DPDPA Readiness Review
A structured operational assessment to establish your organisation's current compliance posture in 10 to 20 working days.
What this engagement is about — and what it is not
The DPDPA Readiness Review is designed for organisations that want an accurate, documented picture of their current operational readiness without committing to a full audit.
It is not a questionnaire. It is not a self-assessment scored against your own responses. It is a structured review of what your systems, notices, vendor relationships, and data handling practices actually look like — measured against the specific requirements of the DPDPA Act 2023 and Rules 2025.
The output is a documented assessment that tells you what is in place, what is missing, and what needs to be addressed first.
This engagement is appropriate for organisations that
Four areas reviewed in every Readiness Assessment
Each area is assessed against the Act's specific operational requirements — not a generic privacy framework.
How consent is collected, recorded, and withdrawn across every data collection point in your product or service. The Act requires consent to be free, specific, informed, and unambiguous — obtained through a notice that is separate from your terms of service. We review whether your collection points meet this standard operationally.
Whether your privacy notice meets the mandatory disclosure requirements under Section 5 of the Act. We review whether your notice addresses each required disclosure specifically and accurately — including the personal data collected, the purpose of processing, how data principal rights can be exercised, and the grievance process.
Which third-party tools and services process personal data on your behalf — and whether Data Processing Agreements exist for each. The Act requires every data processor to operate under a written contract that specifically governs how personal data is handled. We identify every third-party tool in your stack and assess whether adequate contractual arrangements are in place.
How personal data flows through your product and whether the purposes for which it is processed are valid under the Act. We review your data flows against the grounds of processing, and assess whether personal data is being used for purposes that are disclosed, specific, and consistent with what your notice states.
What you receive at the end of the engagement
A single-page summary of the overall operational readiness, the most critical findings, and three immediate priority actions. Designed to be shared with leadership without requiring them to read the full report.
A documented assessment across all four reviewed areas — each finding referenced to the specific Act provision it relates to, with the evidence reviewed and the gap clearly identified.
Every gap identified, documented in a structured register with potential compliance impact mapped per finding. Organised by area and severity so your team can prioritise remediation.
The three highest-priority actions your organisation should take within the next two weeks. Each is specific, operationally clear, and does not require additional analysis to begin.
What this engagement does not cover
The Readiness Review is scoped to provide an accurate governance baseline. Scope boundaries are confirmed during the scoping conversation before work begins.
What a finding looks like in practice
Example of the type of operational finding reviewed during a Readiness Assessment.
During a consent architecture review, we examine how consent is collected across every data collection point. A common finding is a signup flow that presents users with a single checkbox simultaneously accepting the terms of service and providing consent to marketing communications.
Under Section 6(1) of the DPDPA Act 2023, consent must be obtained through a notice that is specific to the purpose of processing and requires an affirmative action. A pre-ticked box does not constitute valid consent — all marketing processing based on this mechanism has no lawful basis.
This finding is documented with a reference to the relevant Act provision, an assessment of the potential compliance impact, and a recommended immediate action.
When to consider the Operational Compliance Audit instead
The Readiness Review establishes your governance baseline. For some organisations, a more comprehensive engagement is appropriate from the outset.
Consider the Operational Compliance Audit if your organisation operates in a sector where DPDPA obligations intersect with other regulatory frameworks — such as fintech, healthcare, or edtech — or has already conducted an informal compliance review and needs a deeper operational assessment across all eight control areas.
Questions about the Readiness Review
Start with a scoping conversation
We will confirm whether the Readiness Review is the right starting point for your organisation — and what the engagement will involve — before anything is agreed.
Book a Scoping ConversationScope and pricing confirmed before work begins. No commitment required.
Written by Viral Maru, Founder — Privara. Last updated: May 2026.