Digital Personal Data Protection Act, 2023 · Rules 2025
DPDP self-score: your picture as of today.
Ten questions a small business can answer in five minutes. Type your domain first and we read what is visible from outside, the way a visitor or a regulator would. Soft enforcement ends 13 Nov 2026. Penalties in the Schedule run up to Rs 250 crore. Nothing you enter here is stored.
Step 1 · What we can see from outside
Public pages and DNS only, the way a visitor sees them. Or skip this and answer the ten yourself.
Step 2 · The ten questions
1 · Notice at the form
When someone signs up or fills a form on your site or app, do they see a short, plain-language notice saying what data you take and why, before they agree?
2 · Withdrawal that works
Can a user withdraw that consent as easily as they gave it, and does anything actually stop when they do?
3 · Deletion on a schedule
Do you delete personal data when the purpose is over or the user asks, on a schedule you can show?
4 · Breach plan, 72 hours
If your database leaked tonight, could you tell every affected user and the Data Protection Board within 72 hours, with a written plan you already have?
5 · Security safeguards
Is personal data encrypted at rest and in transit, is access limited to named people, and do you keep access logs for at least a year?
6 · Vendors under contract
Do all the vendors that touch your users' data (hosting, CRM, analytics, WhatsApp or SMS providers) work under a written contract with you?
7 · Children
Do you know whether any of your users are under 18, and if so do you get a parent's verifiable consent and never profile or advertise to them?
8 · Someone to complain to
Is there a named person and a working email or form where a user can complain, and do you answer within a fixed number of days?
9 · Access, correction, nomination
Can a user get a copy of what you hold on them, correct it, or name someone to act for them if they die or are incapacitated?
10 · Users from before the law
For users who signed up before the law, have you sent them the notice and given them the chance to withdraw?
What this is. A self-score, not legal advice. Each question maps to a section of the Act and its Rules and to the penalty band in the Schedule; the mapping is shown after you answer. The outside read reports only what is present or absent on public pages and DNS. It never scans, never logs in, never rates severity.
Your control. Answers stay in your browser. The domain read is not kept beyond an hour of cache and is never tied to a person. Copy the line, redraw the questions for your sector, disagree in public. That is what it is for.