A DPDP Readiness Assessment That Tells You Where You Actually Stand

Why most Indian businesses fail their first DPDP check

The gap is rarely the firewall. It is knowing where the data is. KYC scans sit in an inbox. A salary sheet lives on a shared drive nobody locked. An ex-employee still has CRM access eight months on.

In DPDP readiness checks we have run for Indian firms, we have seen the same three gaps repeat. Nobody owns the data. Old access never gets removed. No record of consent for data already held.

The Act does not care how busy you are. If a customer asks you to delete their data and you cannot, that is a problem. If data leaks and you cannot prove you tried to prevent it, that is worse. A readiness check finds these holes first.

What a DPDP readiness assessment actually checks

It is not a quiz. We look at your real systems and map them against your duties as a Data Fiduciary, in force now in 2026. The check covers four areas.

1. Data discovery

Where does personal data sit today? Email, CRM, HR files, cloud drives, laptops, old backups. You cannot protect what you have not found.

2. Access and control

Who can open that data, and should they? We review user access, departed-staff accounts, and whether files can walk out on a USB stick or a personal Gmail.

3. Consent and rights

Can you show why you hold each piece of data? Can you delete it, correct it, or hand it back when someone asks? The Act gives people these rights, and you need a way to honour them.

4. Breach readiness

If data leaks tonight, what happens next? We check whether you can detect it, contain it, and report it to CERT-In inside the 6-hour window the rules expect.

How the assessment runs, step by step

The point is to be light on your time. You prepare nothing.

Step 1: A short call

Twenty minutes. We learn what your business does, what data you handle, and which systems run it.

Step 2: A look at your real setup

We review the systems you named: email, file storage, CRM, devices. We check access, retention, and the controls already in place against ISO 27001 good practice. Read-only. We touch nothing without your sign-off.

Step 3: Your written gap report

You get a plain-English report. Every gap is ranked by risk, with a clear fix for each one. Where a fix needs tools or our help, we attach a scoped quote. All of it inside 8 working hours of the review.

Get your free check and written quote

No cost for the assessment. You only pay if you ask us to fix something.

What you get at the end

Not slides. A short document your team can act on this week.

• A map of where your personal data lives, across email, cloud, devices, and backups.
• Your gaps ranked by penalty exposure, so you fix the expensive risks first.
• A clear fix for each gap, with what you can do in-house and what we can do for you.
• A scoped quote for any tooling, so nothing surprises you later.

Many firms take the report and act on it themselves. That is fine. The check is built to be useful on its own.

DPDP readiness check vs a full compliance audit

People mix these up. Different jobs, and you usually want the lighter one first.

Start with the readiness check. It tells you whether you even need the heavier audit yet. It works around whatever data tooling you already run, Microsoft Purview included. Where you have nothing, our own Secure Data Guard service closes the email and USB gaps the check usually finds.

Which industries need this most

Any business holding personal data has DPDP duties. Four types feel the pressure first.

BFSI and lenders

You hold KYC, account, and transaction data, and you already answer to the RBI. DPDP adds a second set of duties. The check shows where the two overlap and where you have new work.

Pharma and healthcare

Patient and trial data is sensitive under the Act. The bar is higher, and so is the penalty if it leaks.

IT and ITES

You process data for clients, often from outside India. Your customers will ask for proof you handle it correctly, and many already do during vendor reviews.

Manufacturing and logistics

Large workforces mean large employee files, plus vendor and customer records spread across plants and branches. The data is everywhere, which is the problem the check solves.

Read these before you decide

Want to understand the law first? Start here.

• DPDP Act penalties for mid-size Indian companies, the real numbers explained.
• A complete DPDP Act 2023 guide for MSMEs.
• The DPDP compliance package, for when you are ready to close the gaps.
• Email DLP and USB device control, the two fixes we find most.
• Already collecting data? Review your privacy notice and your data rights and grievance process.

Or explore the full Secure Data Guard service and our wider cloud and security stack, Microsoft Purview included.