Every DPDP programme should start the same way: find out where you actually stand. A gap assessment turns 'we think we're mostly fine' into a prioritised, evidence-based plan. Here is how to run one.
Step 1: Scope and map
List your systems, data types, purposes and vendors — a first-pass data map. You cannot assess what you cannot see.
Step 2: Test each obligation
Walk the Act and Rules area by area: notices, consent, data-principal rights, grievance redressal, security safeguards, breach readiness, retention, children's data, and vendor contracts. For each, record what exists and what's missing.
Step 3: Check your SDF status
Estimate your data volume and sensitivity to gauge whether you may be a Significant Data Fiduciary, which adds DPO, DPIA and audit duties.
Step 4: Score the risk
Rate each gap by likelihood and impact (including penalty exposure). This is what lets you sequence the work instead of boiling the ocean.
Step 5: Build the roadmap
Turn gaps into a plan with owners and dates — front-door items (notice, consent, cookies) first, then back-door items (security, breach, retention, vendors), then governance (DPO, DPIA, audit). See your first 90 days.
Make it repeatable
Re-run the assessment periodically and after major changes — a new product, a new vendor, a new market. Compliance is a moving target, and the assessment is how you keep aim.
How DPDP Bridge helps
DPDP Bridge's free assessment does exactly this — a structured gap report with your likely SDF status and a prioritised action plan within a few working days. Take the free assessment to see exactly where you stand and what to do next.
This article is general information about the DPDP Act and is not legal advice. For guidance specific to your organisation, take the free assessment or speak to our team.