India DPDP Act · Self-Assessment & Implementation Roadmap
A step-by-step guide for your data officer or leadership team
Any data about an individual who is identifiable by or in relation to such data.
Examples include:
Unlike GDPR, the DPDPA does not separately categorise "sensitive personal data" — all personal data is treated similarly.
Think about data protection from every role that manages personal data:
Check all options that apply in each category. The category score is the highest-scored option selected.
Based on your assessment responses
DPDP Rule 6 — recommended measures by risk tier
Consent notices, data processing, sharing, retention & breach obligations
Phase 2: Legal obligations beyond security safeguards