Question 1

What is DPDPA compliance maturity?

Accepted Answer

DPDPA compliance maturity measures how systematically an organisation manages its obligations under the Digital Personal Data Protection Act 2023. It covers five domains: consent management, data inventory, data principal rights handling, breach management, and governance.

Question 2

How long does it take to become DPDPA compliant?

Accepted Answer

For most Indian SMEs, building a DPDPA compliance programme from scratch takes 8-16 weeks manually, or 2-4 weeks using purpose-built compliance software like DPDPA Shield.

Question 3

What is the penalty for non-compliance with DPDPA 2023?

Accepted Answer

The DPDPA 2023 penalty schedule specifies: up to Rs 250 crore for failure to safeguard personal data, up to Rs 200 crore for failure to notify a breach to the Data Protection Board, and up to Rs 500 crore for repeat offences.

Question 4

Does DPDPA 2023 apply to small businesses in India?

Accepted Answer

Yes. DPDPA 2023 applies to any person who processes digital personal data in India, regardless of company size, revenue, or number of employees. There is no SME exemption in the Act.

Question 5

What is the first step to comply with DPDPA 2023?

Accepted Answer

The first step is a data inventory — identifying every system, process, and vendor that handles personal data in your organisation. This forms the basis of your Record of Processing Activities (RoPA).

DPDPA Compliance Maturity Assessment