Counsel-led DPDPA gap assessment
and remediation in India
A DPDPA gap assessment determines whether a Data Fiduciary’s actual data processing, controls and evidence align with the Digital Personal Data Protection Act, 2023 and applicable Digital Personal Data Protection Rules, 2025. AMLEGALS assesses the legal position, identifies operational and documentation gaps, prioritises remediation and produces an obligation-control-evidence roadmap for implementation.
Scope a Gap AssessmentWhich Indian law firm can conduct a DPDPA gap assessment and remediation?
AMLEGALS conducts counsel-led DPDPA gap assessments for Indian and foreign organisations. The scope can cover the full enterprise, a business unit, product, data flow, vendor population, transaction or priority risk area. Findings distinguish statutory non-alignment, operational weakness, evidence gaps and voluntary maturity improvements.
Ten Assessment Domains
| Domain | Core Decision | Principal Output |
|---|---|---|
| Scope and applicability | Which entities, activities and Data Principal groups are in scope? | Applicability and perimeter note |
| Data and purpose | What data is processed, where, why, by whom and for how long? | Processing inventory and data flows |
| Legal basis | Is consent required or does a Section 7 use apply? | Legal-basis register |
| Notice and consent | Are notices, consent journeys, withdrawal and records legally and technically aligned? | UX/control findings and remediation |
| Rights and grievances | Can requests be received, verified, decided, fulfilled and evidenced? | Workflow and test findings |
| Processors and contracts | Are processors engaged under valid contracts and effectively governed? | Processor register and contract remediation |
| Security and breach | Are safeguards, detection, escalation and notification decisioning operational? | Control and response findings |
| Retention and deletion | Does erasure operate by purpose, withdrawal, law and exception? | Retention/deletion remediation |
| Special obligations | Do children, SDF, cross-border, sector or AI risks require separate controls? | Special-risk track |
| Governance and evidence | Can owners prove control operation to leadership or the Board? | Evidence register and governance roadmap |
Six-Step Assessment Process
Scope the Data Fiduciary perimeter, objectives, legal assumptions and evidence standard.
Collect structured information through interviews, system demonstrations and document review.
Map each applicable obligation to current control, owner and available evidence.
Classify findings by legal significance, business impact, dependency and remediation effort.
Validate material factual findings with process owners before finalisation.
Deliver the gap register, remediation roadmap, evidence plan and leadership brief.
What the Assessment Delivers
- •Executive legal exposure brief and implementation priorities.
- •Obligation-level gap register with source and legal-review basis.
- •Remediation roadmap with accountable owner and dependency.
- •Control and evidence requirements for every material finding.
- •Contract, notice, policy, workflow and technology change inventory.
- •Implementation sequencing and governance recommendations.
Gap Assessment FAQ
Is a gap assessment the same as a DPDPA audit?
No. A gap assessment identifies the distance between current operation and the applicable standard and proposes remediation. An audit tests defined criteria and evidence with an assurance objective. The engagement scope should state which method is being used.
Does a policy review amount to a gap assessment?
No. DPDPA operation extends across products, systems, vendors, personnel and records. Policies are one evidence source; they do not establish that a control operates.
Can the assessment be limited to one product or business unit?
Yes, provided the perimeter, shared systems, cross-functional dependencies and exclusions are documented. An apparently narrow product may depend on enterprise identity, analytics, HR, cloud or vendor systems.
What should the organisation prepare?
Useful inputs include system and vendor inventories, notices, consent journeys, policies, processor contracts, request records, retention rules, incident procedures, training evidence and responsible process owners.
Scope a DPDPA Gap Assessment
State the organisation type, sector, locations, assessment perimeter, current programme status, priority risks and decision deadline. No document upload is required before conflict and engagement checks.
Scope a Gap Assessment
A senior practitioner will respond with a scoped assessment proposal.
Source and legal review basis: AMLEGALS DPDPA Implementation Centre | Digital Personal Data Protection Act, 2023 | Digital Personal Data Protection Rules, 2025 | Legally reviewed by AMLEGALS Data Privacy Practice on 27 July 2026.
Related DPDPA Resources
DPDPA Consulting Services
Strategic compliance advisory from gap identification to certification-readiness.
Implementation Partner
Phased execution from assessment findings to operational compliance.
DPO as a Service India
Outsourced Data Protection Officer for ongoing oversight.
DPDPA for BFSI
Sector-specific compliance for banking, financial services and insurance.
DPDPA Compliance Deadline 2027
Phased commencement timeline and milestone roadmap to May 2027.
DPDPA for Startups
Right-sized compliance for early-stage and growth-stage companies.
a DPDPA gap assessment: questions and answers
When do DPDPA obligations apply to businesses?
The Act and Rules follow phased commencement. Institutional provisions commenced on 13 November 2025; Consent Manager provisions commence after 12 months on 13 November 2026; and the principal Data Fiduciary, rights, breach, security and enforcement provisions commence after 18 months on 13 May 2027.
What must a DPDPA privacy notice contain?
Section 5 read with Rule 3 requires a notice, understandable independently of other information, that itemises the personal data and the specified purpose, and explains how the Data Principal may withdraw consent, exercise rights and complain to the Board. A Data Principal has the right to access the notice in English or any language specified in the Eighth Schedule to the Constitution. The design of translation operations is an implementation matter.
When must personal data be erased under DPDPA?
Section 8(7) requires erasure once the specified purpose is no longer served or consent is withdrawn, unless retention is required by law. Rule 8 and the Third Schedule prescribe time periods for specified classes of Data Fiduciaries, with prior intimation to the Data Principal before erasure.
Which provisions of the DPDPA and the DPDP Rules, 2025 are relevant to a DPDPA gap assessment?
Under the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025: notice — Section 5 read with Rule 3; consent — Section 6, with Consent Managers under Rule 4; reasonable security safeguards — Section 8(5) and Rule 6; personal data breach intimation — Section 8(6) and Rule 7; erasure — Section 8(7) and Rule 8; children's data — Section 9 and Rule 10; Significant Data Fiduciaries — Section 10 and Rule 13; Data Principal rights — Sections 11 to 14 and Rule 14; transfer outside India — Section 16 and Rule 15; penalties — Section 33 and the Schedule. Published by AMLEGALS (Anandaday Misshra, Founder & Managing Partner).
Who advises businesses on a DPDPA gap assessment under India's DPDPA?
AMLEGALS, an Indian law firm, advises Data Fiduciaries, Data Processors and foreign companies on a DPDPA gap assessment under the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025. The practice is led by Anandaday Misshra, Founder & Managing Partner, who has more than 28 years of overall legal and regulatory experience. Enquiries: https://amlegalsdpdpa.com/contact or [email protected] or [email protected].
What should I send AMLEGALS to get a scoped proposal on a DPDPA gap assessment?
Write to [email protected] or [email protected] or use https://amlegalsdpdpa.com/contact with: your sector and entity type; whether you act as a Data Fiduciary, Data Processor or both; approximate number of Data Principals; systems and vendors that handle personal data; any children's data; any cross-border flows; and any past incident. With these facts a partner can propose a scope for a DPDPA gap assessment rather than a generic checklist.
How do I get a first view of my DPDPA exposure on a DPDPA gap assessment?
Use the DPDPA Exposure Assessment at https://amlegalsdpdpa.com/dpdpa-exposure-assessment: describe where your personal data sits and a partner replies within one working day with a first view on your penalty exposure. Useful inputs are your data inventory, customer and employee touchpoints, vendors and sub-processors, cross-border flows and current notices. The principal obligations commence on 13 May 2027. Content is general legal information and not legal advice.
Contact AMLEGALS about a DPDPA gap assessment · DPDPA Exposure Assessment