Answer 7 short questions about your Indian website. We turn the answers into a personal DPDP Act 2023 compliance checklist — gaps ranked by penalty band, each one linked to the exact free tool that closes it.
Free · No signup · Results saved in your browser
Sample output
Your personal checklistDeploy a DPDP cookie banner
Section 6
Publish a named Grievance Officer
Section 8(10)
Itemise the privacy notice
Section 5
Set up rights intake page
Sections 11–14
Document breach playbook
Section 8(6)
Sample shown. Your real checklist is generated from your answers.
Time
≈ 5 minutes
Questions
7 short
Coverage
13 DPDP categories
Output
Personal checklist
Who is this for
The flow works for anyone, but the entry-point you pick changes how long you spend and what you walk away with.
First-time founder
The wizard walks you through every category in plain English. No legalese, no jargon. At the end you have a punch list ordered by what fixes save the most penalty exposure first.
Start the 5-minute flow →Compliance lead
Use the flow as a structured intake. Each step maps to a deliverable — banner, notice, GO publication, breach playbook, rights intake — with the free tool or template to ship it.
See the deliverables →CTO / engineer
Skip the wizard. Run the free DPDP scanner on the live URL — it returns a 0–100 score with Section-anchored evidence and the exact code-level fix for each gap.
Run the scanner instead →What you'll do
Each step is a small multiple-choice or checkbox question. No free text. No legal vocabulary. Every answer maps to a named Section of the DPDP Act 2023.
01
Scope check — territorial reach, data principal vs data fiduciary, sole proprietor exemption.
02
Categories — email, phone, payment, health, children, biometric. Each category triggers different obligations.
03
Banner present? Reject equal to Accept? Categories granular? Withdrawal one click? Maps to Section 6.
04
Section 5 itemisation + Section 8(10) Grievance Officer publication checks.
05
GA, Meta Pixel, payment gateway, CRM, support chat — each one a Section 8 sub-processor under DPDP.
06
72-hour clock under Section 8(6) — playbook, named owner, Board template, customer comms.
07
Access, correction, erasure, withdraw consent, nominee, grievance — Sections 11–14 intake.
Start now
Your answers stay in your browser. No signup. You can pause and resume any time before the page is closed.
Step 1 of 8
The DPDP Act applies if you process personal data of people in India — including from outside India. Email addresses, names, phone numbers and analytics cookies all count.
Stuck on a question? Ask Suraksha or email a specialist.
At the end of the flow
Not a generic checklist. Your gaps, ranked by penalty band, each one with the exact free tool or template that closes it.
Every gap from your answers, with the DPDP Section that requires the fix and a Critical / High / Medium priority chip.
Each fix points at the tool: banner builder, privacy notice generator, DPA generator, breach notification template, rights intake form.
If you flagged sensitive data (health, payment, children), we add the sector-regulator overlay (RBI, IRDAI, ICMR) where it applies.
Email the checklist to yourself, share with your engineer, or upgrade to a free human audit walkthrough.
Or skip the flow
The flow is the broadest starting point. If you already know what you need, jump straight to it.
0–100 compliance score for any Indian website in 60 seconds. 13-category breakdown. Section-anchored evidence. Downloadable PDF.
Scan my website →A checkDPDP specialist walks every category with you, sends admin-dashboard credentials by email within 1 business day. Free.
Request free audit →One-line embed. Reject equal to Accept. Granular categories. Consent log. Section 6 compliant. Free.
Open the Banner Builder →Common questions
Yes. The DPDP Act 2023 applies to any Data Fiduciary processing personal data in India, regardless of revenue or headcount. The penalty schedule does not exempt small companies. The Section 33(2) factors (gravity, mitigation, cooperation) do reduce penalties for genuine good-faith efforts — and good-faith effort is exactly what this 5-minute flow documents for you.
5–8 minutes for most founders. The 7 steps are short multiple-choice or checkbox questions — no free text required. You can pause mid-flow; your answers stay in your browser until you submit. The final checklist is generated instantly.
A personal DPDP compliance checklist — gaps ranked Critical / High / Medium based on your answers, each one citing the DPDP section that requires the fix and linked to the exact free tool or template that closes it (banner builder, privacy notice generator, breach template, DPA generator, rights intake form).
Free. No signup, no account, no credit card. The checklist is generated client-side from your answers — we do not store or transmit them. You can optionally email yourself a copy at the end.
Either order works. The flow is a self-assessment — answers based on what you know about your processing. The scanner is an objective check — what is actually live on your website. The fastest path: run the scanner first (60 seconds), then walk the flow with the scanner findings open so the answers are grounded in real data.
Yes. The questions are written for the founder, not the engineer. Every option has a plain-English explanation. If you genuinely do not know an answer for a step, mark it unknown — the final checklist treats unknowns as "investigate" actions for your engineer.
Ready when you are
Or sixty seconds, if you take the scanner route instead. Either way, no signup.
Last reviewed by checkDPDP editorial · 26 June 2026
