where you are today and a defined standard. For DPDP, the standard is the Act and the Rules. The output is a list of gaps, each tied to a legal provision, and a plan to close them.

What is a regulatory gap assessment?

A regulatory gap assessment applies the same method to any regulation: list each legal requirement, test current practice against it, and record the gaps. For DPDP the duties, penalty ceilings and dates are specific to the Indian Act and Rules, so a GDPR checklist does not transfer one to one.

Do we need a DPDP gap assessment?

The Act does not use the term or set it as a filing. What it does is make you responsible for compliance (s.8(1)), require reasonable security safeguards (s.8(5)) and set penalty ceilings of up to Rs 250 crore after a Board inquiry. A gap assessment is the practical way to see where you stand and to show you took reasonable steps. Significant Data Fiduciaries must also run a periodic DPIA and independent audit (s.10(2), Rule 13). As of 22 October 2026, we found no official notification designating any Significant Data Fiduciary.

Is a gap assessment the same as a privacy audit or a DPIA?

No. A gap assessment finds what is missing against the law. A privacy audit tests whether your controls work in practice. A DPIA and independent audit every 12 months are duties for Significant Data Fiduciaries, not for every business.

When should we do a gap assessment?

Early enough to fix what it finds before 13 May 2027, when the core duties and the penalty provisions start. Consent manager provisions start on 13 November 2026. Fixing security, breach and notice gaps usually takes longer than finding them.

How long does a DPDP gap assessment take?

It depends on the number of entities, systems and vendors, and on how quickly evidence is shared. The delivery partner confirms a timeline after the scoping call, before you commit to anything.

What does a DPDP gap assessment cost?

Cost depends on scope: entities, products, systems, vendors, whether children's data is involved, and sector rules. We scope first and tell you what the assessment will cover before you commit. We do not publish a fixed price because a fixed price would not fit most scopes.

Do small businesses and startups need one?

The Act applies to what you do with digital personal data in India, not to company size alone. A small team can start with the free readiness assessment and a data inventory, then commission a full gap assessment when the picture is unclear or a client asks for evidence.

Do we need a Data Protection Officer after the assessment?

Only a Significant Data Fiduciary must appoint a DPO (s.10(2)(a)). Every Data Fiduciary must publish contact details of a DPO if applicable, or of another person who can answer questions (s.8(9)), and run a grievance process (s.8(10)). As of 22 October 2026, we found no official notification designating any Significant Data Fiduciary.

What happens after the assessment?

You receive the findings register and the dated plan. You can fix the gaps with your own team or any provider. A delivery partner can scope remediation if you ask, but that is a separate decision and a separate engagement.

How do I conduct a DPDP gap analysis myself?

List the personal data you hold and why, match each purpose to consent or a legitimate use, test notices and consent screens, test the s.8 duties (security, breach, retention, processors), check rights, grievance and children, then log each gap with its section, owner and date. The six steps are set out above.

Does GDPR or ISO 27001 compliance mean we are DPDP compliant?

No. They help with security and some governance, but DPDP has its own rules on consent, notice, children, breach reporting to the Board and rights. No DPDP certificate exists, and an ISO certificate does not stand in for one.

What should we prepare before the assessment?

Your notices and consent screens, a list of systems and vendors, vendor contracts, your security and incident policies, any retention schedule, and the names of the people who own product, security, HR and legal. Missing documents are normal and become findings.

Sources

Sources and last check

Commencement of the Act: Gazette notification G.S.R. 843(E), 13 November 2025. Establishment of the Board: G.S.R. 844(E).
Rules and their commencement: G.S.R. 846(E), 13 November 2025, as corrected by G.S.R. 892(E), 10 December 2025 (wording corrections only).
Act provisions cited: s.5, s.6, s.7, s.8, s.9, s.10, ss.11 to 14, s.33 and the Schedule of penalties.
Rules cited: Rules 3, 4, 6, 7, 8, 10, 12, 13, 14 and 15. See the DPDP Rules explained.
Board vacancy: MeitY notice F. No. 2(1)/2026-Pers.I, 6 May 2026.
Status items (no SDF notified, no Board appointments found, no amendment to dates found): last checked 22 October 2026. These are based on our searches, not an official statement.

This page is general information, not legal advice. A gap assessment is a compliance review and does not certify compliance. Ask your own lawyer to confirm legal conclusions. Last reviewed 22 October 2026 by Team DPDP Act India.

DPDP Act Gap Assessment Service: Find Your Compliance Gaps Before 13 May 2027

What is a DPDP Act gap assessment?

Three dates set the clock

A gap assessment, and what it is not

Twelve areas, each tied to the law

Where the penalty ceilings sit

Five steps from scope to plan

Scope

Collect

Test

Rank

Plan

What we ask you for

What affects scope

What you receive

Domain scorecard

Gap findings register

Risk ranking

Dated roadmap

What the output looks like

Domain scorecard

How to read it

Sample findings register (illustrative)

Who benefits most, and where to start

SaaS and IT firms

Fintech and NBFCs

Healthcare providers

E-commerce and consumer apps

EdTech and schools

Overseas firms with Indian users

Early stage? Start here

Common mistakes we see

How to run a DPDP gap analysis yourself in six steps

If you already follow GDPR or ISO 27001, what is different?

What ISO 27001 already gives you

What it does not cover

A plan that runs to 13 May 2027

Month 1: high-risk gaps

Months 2 to 4: vendors and flows

By 13 May 2027: evidence in place

Independent delivery partners, introduced only when you ask

What to ask any partner before you sign

What stays yours

Assess my requirements

Sector guides that feed the assessment

DPDP gap assessment questions

Related DPDP services and guides

Sources and last check