⚖️ Formal DPDP Audit If Gaps Are Real

Free DPDP Risk Check

This free DPDP audit helps Indian companies identify whether customer data, employee data, vendors, processors, consent flows, breach workflows, and retention practices need deeper review. If the score shows exposure, the next step is a formal Digital Personal Data Protection audit with Kavach Privacy.

β = 0.85x

Pillar 1: Data Architecture & Security Safeguards

Section 8(5) Focus • 35 Points Max
Q1 Section 8(5) Up to ₹250 Crore Weight: 8 pts

Encryption & KMS Key Segregation

Are production databases and object stores encrypted at rest using AES-256 with tenant-isolated or customer-managed encryption keys (CMEK), decoupled from application role policies?

Q2 Section 8(5) Up to ₹250 Crore Weight: 8 pts

Telemetry & Log Scrubbing Pipeline

Are sensitive Indian PII (Aadhaar, PAN, phone numbers, auth tokens, bearer headers) systematically sanitized before logs leave your VPC to Datadog, Sentry, or CloudWatch?

Q3 Section 12(3) Up to ₹50 Crore (General) Weight: 7 pts

Cascade Hard-Erasure Pipeline

When a user requests account deletion, does an event-driven tombstone synchronously trigger hard deletions across read replicas, data warehouses (Snowflake, BigQuery), vector stores, and third-party SaaS?

Q4 Section 8(7) Up to ₹50 Crore (General) Weight: 6 pts

Automated Retention & Purge TTLs

Are raw personal data records in operational caches (Redis), debug snapshots, and temporary S3 buckets bound by automated Time-To-Live (TTL) policies or lifecycle deletion rules?

Q5 Section 8(5) Up to ₹50 Crore (General) Weight: 6 pts

CI/CD Schema Scanners & PII Linting

Does your GitHub/GitLab deployment pipeline run automated linters or static analysis to block pull requests that add unindexed or untagged PII columns without explicit statutory purpose metadata?

Pillar 2: Consent, Notice & Principal Rights

Section 5 & 6 Focus • 35 Points Max
Q6 Section 6(1) Up to ₹50 Crore (General) Weight: 8 pts

Unbundled Purpose-Specific Consent

Are consent checkboxes for core product terms, promotional marketing, and third-party telemetry separated into distinct, unbundled opt-ins with zero pre-ticked defaults?

Q7 Section 5(3) Up to ₹50 Crore (General) Weight: 6 pts

Multilingual Notice in 22 Languages

Is your Section 5 privacy notice accessible in English and all 22 Eighth Schedule languages (Hindi, Tamil, Telugu, Kannada, Bengali, etc.) with a seamless language switcher?

Q8 Section 6(10) Up to ₹50 Crore (General) Weight: 8 pts

Immutable Cryptographic Consent Ledger

Is every consent grant or refusal stored in an append-only ledger with an immutable receipt (UUID, UTC timestamp, SHA-256 notice text hash, and IP/User-Agent)?

Q9 Section 6(4) Up to ₹50 Crore (General) Weight: 7 pts

Symmetric 1-Click Revocation

Can users withdraw consent with the exact same ease and friction as giving it (e.g., 1-click in account settings), without dark patterns, surveys, or mandatory phone calls?

Q10 Section 11(1) Up to ₹50 Crore (General) Weight: 6 pts

Access & Machine-Readable Data Portability

Can your system export all personal data linked to an Indian user in a structured, machine-readable format (JSON/CSV) within statutory SLA (72 hours)?

Pillar 3: Breach Ops, Vendor DPAs & Governance

Section 8 & 33 Focus • 30 Points Max
Q11 Section 8(2) Up to ₹50 Crore (General) Weight: 6 pts

Sub-Processor DPA Coverage

Do contracts with every third-party sub-processor (AWS, Stripe, Twilio, SendGrid, OpenAI) contain mandatory DPDPA-aligned Data Processing Agreements with statutory indemnity clauses?

Q12 Section 8(6) Up to ₹200 Crore Weight: 9 pts

DPBI 72-Hour Breach Alerting Pipeline

Does your security operations team have an automated playbook to notify the Data Protection Board of India (DPBI) and affected Data Principals within the statutory window following a breach?

Q13 Section 8(9) Up to ₹50 Crore (General) Weight: 5 pts

Grievance Redressal Officer Publishing

Is the Data Protection Officer (DPO) / Grievance Officer's full name, email, phone number, and statutory 30-day escalation SLA prominently published on the web and mobile apps?

Q14 Section 16 Up to ₹50 Crore Weight: 5 pts

Vendor Risk & Cross-Border Whitelisting

Are all outbound international data flows mapped against Central Government restricted-country blacklists with signed Standard Contractual Clauses (SCC)?

Q15 Section 14 Up to ₹50 Crore Weight: 5 pts

Nomination Workflow for Incapacity/Death

Does the platform provide an authenticated self-service workflow for users to designate a nominee to exercise data rights in the event of death or incapacity?

● 0 of 15 Answered
Living DPDPA Demo: Immutable Cryptographic Consent Receipt
Section 6(10) Verified
Consent UUID:--
Data Principal:--
Designation:--
Timestamp (UTC):--
Notice SHA-256:--
Purpose 1 (Core):TRANSACTIONAL_FULFILLMENT • Granted (Sec 4(1)(a))
Purpose 2 (Marketing):OPTIONAL_CONSENT • Denied (Default)
KavachPrivacy Executive Assessment Report

Indicative Readiness & Statutory Exposure Evaluation • DPDPA 2023

Discuss on WhatsApp
Compliance Score
0 / 100
Tier 4: Critical Default
Approx. Penalty Value (Exposure)
~₹250 Cr
Indicative estimate (Statutory ceiling: ₹250 Cr)
Industry Architecture
General B2B SaaS
Multiplier M = 0.85x
Mandatory Statutory Disclaimer: This provides indicative penalty exposure estimates based on Schedule 1, DPDPA 2023. It is not legal advice. Actual penalties are determined by the Data Protection Board based on specific circumstances. Consult a qualified DPDPA compliance professional for formal assessment.

Take Action on Your DPDP Assessment

Discuss compliance gaps with our privacy engineering team or receive your complete personalized action report.

📞 Book a Call
📋 View Detailed Technical Appendix & Statutory Breakdown (Optional) ↓ Click to Expand

DPDPA Schedule 1 Statutory Exposure Breakdown

Legal Provision Statutory Obligation & Breach Nature Statutory Ceiling Assessed Exposure

15-Point Architectural Controls Audit Grid

Control ID Statutory Section Engineering Control Architecture Max Score Status