DPDP Gap Assessment: From Findings to a 90-Day Plan

A DPDP gap assessment ends with a list. That is the easy part. The harder question arrives the following Monday: who does what about it, in what order, with whose time?

If you are the person who has just been handed that list, you are probably not a privacy specialist. RuleExpert’s own description of the typical reader is blunt about it: the hospital administrator who already runs admissions, billing and the NABH file, the SaaS company’s CTO who is also the security team, the person who handles payroll and has now become responsible for candidate, employee and client data at once. The Act assumes somebody owns this work. In most businesses in scope, nobody does.

This guide picks up where our main guide, what a DPDP gap assessment covers and how to read the results, leaves off. It shows how findings turn into fixes, what a ninety-day programme looks like, who carries which part, and what you should be holding when the outside help leaves. We have kept it to what RuleExpert actually offers and says, so you can check any claim against our services pages.

1. What Do You Have in Your Hands When the Assessment Ends?

A proper assessment leaves you with five things: a register of where personal data sits, findings tied to the provision that creates each duty, a readiness score, your exposure in order of size as a phased roadmap, and a board-ready summary. You keep all of it whether or not anything else follows. In RuleExpert’s model it is also the cheapest of the three stages, and the one that has to come first.

The reason it has to come first is simple. Until somebody has walked your operation and written down where personal data actually sits, anything a consultant says about your obligations is a guess. That includes anything we say. Everything that follows in this guide is a response to what the assessment found, not a substitute for it.

If you have not yet done an assessment, the free DPDP Scorecard is the quickest start. It scores readiness in about five minutes, needs no account and shows your exposure in rupees. It is a self-assessment, so it is a starting point, not a finding.

2. Who Is Actually Doing This at Your Place?

RuleExpert’s services page describes three reasons the work lands badly on whoever inherits it.

• They already have a job. DPDP arrived on top of whatever else sat on their desk.
• The statute is new to everyone. The Rules were notified in November 2025, so nobody has ten years of DPDP practice. RuleExpert’s view is that most advice in circulation is GDPR with the country name swapped.
• The work is front-loaded. Mapping an estate, drafting notices and papering vendors are heavy once and light forever after. Hiring a permanent role for a temporary volume of work is the wrong shape, and so is outsourcing a function your own people could run once it is set up.

That is why RuleExpert describes its offer as hands, not a replacement. The aim is to carry the volume while it is heavy and hand back something your own team can operate. As the services page puts it, if the job is done properly you need less outside help each year.

3. How Do Findings Turn Into Fixes?

Most findings fall into recognisable types, and each type has a natural fix. The table maps the common ones to the RuleExpert service and platform module that deal with them. It is a guide to where findings usually land, not a promise that every organisation needs every row.

Two notes on reading it.

• Security safeguard gaps are not a row. The assessment reviews your safeguards, but fixing them usually sits with the people who run your systems. RuleExpert’s guidance on working with others is that your IT provider knows your systems and your lawyer knows your contracts, and that RuleExpert supplies the machinery, the evidence trail and the specialist reading, and briefs them. Where you would rather involve nobody else, RuleExpert can do all of it.
• The same finding can land on more than one row. A consent problem is often a notice problem too. Treat the table as a map, not a checklist.

For the detail on two rows that carry heavy obligations, see our guides to DPDP breach notification requirements and DPDP consent management for businesses.

4. Do You Have to Appoint a DPO?

This is the question that most often turns a calm project into an expensive one, so it deserves its own section.

Almost certainly not. A formal Data Protection Officer based in India is required only of a Significant Data Fiduciary under Section 10 of the Act, meaning an organisation the government designates as one. Everyone else must publish contact details for a person who can answer questions about how they handle personal data, and that can be someone you already employ.

For most organisations, then, DPO as a Service is a capacity decision, not a legal one: do you want a named, reachable person holding the function and reporting to you, or do you have someone who can do it? RuleExpert’s advice is to be careful of anyone quoting for a mandatory DPO appointment before establishing whether you are a Significant Data Fiduciary, and to check which section they cite for it.

That is also why the DPIA and SDF readiness work sits in the first stage. Finding out early whether you are likely to be named saves you from buying obligations you do not owe. RuleExpert’s page notes that most businesses are not. Our guide to Significant Data Fiduciary obligations explains what changes if you are.

5. The Three Stages: Assess, Operate, Assure

RuleExpert organises its ten services into three stages that run in sequence.

• Assess is where you find out what you are carrying: the gap assessment, data discovery and the record of processing, and the DPIA and SDF readiness work. Nothing else can be scoped honestly until it exists.
• Operate is the work that runs every week. This is where a programme is either alive or decorative, and where most of the hours go: DPO as a Service, Privacy Operations, Notices, Policies and Consent, and DPA and Contract Review. Privacy Operations in particular is described as the part nobody budgets for and everybody discovers.
• Assure is about being able to prove it on the day. The services page ties this to Section 33(2) of the Act, which makes what you did, and how promptly, an express factor in any penalty. It covers breach readiness and response, audit readiness and support, and training. The audit service exists because Rule 13 puts an independent auditor in front of a Significant Data Fiduciary every twelve months. Training exists because the receptionist taking consent at a counter needs different training from the person answering a rights request, and both need to have been trained, with a record to show it.

The people behind the work are described as lawyers and engineers rather than a reseller: empanelled privacy lawyers who draft the notices, policies and agreements, techno-legal consultants who walk and map your operation, and a platform that RuleExpert builds and maintains itself.

6. What Does a Ninety-Day Programme Look Like?

For organisations that want to be done in one pass, RuleExpert runs the three stages as a ninety-day engagement. Each stage ends in something you could put in front of a regulator, an insurer or your board.

• Days 0 to 30, Assess. Your documents are read against the Act, your people are interviewed and your premises are walked. Out of that come the register, the record of processing, the readiness score and your exposure. You finish this stage knowing what you are carrying, which is not where most businesses start.
• Days 30 to 75, Operate. Notices are drafted and published. Consent is designed purpose by purpose. Retention schedules are written with a legal basis behind each entry. Vendor agreements are put in place. The accountable contact is published where people can find it.
• Days 75 to 90, Assure. The breach playbook is wired to the clock, the evidence pack is generating, people are trained on the parts they actually touch, and you have the first audit-ready position you have had.
• Then hand over and step back. RuleExpert trains whoever owns it, watches them run a cycle, and reduces its involvement. Some clients keep a light retainer. Some need nothing. RuleExpert describes both as successful outcomes and says it will tell you which one you are heading for.

7. Ours to Carry, Yours to Decide

Outsourcing goes wrong when the line between what the provider does and what you decide is blurry. RuleExpert draws it in five places.

• RuleExpert does the volume. Walking the estate, drafting and translating notices, papering vendors. It is heavy once and needs a specialist reading of a new statute.
• You set the lawful basis. Whether a purpose runs on consent or on a legitimate use is a decision about your business, and you live with the consequence. RuleExpert shows you what follows from each choice. It does not make the choice for you.
• You approve what publishes. Notices, policies and filings all go out carrying a name from your organisation, and the record shows whose.
• RuleExpert is on call for the bad day. A breach at nine at night is not the moment to read Rule 7 for the first time. That is when an outside team earns its retainer.
• You keep the register. Every record created is yours, in your own tenant and exportable. Nothing about leaving is designed to be difficult.

That division is the point of the arrangement. You keep the decisions that belong to the business, and you borrow the capacity and the specialist reading you do not have time to build.

If you would like to talk through where that line would fall for your organisation, you can get a free consultation with RuleExpert with people who do this daily.

8. What Will You Be Holding When the Engagement Ends?

RuleExpert calls this the question to ask every provider you consider, and the one the market answers worst. There are three possible answers.

• If you buy software alone, you own a product with nothing in it. No tool is going to walk your premises and find the paper register at reception or the spreadsheet on a recruiter’s laptop.
• If you buy consulting alone, you end with a report. It was accurate the week it was written, and it starts ageing the day the consultants leave, because nothing is keeping it current.
• What RuleExpert does instead is have its consultants populate the platform. The register, the notices, the agreements and the schedules go into software you keep, so the day the engagement ends is the day the system starts running.

The summary on the services page is a good test for any quote: a document describes what was true once, and a system stays true because your team uses it. In practice you should expect to leave with a populated system, not a report: the register of where personal data sits, the published notices and their versions, the processing agreements, the retention schedules and the audit trail, all in your own tenant and all exportable.

9. Which Services Do You Actually Need?

Not all ten. A DPDP consultant who insists otherwise, in RuleExpert’s words, is selling a programme rather than solving your problem.

The common pattern RuleExpert describes is this. Most clients take the Assess stage first, because until the operation has been walked and the data written down, anything either side says about your obligations is a guess. After that, the usual next step is one or two Operate services, most often notices and vendor agreements, with the rest handled in-house. The full ninety-day programme is for businesses that want to be done in one pass.

A few practical points follow from that.

• Start where the evidence points. The assessment tells you which findings are largest. Take the services that match those, not the whole menu.
• Keep what your team can run. If your own people can operate something once it is set up, outsource the set-up, not the function.
• Use your existing advisers. Your lawyer already knows your contracts and your IT provider already knows your systems. Neither usually has time to become a DPDP specialist, so RuleExpert briefs them and supplies the specialist reading.
• Use the platform where it fits. The compliance suite has six modules, covering the scorecard, consent management, rights request automation, the data registry, breach management and vendor governance, all on one data model. Our DPDP compliance solution page shows how they fit together.

For the full list of rules and their deadlines, RuleExpert’s DPDP Rules 2025 guide is the reference to keep open while you plan.

10. How to Judge a Quote

Four checks, all drawn from how RuleExpert describes its own approach.

• Ask what you will hold at the end. A populated system in your own tenant, or a report. The previous section is the test.
• Expect scoping, not a flat number. The cost depends on the size of your estate and on which of the ten services you want carried. RuleExpert says it would rather scope the work than quote a number that turns out wrong in either direction. A provider who quotes without looking at your estate is guessing.
• Check the DPO line. If the quote includes a mandatory DPO appointment, ask whether you are a Significant Data Fiduciary and which section requires it.
• Calibrate to your situation. RuleExpert notes that full programmes for Significant Data Fiduciaries are quoted across this market in the tens of lakhs and up, and that most businesses are not Significant Data Fiduciaries and should not be paying anything like that.

One client describes the value of a first conversation this way. A founder at a logistics company, quoted on RuleExpert’s services page, says that after reviewing their score they “opted for a consultation”, found the discussion “very practical”, and “got clear direction on what to fix first and how to approach DPDP compliance in a structured way.” The page attributes its client quotes by role and sector and says it never names a client.

11. Mistakes After a Gap Assessment

• Filing the report and moving on. A report starts ageing the day it is delivered. The point of a register and a re-runnable score is that they keep up.
• Buying software alone. You will own an empty product, because no tool walks your premises.
• Buying consulting alone. You will end with a document, and nothing keeping it current.
• Hiring a permanent role for a temporary volume of work. The load is heavy once and light afterwards.
• Outsourcing the decisions. The lawful basis and what publishes are yours. Hand those over and nobody in the business owns the consequences.
• Paying for a mandatory DPO you may not need. A formal DPO is required only of a Significant Data Fiduciary.
• Assuming a large vendor’s paper is fine. You remain accountable for every processor, so the clauses it is missing become your problem.
• Skipping the record of training. It is not enough to have trained people. You need to be able to show that you did.
• Forgetting the bad day. A breach is the worst time to read the Rules for the first time. Have the playbook, and know who is on call.

12. Frequently Asked Questions

What happens after a DPDP gap assessment?

You hold a register of where personal data sits, findings tied to provisions, a readiness score, your exposure in order and a phased roadmap. From there you fix what the findings point to, using your own team, your existing advisers, RuleExpert’s services, or a mix.

Do we have to buy more services after the assessment?

No. You keep the assessment output whether or not anything else follows. RuleExpert says a DPDP consultant who insists you take all ten services is selling a programme rather than solving your problem.

Which services do most clients add after the assessment?

RuleExpert describes the common pattern as one or two Operate services, usually notices and vendor agreements, with the rest handled in-house.

What do we keep when the engagement ends?

A populated system rather than a report: the register of where personal data sits, the published notices and their versions, the processing agreements, the retention schedules and the audit trail, in your own tenant and exportable.

Do we have to appoint a Data Protection Officer?

Almost certainly not. A formal DPO based in India is required only of a Significant Data Fiduciary. Everyone else must publish contact details for a person who can answer questions, and that can be someone you already employ.

How long is the full programme?

Ninety days: Assess in days 0 to 30, Operate in days 30 to 75, Assure in days 75 to 90, followed by a hand-over in which RuleExpert trains whoever owns it and steps back.

Can RuleExpert work with our existing lawyer or IT provider?

Yes, and RuleExpert says it is usually the better arrangement. They know your contracts and systems, and RuleExpert supplies the machinery, the evidence trail and the specialist reading, and briefs them. Where you would rather not involve anyone else, it can do all of it.

What does it cost?

It depends on the size of your estate and which services you want carried, so RuleExpert scopes rather than quotes a number. It notes that full programmes for Significant Data Fiduciaries are quoted in the tens of lakhs and up, and that most businesses are not in that position.

Who does the work?

Empanelled Indian privacy lawyers, techno-legal consultants who walk and map your operation, and the platform RuleExpert builds and maintains.

Where should we start?

With the free DPDP Scorecard, which takes about five minutes and needs no account, or with a free consultation if you would rather talk it through first.