DPDP readiness quiz.
15 questions. Weighted.

Whether MeitY's January 2026 proposal to compress the DPDP compliance window from eighteen months to twelve (moving SDF compliance to 13 November 2026) and to bring s.10(1), r.13(4), r.15 and s.17(2) into force immediately has been notified in the Gazette. Sources dated to 22 July 2026 still describe it as an unnotified consultation proposal following stakeholder discussions on 23 January 2026 with comments due 4 February 2026. No amending notification was located.

Whether monetary penalties can in fact be imposed on a Consent Manager from 13 November 2026. G.S.R. 843(E) cl.(b) brings s.27(1)(d) into force at twelve months, and that clause speaks of inquiring "and impose penalty as provided in this Act" — but s.33 and the Schedule commence only at eighteen months under cl.(c). Several commentaries assert that the penalty framework for consent managers is enforced in Phase 2; the gazette text does not support a monetary penalty before 13 May 2027. Rule 4(4) directions and Rule 4(5) suspension or cancellation of registration are available from 13 November 2026 regardless.

Whether the Board has published the "data protection standards and assurance framework" referred to in First Schedule Part A item 9(a), or the application particulars, information and documents contemplated by Rule 4(1). Neither located. Until they exist a prospective Consent Manager cannot fully assemble an application.

Whether the Chairperson and Members of the Data Protection Board of India have been appointed and assumed office as at 19 August 2026. MeitY invited applications on 6 May 2026 with a further notification on 6 June 2026; commentary dated April 2026 states the search-cum-selection committees were delayed and no Chairperson or Members had been appointed. No appointment notification was located.

Whether any Data Fiduciary or class has been notified as a Significant Data Fiduciary under s.10(1). None located.

Whether the Central Government has issued any notification under s.16(1) restricting transfer to a named country or territory, or any general or special order under Rule 15 specifying requirements for making personal data available to a foreign State or an entity under its control. None located.

Whether the Central Government has specified, under Rule 13(4), the categories of personal data an SDF must keep within India, or constituted the Rule 13(5) committee. Neither located.

Whether s.9(5) — the power to notify a higher age above which a Data Fiduciary with verifiably safe children's processing is exempt from s.9(1) and s.9(3) — has been operationalised for anyone. No notification located.

The Fourth Schedule Note in the gazette text of the DPDP Rules 2025 has duplicated clause lettering: both "advertisement" and "allied healthcare professional" are lettered (a). This appears to be a drafting error; no corrigendum was located.

Precise wording of s.6(7) and s.6(8) could not be confirmed against the primary PDF at character level (the fetched Act text rendered those sub-sections through a summarising layer). s.6(9) was confirmed. Verify s.6(7)–(8) against the MeitY PDF before quoting them in a client-facing product.

Claims circulating in secondary commentary that s.33 permits the Board to enhance or double a penalty (a purported s.33(3)) — the Act as published by MeitY contains only s.33(1) and s.33(2), and no doubling or multiplier provision was found. Treat the "up to Rs 500 crore" figure that appears in some vendor material as unsupported.

It depends on the date, because G.S.R. 843(E) split commencement into three. On 13 November 2025 only the Data Protection Board framework came into force — s.1(2), s.2, ss.18–26, s.35, ss.38–43 and s.44(1) and (3), with Rules 1, 2 and 17–21. No compliance obligation attached to any Data Fiduciary, and contrary to much of the commentary, complaints did not open: s.27 was not in force in that phase at all. On 13 November 2026 exactly one thing commences — s.6(9), s.27(1)(d) and Rule 4 with First Schedule Parts A and B, which open Consent Manager registration. On 13 May 2027 the operative regime lands: ss.3–5, s.6(1)–(8) and (10), ss.7–17, s.27 except cl.(1)(d), ss.28–34, s.36, s.37 and s.44(2), with Rules 3, 5–16, 22 and 23.

For an ordinary Data Fiduciary, that is what the gazette text says. Sections 28–34 — the Board's inquiry powers, appeals, penalties under s.33 and THE SCHEDULE — commence only eighteen months after 13 November 2025. The one open question concerns Consent Managers: s.27(1)(d) commences at twelve months and speaks of inquiring and imposing penalty as provided in the Act, but s.33 and the Schedule do not commence until eighteen months. Several commentaries assert the consent-manager penalty framework is live in Phase 2; the gazette text does not support a monetary penalty before 13 May 2027, and we have left that flagged as unresolved rather than resolving it either way. Rule 4(4) directions and Rule 4(5) suspension or cancellation of registration are available from 13 November 2026 regardless.

THE SCHEDULE, read with s.33, sets ceilings per breach rather than fixed fines. Rs 250 crore for failing to take reasonable security safeguards under s.8(5); Rs 200 crore for failing to notify a personal data breach under s.8(6); Rs 200 crore for the children's obligations under s.9; Rs 150 crore for Significant Data Fiduciary obligations under s.10; Rs 10,000 for a Data Principal's own duties under s.15; the applicable amount for breaching a voluntary undertaking under s.32; and Rs 50 crore as the residual entry covering everything else, including notice, consent, retention, rights and cross-border failures. One incident can attract the s.8(5) and s.8(6) entries concurrently, so Rs 450 crore of headroom. There is no turnover-percentage cap of the GDPR 2%/4% kind, and the Act as published contains no provision allowing the Board to double or enhance a ceiling — the "up to Rs 500 crore" figure in some vendor material is unsupported.

You do not decide. SDF status is conferred by Central Government notification under s.10(1), on an assessment of factors including the volume and sensitivity of personal data processed, risk to the rights of Data Principals, potential impact on the sovereignty and integrity of India, risk to electoral democracy, security of the State, and public order. The list is non-exhaustive and there is no numeric threshold anywhere in the Act or the Rules. Seventh Schedule entry 3 names a MeitY officer designated by the Secretary as the person who carries out that assessment, and Rule 23 lets the Government call for information for the purpose. As at 19 August 2026 no entity or class had been notified. Once designated, Rule 13(1) runs a twelve-month clock from the designation date for the first DPIA and audit — so the practical answer for anyone plausibly in scope is to build the package before the notification, not after.

No, and the reason is structural rather than cosmetic. Section 8(1) makes the Data Fiduciary responsible for compliance irrespective of any agreement to the contrary and irrespective of the processor's failure, while DPDP imposes essentially no direct statutory duty on the Data Processor — so unlike GDPR, the contract is the only instrument that moves risk, and there is no Article 28(3) checklist to fall back on. Section 8(2) also narrows engagement: a processor may be engaged only under a valid contract and only for activity related to offering goods or services to Data Principals. Practically, a DPDP processor contract needs the r.6(1)(f) security-safeguards flow-down, a breach-escalation clock fast enough to feed your Rule 7 Board report, erasure on instruction mirroring s.8(7)(b), and support for the r.8(3) one-year log floor. Fix the vocabulary too: controller, processor and data subject become Data Fiduciary, Data Processor and Data Principal; "legitimate interests" has no analogue under s.7's closed list; and SCC and adequacy language is inert under s.16's restriction model.

Only if you are designated a Significant Data Fiduciary. Section 8(9) requires an ordinary Data Fiduciary to publish the business contact information of a person able to answer a Data Principal's questions about processing — that person does not have to carry the DPO title, so do not manufacture an obligation you do not have. If you are designated an SDF, s.10(2)(a) is stricter than GDPR Article 37: the DPO must be an individual, based in India, responsible to the Board of Directors or similar governing body, and the point of contact for grievance redressal. An EU-based group DPO does not satisfy it. Note also Rule 9's second limb, which is routinely missed — the contact information must appear not only on your site or app but in every response to a communication exercising Data Principal rights.

Not as a general rule. Section 16 is a blacklist power, not an adequacy whitelist: transfer outside India is permitted by default, and the Central Government may notify countries or territories to which transfer is restricted — the inverse of the GDPR Chapter V model. The only localisation mandate in the framework is Rule 13(4), which binds Significant Data Fiduciaries alone and only over categories of personal data the Central Government later specifies on the recommendation of a Rule 13(5) committee. As at 19 August 2026 no s.16(1) restriction and no r.13(4) category had been notified. Section 16(2) expressly preserves stricter sectoral law, so RBI payment-data localisation, IRDAI and telecom directions continue to bind you regardless of what DPDP permits.

Possibly, and it is the biggest open question in this area. MeitY's January 2026 consultation proposed compressing the compliance window from eighteen months to twelve — moving SDF compliance to 13 November 2026 — and bringing s.10(1), r.13(4), r.15 and s.17(2) into force immediately. Sources dated 22 July 2026 still described it as an unnotified consultation proposal, and no amending notification was located as at 19 August 2026. We have left that flagged as unconfirmed rather than assuming either outcome. If you are plausibly in SDF scope, build to the earlier date.

No. The quiz runs entirely in your browser's memory. There is no API call, no analytics event carrying your answers, no email gate and no stored report — refreshing the page clears everything. The print button hands the page to your own browser's print dialogue so you can save a PDF locally; nothing is uploaded to produce it. For a privacy self-assessment that matters more than usual, so it is worth verifying in your browser's network tab.