DPDP Gap Assessment Checklist: What to Collect, What Good Looks Like, and Where It Goes Wrong

Most DPDP checklists open with the same line: “Publish a privacy notice.” Fine. But everyone has one. The better question is whether you can produce the dated, versioned, owned document behind it, and some sign that anyone follows it.

This DPDP gap assessment checklist is built around evidence. For each area you get what to collect, who probably holds it, what good looks like, and the red flag that says “paper only”. For the wider picture, start with our guide to what a DPDP gap assessment covers and how it runs. This page is the working list.

1. Checklist of Laws or Checklist of Evidence?

A checklist of laws tells you what the Act says. A checklist of evidence tells you whether your business matches it. “Privacy notice published” is a tick. A copy of the notice, its version history and the link a customer actually sees is proof. This is not legal advice, and finishing the list does not make you compliant. It shows where you stand today, on paper you can inspect.

2. Grade Every Item

Yes-or-no scoring flatters you. It has no room for the most common answer in Indian businesses right now: “we have something, but…” So grade three ways.

Our rule of thumb, not the Act’s: if the owner cannot produce the artefact in ten minutes, drop it a grade. An auditor, insurer or enterprise client rarely waits while you search old email. For a quick first read, the free DPDP Scorecard takes about five minutes.

3. The DPDP Evidence Checklist: Eight Packets

Give each packet one named owner. Section numbers refer to the DPDP Act, 2023 and rule numbers to the DPDP Rules, 2025.

4. Where a Gap Assessment Goes Wrong

• Collecting policies, not proof. A folder of PDFs feels productive. Ask for the log, the ticket or the signed page.
• Building the vendor list from the accounts ledger. Free plans, form plugins and a recruiter’s spreadsheet never reach payables. Ask each team what holds customer or employee data.
• Treating one-year log retention as an IT detail. Rule 6 makes it a legal duty, and it can sit awkwardly beside erasure. Reconcile the two on paper.
• English-only notices. Section 5 expects people to be able to read the notice in English or any Eighth Schedule language.
• Grading yourself from memory. Teams tend to score higher than their evidence supports. Have someone outside the function check.
• Treating it as a one-off. Grades go stale when a new tool or vendor arrives. Re-run after material changes.

5. A Worked Example

This is hypothetical, not a client case. A 120-person software company hands over a vendor list of fourteen names from finance. The compliance lead then asks every team one question: which tools hold customer or employee data? The answers run well past thirty. A form plugin, a webinar tool, a recruiter’s spreadsheet, a screen-recording app. Nobody lied. The ledger simply cannot see free plans.

The processors packet drops from Evidenced to Missing. The first fix is a register built from team answers, with a contract status beside every name.

6. How Much Time Is Left

Rules 3 and 5 to 16 commence on 13 May 2027, about 200 days from late October 2026. Some commentary says 14 May, so confirm against the Gazette and watch MeitY for changes. When you have findings, our 90-day plan shows how to fix them, and the DPDP Rules 2025 guide lists the dates.

7. Where RuleExpert Fits

A spreadsheet is fine for the first pass. It struggles when you must prove the second pass beat the first. RuleExpert’s Data Registry keeps the inventory and owners together, Vendor Governance holds the processor register with agreement status, DSR Automation tracks requests against deadlines, and Breach Management follows the Rule 7 clock. Software does not replace your decisions or legal advice. It stops evidence going stale.

Prefer help with the legwork? See the RuleExpert gap assessment service, or book a RuleExpert demo.

8. Frequently Asked Questions

What is a DPDP gap assessment checklist?

A working list of evidence used to test each duty under the DPDP Act and Rules. Each item is graded Evidenced, Paper-only or Missing.

What documents should I collect for a DPDP gap assessment?

Your data register, notices and consent logs, vendor contracts, security and log settings, rights request log, breach procedure, retention schedule, and training and contact records.

Is a DPDP gap assessment mandatory?

No. Neither the Act nor the Rules require one, though several duties are hard to meet without the visibility it gives.

How is this different from a DPDP compliance checklist?

A compliance checklist asks whether a control exists. This one asks for proof and grades how strong it is.

How long must logs be kept under DPDP Rule 6?

One year for logs and related personal data, to help detect and investigate unauthorised access, unless another law requires a different period.

Who should own the assessment?

Usually the compliance head, company secretary or COO, sponsored by a director or the CFO. Each packet still needs its own owner.

How often should we repeat it?

After any material change such as a new vendor, product or system, and at least once a year.

Does the three-year erasure rule apply to my company?

Only to specified large platforms: e-commerce and social media with 2 crore or more registered users, and online gaming with 50 lakh or more, with 48 hours’ notice before erasure. Others follow Section 8(7).

When do the DPDP Rules take effect?

Rules 1, 2 and 17 to 21 are in force. Rule 4 commences on 13 November 2026, and Rules 3, 5 to 16, 22 and 23 on 13 May 2027. Confirm against the Gazette.

Can an MSME or startup use this checklist?

Yes. The Act sets no turnover or headcount threshold for its core duties. Scale the depth of evidence to your size, but keep all eight packets.