anadi.thakur Talk to Bit
FREE · 13 QUESTIONS · 3 MINUTES

Is your app ready for India's data law?

Thirteen questions about what your product actually does with personal data. Each one maps to an obligation in the DPDP Act or Rules, most of which apply from May 2027. You'll get a readiness score and your gaps, ranked.

  • RUNS IN YOUR BROWSER
  • NOTHING STORED
  • NO SIGN-UP
  1. NOTICE & CONSENT
    01Before you collect personal data, do people see a clear notice listing what you collect and why?

    WHY IT MATTERSA standalone notice in plain language, itemising the data and each purpose, given with the request for consent.

  2. 02Do people consent to each purpose separately, rather than by accepting your terms of service?

    WHY IT MATTERSConsent must be free, specific, informed and given by a clear affirmative action, limited to what each purpose needs.

  3. 03Can people withdraw consent as easily as they gave it, from inside the product?

    WHY IT MATTERSWithdrawing consent must be as easy as giving it, and processing for that purpose stops once it is withdrawn.

  4. 04Do you keep a record of who consented, when, and to which version of the notice?

    WHY IT MATTERSYou must be able to show that consent was given, on the notice that was in force at the time.

  5. USER RIGHTS
    05Can a user get a summary of the personal data you hold about them and who you shared it with?

    WHY IT MATTERSPeople have the right to a summary of their data, the processing done on it, and the parties it was shared with.

  6. 06Can users correct or update their personal data themselves, or by a simple request?

    WHY IT MATTERSPeople have the right to correct, complete and update their personal data.

  7. 07When someone deletes their account, is their data actually erased, including in backups and the tools you send it to?

    WHY IT MATTERSPeople can ask for erasure, and data must be erased once its purpose is served, by you and by anyone processing it for you.

  8. 08Do you publish a contact for privacy questions and complaints, and answer within a set time?

    WHY IT MATTERSYou must publish a contact for privacy questions and run a grievance process with a response deadline set by the Rules.

  9. RETENTION
    09Do you delete personal data once you no longer need it, on a schedule, rather than keeping it forever?

    WHY IT MATTERSData may only be kept as long as its purpose needs; certain large platforms must erase after a set period of inactivity, with notice first.

  10. CHILDREN
    10If people under 18 could use your product, do you get verifiable parental consent and avoid tracking or targeting them?

    WHY IT MATTERSProcessing a child’s data (under 18) needs verifiable parental consent, and tracking, behavioural monitoring and targeted ads at children are prohibited.

  11. SECURITY & BREACH
    11Is personal data encrypted, access-controlled, and are access logs kept for at least a year?

    WHY IT MATTERSReasonable security safeguards are required, including encryption or masking, access control, and logs retained for a year. Failing to take them carries the largest penalties.

  12. 12If there were a data breach tomorrow, would you know, and could you tell users and the Data Protection Board within 72 hours?

    WHY IT MATTERSBreaches must be reported to affected people and the Board without delay, with a detailed report to the Board within 72 hours.

  13. ACCOUNTABILITY
    13Do you know every tool that receives your users’ personal data (analytics, email, payments, AI), with a contract for each?

    WHY IT MATTERSYou stay responsible for data your processors handle, so each needs a valid contract and the same erasure duties.

Questions

Something else? Email me.

What does the DPDP Act require an app to do?

In product terms: show a clear notice and take specific consent per purpose, let people withdraw consent, access, correct and delete their data, erase data when it is no longer needed, protect it with reasonable security safeguards, report breaches to users and the Data Protection Board, and treat under-18 users’ data with verifiable parental consent and no tracking.

Is this self-check legal advice?

No. It is a quick way to see which obligations your product may not meet yet. A lawyer decides what your policy says; the free DPDP audit shows what your product needs to change.

Do you store my answers?

No. The check runs in your browser and nothing is sent anywhere.