How DPDP-Ready Is Your Business?

1We know which systems hold personal data (HR, CRM, email, billing, files)

2We have a list of what personal data we collect and why

3We know which vendors and cloud services process our data

4We collect personal data only for stated purposes

5We take clear, purpose-wise consent before collecting data

6Our privacy notice says what we collect, why, and how to complain

7People can withdraw consent as easily as they gave it

8We keep records that prove consent was given

9People can ask to see, correct or delete their data

10We have a named grievance contact and a response process

11We can find all data about one person across our systems

12We get verifiable parental consent for anyone under 18, or collect no children's data

13Access to personal data is limited by role

14Personal data is encrypted when stored and sent

15We keep logs of who accessed personal data

16We have a written breach response plan

17We know how to notify the Data Protection Board and affected people

18We delete personal data once its purpose is over

19Our vendor contracts include data protection terms

20Staff have been trained on DPDP basics