Question 1 of 5

Does your business collect, store, or process personal data of individuals (customers, employees, or users)?

Personal data includes names, emails, phone numbers, addresses, payment info, health records, biometric data, or any information that can identify a person.

Question 2 of 5

Do you obtain clear, informed consent from individuals before collecting their personal data?

Under the DPDP Act 2023, consent must be free, specific, informed, and given through a clear affirmative action. Pre-ticked boxes or bundled consent do not count.

Question 3 of 5

Do you have a documented privacy policy that explains what data you collect, why, and how individuals can exercise their rights?

Both the DPDP Act and GDPR require a clear, standalone privacy notice — not buried in terms of service. It must be in plain language and easily accessible.

Question 4 of 5

Do you store or transfer personal data to servers or third parties located outside India?

Cloud services (AWS, Google Cloud, Azure), SaaS tools (Mailchimp, HubSpot, Slack), and international payment processors all involve cross-border data transfer. The DPDP Act restricts transfers to certain countries.

Question 5 of 5

Do you have a documented process for responding to data breaches within 72 hours and notifying affected individuals?

Under both the DPDP Act and GDPR, you must notify the Data Protection Board and affected individuals without undue delay. Not having a breach response plan is itself a compliance violation.