DPDP gap assessment: what it covers, how long it takes, what you get

A DPDP gap assessment compares how your organisation handles personal data today with each duty in the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025, and writes every gap down with the provision it breaches, the evidence found, the risk it carries and a fix with an owner and a date. Done well, it gives you four things: a map of the data you hold, a gap register, a heat map ranked by penalty and likelihood, and a dated roadmap to 13 May 2027, when most duties start. On our planning assumptions it takes two to three weeks for a small organisation and eight to sixteen for a large group. There is no official DPDP certification for Data Fiduciaries as of 25 October 2026; what vendors sell as a "DPDP certificate" is their own attestation.

Like the Act (s. 2(y)), we say "she" and "her" for every person.

Jump to:

• Planning one: Method, Scope by provision, How long it takes, Choosing an assessor.
• Want to see the output: Sample gap register, Heat map.
• Asked about certificates: Is there a DPDP certification?

What a gap assessment is for

A useful gap assessment tests evidence. It asks to see the consent record, the access review and the signed contract, because those are what you will need when a consent is questioned (s. 6(10)) or your safeguards are examined after a breach (s. 8(5)).

It also tells you where to start. Penalty ceilings differ by duty, from ₹50 crore for any other fiduciary duty (Schedule item 7) to ₹250 crore for failing to keep reasonable security safeguards (Schedule item 1). A register ranked by penalty and likelihood gives leadership a reason to fund the first ninety days.

It is neither the independent data audit a Significant Data Fiduciary must commission (s. 10(2)(b), Rule 13), a legal opinion, nor a certificate, though it is good preparation for the first and will surface questions for the second.

How the assessment runs

The steps overlap, and on a small organisation steps 2 to 4 can run in the same week.

1. Scope and roles. List the legal entities, programmes, products and functions in scope. For each, decide whether you act as Data Fiduciary (you decide why and how data is processed, s. 2(i)), Data Processor (you process on someone else's behalf, s. 2(k)) or both, and where you share decisions with a funder or partner. Agree who will answer for each area.

2. Questionnaire and interviews. Each team answers questions about its own work: what it collects, on what form or app, from whom, on what basis, who it shares with, how long it keeps it. Follow up with short interviews. Anything nobody can answer is itself a gap.

3. Walk the data. Look at systems, shared drives, spreadsheets, survey tools, messaging groups, field phones and vendor portals. Include paper once it is digitised: the Act covers data collected on paper and digitised later (s. 3(a)), so a register photographed into a WhatsApp group is inside it while the paper original in a cupboard is not. Build the data map as you go: each data set, its purpose, basis, location, owner, recipients and retention. Data mapping under DPDP gives a four-week method and the digitisation line for paper.

4. Test samples. This step separates an assessment from a survey. Tests we recommend:

• pull five consent records at random and check each against s. 6(1) and the notice shown;
• send a test access request through your published route and time the reply;
• check whether a leaver from three months ago still has access to anything;
• read three vendor contracts for processing, security and breach-notice terms;
• check log retention on two systems that hold personal data;
• check how one programme or product verifies a parent.

5. Rate each gap. Record each control's status (in place with evidence, partly in place, absent, or not applicable with a reason). For each partial or absent control, place it on the grid below by penalty tier and likelihood.

6. Report and roadmap. A short executive summary for the board, the gap register, the heat map, the data map and a roadmap that assigns each gap to an owner and a month.

What it covers, area by area

For a body corporate, add a short check against the 2011 SPDI Rules, which bind until 13 May 2027 (see the FAQs and the DPDP timeline). For the full control list, see the DPDP compliance checklist.

How we rate a gap

The Act prescribes no scale; this is the scale we suggest. Every partial or absent control falls in exactly one cell. Penalty tier comes from the Schedule; likelihood is judgement about how often the gap is exercised and how many people it touches.

A missing children's consent check in a programme that enrols 3,000 children a year is critical; a missing nomination form is low.

Sample gap register

Illustrative composite: a mid-sized nonprofit running education programmes in two states, with a donor CRM and an HR system.

VND-02 sits in the ₹250 crore tier because security terms in processor contracts are part of the s. 8(5) safeguards (Rule 6(1)(f)).

Heat map

The same gaps on the rating grid. Work top right first.

Placing a gap by penalty tier is our method for ranking. It does not predict an amount: the Board must first find a breach significant (s. 33(1)) and then weigh the factors in s. 33(2). Penalties under the DPDP Act explains those factors.

What else you should receive

• An executive summary of two pages: readiness, the critical gaps, the decisions needed and the cost of the first ninety days.
• The data map as a working file, one row per data set.
• A roadmap with every gap assigned to a month and an owner, and dependencies shown. The data map comes before notices, and notices before the existing-data drive.
• The evidence file: the samples tested and what was found, so the next assessment can re-test the same things.
• Open legal questions, listed separately for your lawyer, with the facts she needs.

How long it takes

These are planning assumptions for elapsed time, based on the number of teams to interview and systems to walk, and assuming the people who need to answer are available. They are not quotes. What usually stretches the timeline is waiting for answers.

What lengthens it: data held by implementing partners or grantees, field operations in several languages, children's data, many vendors, and no one with authority to make teams answer. What shortens it: a current system inventory, a recent security assessment, and a single owner who chases.

The fixes take far longer than the assessment, so start early; the DPDP timeline works back from 13 May 2027.

Doing it yourself, or with help

You can run the assessment yourself. You need someone who has read the Act and the Rules in full, the authority to get answers from every team, and the discipline to test samples rather than accept assurances. The area table is the scope; the DPDP Act guide explains each duty; the checklist gives the controls. Our view: internal teams tend to underrate gaps in their own work, so ask someone outside the function to review the ratings.

Bring in help when you lack the time, when the organisation will not answer its own staff, when the board wants an independent view, or when field operations, children's data or many partners make the scope large.

How to choose an assessor

Questions to ask:

1. Will you test samples of our records and contracts, or rely on our answers?
2. Who will do the work, and have they read the Rules in full? Ask for a sample register from a past assessment, anonymised.
3. How will you cover field operations, paper that gets digitised, and partners?
4. What do we receive, in what format, and can we use it with any vendor?
5. What personal data will you need to see, and how will you protect it?

Red flags in proposals:

• a questionnaire only, with no interviews or sample tests;
• a report generated by a tool, with ratings nobody can explain;
• a "DPDP certificate" offered at the end (see below);
• findings that name the assessor's own products rather than requirements;
• no mention of children's data, the s. 5(2) notice drive or processors.

What drives price. The number of entities, programmes and systems; field sites; languages; children's data; partners; and how much sample testing you want. As planning assumptions for assessor effort: roughly 5–10 days for a small organisation, 15–30 for a medium one, and 40–80 or more for a large group. Use them only to compare proposals.

The assessor is your processor. An assessor who looks at consent records, HR files or beneficiary lists is processing personal data for you, so put a contract in place before access (s. 8(2)), with confidentiality, security terms (Rule 6(1)(f)), and erasure of anything copied when the work ends (s. 8(7)(b)). Our view: give view-only access or masked samples where you can, and keep a log of what was shared.

Our baseline, and the conflict to manage

We run baselines, and we also sell the work and the platform that fix the gaps. That is a conflict, and you should weigh our findings with it in mind. Ask any assessor, including us, to put in the contract that the gap register is yours to take to any adviser or vendor, that findings name requirements rather than products, and that readiness counts only evidence.

In plain terms, the baseline as our home page describes it works like this. It starts with a workshop where leadership and team leads agree the scope, owners and the first 90 days. Each team then answers our baseline questionnaire about its own work, and every question shows which part of the law it comes from; anything nobody can answer shows up as a gap. Alongside, we map every app, sheet, form and vendor that holds personal data and why you keep it. The output is a register of gaps ranked by the penalty each carries, a readiness score and a roadmap with named owners.

The readiness score measures how many of the controls the Act and Rules ask of you are done, weighted by the penalty they carry, and it counts a control as done only when its evidence is on file. It does not measure how well a control works in practice; the sample tests we recommend above do that; ask whether any assessor, including us, will run them.

The baseline is available on its own or as the first stage of the full programme. The home page also offers a two-minute readiness check for a rough picture, and a free first call of about 30 minutes. We do not publish baseline prices on the site.

Is there a DPDP certification?

No official one, as of 25 October 2026.

The Act and Rules contain no certification scheme for Data Fiduciaries or Data Processors. No provision lets the Board or the government certify an organisation as "DPDP compliant", and we have found no notified scheme. The Board itself had no Chairperson or Members appointed as of reports through August 2026 (LiveLaw, 1 August 2026), and we have found none announced since.

The Rules mention certification in one place. A company applying to register as a Consent Manager must be independently certified as consistent with the data protection standards and assurance framework that the Board publishes (First Schedule, Part A, item 9). That applies only to Consent Manager applicants, and as far as we found the Board had not published the framework by 25 October 2026. The other formal check, for Significant Data Fiduciaries, is an annual impact assessment and audit by an independent data auditor (s. 10(2)(b), Rule 13), which produces a report, not a certificate; no SDF has been notified.

What vendor certificates are. A "DPDP compliance certificate" or "DPDP certified" badge from a consultant or software vendor is a private statement that the vendor assessed you against its own criteria. It has no legal standing, it does not shift the burden of proof in s. 6(10), and it does not make your safeguards reasonable under s. 8(5). It can still be useful evidence that you took care, if it shows what was tested, how, and when. A "certified DPDP professional" course certificate is a training record for an individual.

What related certificates are. Accredited certification to ISO/IEC 27001 (information security) or ISO/IEC 27701 (privacy information management), or a SOC 2 report, is independently checked. ISO/IEC 27701:2025 is now a standalone, certifiable standard, while certificates to the 2019 edition, which sat on top of ISO/IEC 27001, are in transition; check which edition a certificate cites. These are good evidence for parts of Rule 6 and for a processor's customers. They do not test the duties particular to the Act, such as notices in Scheduled languages, the s. 5(2) notice drive, verifiable parental consent under Rule 10 or the 72-hour Board report, and their scope may exclude the systems that matter.

What to ask anyone offering a certificate:

1. Which standard or criteria, and who wrote them?
2. Is the certifier accredited, and by whom?
3. What was in scope, and what was excluded?
4. What was tested by sampling, and what was taken on assurance?
5. On what date, and how long is it meant to be valid?

Where the law is unclear

How should gaps be weighed before the Board has decided any case? By the Schedule's ceilings and by likelihood, as above. Why: the ceilings show what Parliament treated as most serious, and s. 33(2) factors such as gravity, duration and mitigation favour fixing frequent, widespread gaps first. Would change if: early orders show different priorities. Confidence: medium.

Can the assessment be kept privileged? Only in narrow conditions. Why: professional communications privilege under the Bharatiya Sakshya Adhiniyam, 2023 (ss. 132–134) protects communications with an advocate for the purpose of legal advice. The Supreme Court held on 31 October 2025 that in-house legal teams do not attract s. 132, though s. 134 may protect their communications with the organisation's external legal adviser (In re Summoning Advocates, 2025 INSC 1275). Privilege, if any, therefore needs external counsel and a genuine legal-advice purpose, and an operational assessment run for compliance planning is unlikely to qualify as a whole. Ask your lawyer before you start. Would change if: a court rules on compliance assessments commissioned through counsel. Confidence: low.

Your next four weeks

1. Name the owner, and get a board or leadership mandate for teams to answer.
2. Fix the scope: entities, programmes or products, and roles.
3. Send the questionnaire to every team, and book the interviews.
4. Start the data map with the systems you know, then look for the ones you do not.
5. Run the six sample tests.
6. Rate the gaps, build the register and heat map, and take the critical items to leadership with an owner and a month each.
7. Brief the board with the ten questions boards should ask.

How we wrote this guide. We worked from the text of the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E), as corrected by G.S.R. 892(E)), and the Bharatiya Sakshya Adhiniyam, 2023. The absence of an official certification scheme and the status of the Board and its Consent Manager framework were last checked on 25 October 2026. The description of our baseline is taken from our home page. Time and effort estimates and the rating scale are our planning assumptions. This guide explains the law; it is not legal advice.