DPDP Gap Assessment: What It Covers, How It Works and How to Read the Results

Ask five organisations whether they have done a DPDP gap assessment and you will hear five different things. One has a spreadsheet of policy checkboxes. One has a consultant’s report written against the draft Rules. One took an online quiz. One has a lawyer’s memo on the Act. One says the IT team has it covered.

Each of those can be useful. None of them is the same as checking what your organisation actually does against what the Act and the Rules actually say, provision by provision, with evidence. That is what a proper DPDP gap assessment is, and it is the difference between knowing your position and believing you know it.

This guide explains what an assessment should cover, how one runs, what it asks of your team, what you should hold at the end, and how to turn the findings into a roadmap. It is written for the people who sign it off: founders, COOs, CFOs, company secretaries, compliance heads and their chartered accountants. If you want the service rather than the explanation, RuleExpert’s DPDP gap assessment does what this guide describes.

1. What Is a DPDP Gap Assessment?

A DPDP gap assessment compares what your organisation actually does with personal data against what the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 require, and lists the differences. The output is a set of findings, each tied to the provision that creates the duty, and a view of what to fix first.

The words “actually does” matter. A gap assessment reads the document, then checks whether the document describes reality. A privacy notice that promises something the checkout page does not do is a finding. A vendor contract that exists but covers a different service from the one now being delivered is a finding. A breach procedure that no one has opened since it was written is a finding.

It also helps to separate it from its neighbours, because the terms get used interchangeably and they are not the same job.

A gap assessment usually comes first, because it tells you which of the others you actually need and in what order.

2. Does the DPDP Act Require One?

No. Nothing in the Act or the Rules uses the phrase, and no provision tells you to commission one.

That does not make it optional in any practical sense, because several duties cannot be met without the knowledge an assessment produces:

• Security safeguards under Section 8(5) cannot be applied to systems you do not know you have.
• Breach notification under Section 8(6) and Rule 7 assumes you can tell whose data was affected and reach them.
• Rights requests assume you can find a person’s data across everything that holds it.
• Erasure under Section 8(7) assumes you know where the copies are.
• For a Significant Data Fiduciary, the annual audit and impact assessment under Rule 13 begin with an inventory. An auditor who arrives to find none will build one first, at your expense.

So the assessment is not a legal requirement. It is the cheapest way to find out whether you can meet the ones that are.

3. Why a Self-Score Is Not Enough

Self-assessment tools have a real use. RuleExpert’s free DPDP Scorecard scores readiness across ten weighted dimensions in about five minutes and shows your exposure in rupees. It takes no account and costs nothing. If you have never looked at your position, it is the right first step, and it tells you how urgent the second one is.

Its limit is built into how it works. It scores what you tell it.

The gap between the two is where most of the value sits. People forget the systems they stopped noticing: the paper register at the front desk, the spreadsheet on one manager’s laptop, the tool a team bought on a company card two years ago. An assessment that reads documents, talks to the teams who hold the data and walks the premises finds them. A quiz cannot, because the person answering the quiz is the same person who forgot them.

In our experience, organisations tend to score themselves higher than the evidence supports. That is not carelessness. It is what happens when you assess yourself from memory.

4. What Should It Cover? The Twelve Areas

A useful assessment is structured around the obligations themselves, not around departments. RuleExpert’s approach covers twelve areas, each read against the provision that creates it and set against the penalty ceiling the Schedule to the Act attaches to it.

A few of these deserve a closer look.

• Processors is usually the longest list. Section 8(2) lets you engage a processor only under a valid contract, and Section 8(1) leaves you responsible for what they do. The vendor count is usually higher than anyone guesses, and the contracts predate DPDP. Our Vendor Governance module and DPA contract review service exist for exactly this.
• Retention cuts both ways. Section 8(7) expects erasure once a purpose is served. But the Rules also require logs, and the personal data they relate to, to be kept for a year under Rule 6, and Rule 8 adds its own retention periods for certain classes of entity. An assessment has to reconcile the duty to delete with the duty to keep, not just count deletion jobs.
• Breach is really three duties. A Data Principal notice without delay, an initial Board alert without delay, and a detailed Board report within 72 hours. Two of the three fall due the moment you become aware. An assessment should test whether you could meet them, which is a different question from whether a procedure exists. Our guide to DPDP breach notification requirements has the detail.
• The SDF row is about probability, not a label. The Act sets no user or turnover threshold. It lists qualitative factors and the Central Government decides, so the assessment should tell you how exposed you are. Our guide to Significant Data Fiduciary obligations explains.

5. How Does an Assessment Actually Run?

The method has four parts, and the order matters.

• Documents. Your notices, policies, vendor contracts and breach procedure are read against the provision each one is meant to satisfy. Most of the findings that get called “legal” turn up here.
• People. Short interviews with the teams who actually hold the data: the front desk, IT, HR, marketing, finance, customer support. This is where you learn what happens on a Tuesday afternoon rather than what the policy says happens.
• A walk-through. Seeing the premises, the forms in use and the systems on screen. It is the visible part of an assessment, and the least of it. The reading is most of the work.
• A Rule 6 review. A technical check of the seven security safeguards that Rule 6 of the DPDP Rules lists, covering encryption or masking, access control, logs and monitoring, backups, log retention, processor clauses and the organisational measures behind them. For most organisations this is the highest-stakes row in the table, with a ceiling of ₹250 crore.

The findings are then scored across the twelve areas, with exposure set against the Schedule. Skip any part and you are buying a questionnaire with a nicer cover.

6. How Long Does It Take, and What Does It Need From You?

RuleExpert’s guide is two to three weeks elapsed for a single location, and about a day of your team’s time in total. Larger or multi-site estates take longer and are scoped rather than quoted off a rate card, because the elapsed time depends on how many places hold data, not on how many people you employ.

What the assessor needs is modest:

• Your current privacy notices, policies and consent wording
• A list of vendors, and whatever contracts you have
• Your breach or incident procedure, if one exists
• An hour with each team that holds personal data
• Access to walk the premises and see the main systems in use

Two things are worth insisting on.

• No questionnaire. Anyone who sends you a form to fill in and returns a score is running a self-assessment on your behalf.
• No copies of your personal data. An assessment needs to know which systems hold which categories of data and who owns them. It does not need the values themselves. A provider holding copies of your customers’ records has made your problem bigger.

Be wary of anyone offering a meaningful assessment in an afternoon. You can check whether a notice exists in an afternoon. You cannot check whether it matches reality.

7. What Should You Keep at the End?

This is the question most buyers forget to ask, and it decides whether the money was well spent. A good engagement leaves you holding five things:

• A personal data register of what you hold, where it sits and who owns it
• Findings by provision, each gap tied to its clause
• A readiness score you can re-run, so progress is visible
• Exposure in order, as a phased remediation roadmap
• A board-ready summary, one page for the people who decide

The key phrase is “that you can re-run”. A score that only exists in a PDF is a photograph. A score that lives in a system you own is a measurement, and you can measure again after you have fixed things. Ask any provider where the register and the score live once the engagement ends, and whether you can export them. RuleExpert’s findings sit in a workspace you own, built on our Data Registry, so the register is a working document rather than an appendix.

If you want to see what this looks like for your organisation, you can scope a DPDP gap assessment with RuleExpert. Start with the free Scorecard if you would like a quick read first.

8. How to Read the Results

A scored list of gaps is only useful if you know what to do first. Three principles help.

• Use the ceilings to order the roadmap, not to forecast a fine. The Schedule sets maximum penalties per contravention: ₹250 crore for security safeguards, ₹200 crore for breach notification and for children’s data, ₹150 crore for SDF duties, and ₹50 crore for the other areas. The Board assesses penalties after an inquiry. Our guide to the DPDP penalty and enforcement structure explains how that works. A notice gap and a security gap are not the same size of problem, and the ceilings tell you so.
• Weigh likelihood as well as size. A high-ceiling area you are unlikely to trigger can wait behind a lower-ceiling area you will trigger next week. Children’s data is a ₹200 crore ceiling, but if you hold no children’s data the finding is short.

Sequence by effort. A workable order for most organisations:

• Fix first: security safeguards and breach readiness, plus children’s data if it applies. These carry the highest ceilings and are the hardest to fix quickly.
• Paperwork next: notices, consent wording, the published contact and the grievance route. Rule 14 asks you to publish a response period for grievances that does not exceed ninety days. These are quick wins with a visible effect.
• Contracts: processor agreements. This is the longest list and needs negotiation, so start early.
• Structural work: retention and deletion, the rights-request flow, cross-border mapping.
• Watch: SDF exposure, which depends on a government decision you cannot control.

Re-run the score. After the first round of fixes, measure again. This is the reason to insist on a re-runnable score.

On timing: the DPDP Rules, 2025 were notified on 13 November 2025, and the core operational provisions, including notice, security safeguards, breach notification and rights, fall within an eighteen-month phased window ending 13 May 2027. Law-firm commentary reported that MeitY consulted in January 2026 on shortening some of those windows for Significant Data Fiduciaries. We found no notified amendment as of writing, so plan against the confirmed date and check MeitY’s notifications for changes.

9. Who Needs One, and When?

The honest answer is almost any organisation that collects personal data in digital form. The triggers that usually turn “eventually” into “now”:

• A client, insurer or investor asks for evidence. A signed policy is not evidence. A scored assessment is.
• A new product, market or vendor changes what you collect or who receives it.
• A transaction is coming, and buyers ask about data protection in diligence.
• You might be notified as a Significant Data Fiduciary. A resident DPO, independent auditor and DPIA programme take time to set up.
• You are in healthcare. Hospitals, clinics and labs sit under extra layers of law. See our guides on healthcare providers and clinics.
• The date is approaching. Two to three weeks for the assessment, plus the time to fix what it finds, has to fit before 13 May 2027.

For directors, CFOs and company secretaries, the board-ready summary is the part that matters most. It turns a technical exercise into a decision you can minute.

10. A 20-Minute First Pass You Can Do Today

You can learn a lot before you hire anyone. Take twelve questions, one per area, and see how many you can answer in a minute each.

• Notice. Can you show every notice a customer sees, and does each stand on its own?
• Consent. Is any optional purpose pre-ticked? Is withdrawing as easy as agreeing?
• Legitimate use. What do you process without asking, and which Section 7 clause covers each?
• Processors. How many vendors touch personal data, and how many have a contract?
• Security. Does everyone log in as themselves? Are logs kept for a year?
• Breach. Who may declare a breach, and where is the notice template?
• Retention. When did you last delete personal data on purpose?
• Contact. Email your published contact address from outside. Does anyone answer?
• Children. Could any of your users be under 18?
• SDF. Do you process large volumes or sensitive categories of data?
• Rights. If a customer emailed “send me my data” today, who would see it?
• Cross-border. Which tools send data outside India?

Every question you cannot answer in a minute is a place to look. That is the assessment, started for free. If most of them stall, a structured one will pay for itself in the time it saves.

11. Mistakes to Avoid

• Treating a questionnaire as an assessment. It measures confidence, not compliance.
• Using a report written against the draft Rules. Numbering changed between the draft and the final Rules. The Significant Data Fiduciary rule, for example, moved from Rule 12 to Rule 13, so an older report may cite the wrong rule.
• Ignoring paper, shadow IT and tools bought on a card. They are the findings you most need.
• Treating penalty ceilings as predictions. Use them to rank, not to forecast.
• Letting the assessor hold copies of your data. It adds risk and adds nothing to the findings.
• Choosing a report over a register. A PDF ages the day it is delivered. A working register does not.
• Starting too late to fix what you find. The assessment is the start of the work, not the end.

12. Frequently Asked Questions

What is a DPDP gap assessment?

A structured comparison of what your organisation actually does with personal data against what the DPDP Act, 2023 and the DPDP Rules, 2025 require, with each finding tied to the provision behind it and ranked by exposure.

Is a DPDP gap assessment mandatory?

No. Neither the Act nor the Rules require one. But duties such as security safeguards, breach notification, rights handling and erasure cannot be met without the knowledge an assessment produces.

How long does a gap assessment take?

RuleExpert’s guide is two to three weeks elapsed for a single location, and about a day of your team’s time in total. Multi-site organisations take longer.

What documents are needed?

Your privacy notices and policies, consent wording, a list of vendors and their contracts, and any breach or incident procedure, plus short interviews with the teams that hold personal data.

Does the assessor need access to our personal data?

No. An assessment needs to know which systems hold which categories of data and who owns them, not the underlying records.

How is a gap assessment different from a free DPDP scorecard?

A scorecard scores what you tell it. A gap assessment reads your documents, speaks to your teams, walks your premises and reviews your security safeguards, so it can find what you forgot.

What areas does a DPDP gap assessment cover?

Twelve: notice, consent, legitimate use, processors, security safeguards, breach notification, retention, the published contact, children’s data, Significant Data Fiduciary duties, rights requests and cross-border transfers.

How do penalties factor into the results?

Each area is set against the maximum penalty the Schedule attaches to it, from ₹250 crore for security safeguards down to ₹50 crore. The ceilings rank the work. They do not predict a fine.

How often should we repeat it?

After the first round of fixes, and again when your systems, vendors or products change materially. A re-runnable score makes that cheap.

Who should own the assessment internally?

Usually the compliance head, company secretary or COO, with the CFO or board sponsoring it. The board-ready summary is meant for the people who approve the roadmap.