Readiness Program
The 79-control startup audit checklist
The same controls the 14-day program scores you against. Each has a stable ID, the rule behind it, how it is verified (0 can be checked automatically) and the quickest fix.
A readiness aid, not legal advice. Rule citations reflect the DPDP Act 2023 and the DPDP Rules 2025; confirm against the current official text.
| ID | Severity | Area | Rule | Verification | Quick fix |
|---|---|---|---|---|---|
| FC-01 | Critical | Form Consent Form Consent & Notice | DPDP s.6(1)–(2): consent must be free, specific, informed, unconditional, unambiguous, clear affirmative action; GDPR Art. 4(11), 7 | **Auto**: crawl asserts no `checked` attribute / default-true state on any consent control | Remove `checked`; use SDK widget (unset by default) |
| FC-02 | Critical | Form Consent Form Consent & Notice | DPDP s.6(1) "specific"; GDPR Art. 7(2) granularity | **Auto**: detect one consent control referencing >1 purpose (keyword + purpose-count heuristics); **Manual** confirm | Split into one toggle per purpose; remove "I agree to everything" |
| FC-03 | Critical | Form Consent Form Consent & Notice | DPDP s.6(1) "unconditional": consent limited to what is necessary; GDPR Art. 7(4) | **Hybrid**: submit form with all optional purposes off; must succeed | Decouple optional purposes (marketing, analytics, partners) from account creation |
| FC-04 | Critical | Notice Form Consent & Notice | DPDP s.5(1): notice before/with consent listing personal data, purpose, rights, how to complain; Rules: itemised, plain language | **Auto**: notice link present and reachable pre-submit; **Manual** content review vs template (Module 4 §2) | Insert form-linked notice (Module 4); show above consent controls |
| FC-05 | High | Notice Form Consent & Notice | DPDP s.5(3): access in English or any Eighth Schedule language | **Auto**: language switcher exists; locale files complete; **Manual** native-speaker review | Ship Hindi + top-user-base languages via SDK i18n; add `reviewed_by` metadata |
| FC-06 | High | Notice Form Consent & Notice | DPDP s.5(2): notice for processing based on consent given *before* commencement must be given "as soon as reasonably practicable" | **Manual**: legacy-user inventory and re-notice plan | Email/in-app re-notice to legacy base; collect fresh consent for non-s.7 purposes |
| FC-07 | High | Consent Records Form Consent & Notice | DPDP s.6(10): burden of proof on fiduciary; Rules (consent artefacts); GDPR Art. 7(1) | **Auto**: SDK writes record with timestamp, notice version/hash, text hash, language, purposes; hash chain verifies | Deploy consent log (Module 2 §1); backfill what's provable, mark rest "legacy-unproven" |
| FC-08 | High | Consent Records Form Consent & Notice | Tamper evidence (best practice supporting s.6(10)) | **Auto**: `verifyChain()` passes; anchor batch exists in WORM store | Enable append-only DB perms + hourly Merkle anchoring |
| FC-09 | Critical | Withdrawal Form Consent & Notice | DPDP s.6(4)–(6): withdrawal as easy as giving consent; on withdrawal cease processing within reasonable time; GDPR Art. 7(3) | **Hybrid**: count clicks to give vs withdraw; withdraw → verify jobs stop and processors notified | Add persistent "Manage consent" link; wire withdrawal webhooks |
| FC-10 | High | Withdrawal Form Consent & Notice | DPDP s.6(6): consequences of withdrawal borne by principal; cannot penalise | **Manual**: confirm no punitive treatment on withdrawal | Document consequences in notice (e.g., "we will stop emails") |
| FC-11 | High | Dark Patterns Form Consent & Notice | GDPR Art. 5(1)(a)/EDPB dark-pattern guidelines; DPDP unambiguous consent; CCPA regs on consent UX | **Auto**: compare visual prominence of Accept vs Reject (size/colour contrast/position); **Manual** review | Equal-weight buttons; remove nudging copy, countdowns, confirm-shaming |
| FC-12 | Medium | Consent Records Form Consent & Notice | Interaction evidence (supports s.6(10)) | **Auto**: `interaction_ms` captured; flag sub-300 ms bulk grants | Review flagged records; adjust UI if it auto-dismisses |
| FC-13 | High | Consent Managers Form Consent & Notice | DPDP s.6(7)–(9), Rules (registration of Consent Managers; operative after phase-in) | **Manual**: decide whether to accept consent via registered Consent Manager | Plan API interop when registry opens; no action pre-launch |
| FC-14 | High | Legitimate Use Form Consent & Notice | DPDP s.7: reliance must fit enumerated uses | **Manual**: per-purpose basis memo signed by Legal Reviewer | Anything outside s.7 (marketing, analytics, cross-selling) → move to consent |
| FC-15 | Medium | Notice Versioning Form Consent & Notice | DPDP s.5; GDPR Art. 13(3) | **Auto**: notice changes bump version; re-consent triggered on material change | Add changelog + SDK `noticeVersion` bump pipeline |
| CH-01 | Critical | Children Children & Special Handling | DPDP s.9(1): verifiable parental/guardian consent for under-18; Rules (verification methods) ; GDPR Art. 8 (13–16 by member state) | **Hybrid**: age-gate present where children plausibly use; flow tested | Add age screen; implement DigiLocker/virtual-token or existing-verified-parent method |
| CH-02 | Critical | Children Children & Special Handling | DPDP s.9(3): no tracking, behavioural monitoring or targeted advertising directed at children | **Auto**: trackers/ad pixels disabled for child-flagged sessions | Conditional script loading by `is_child` |
| CH-03 | High | Children Children & Special Handling | DPDP s.9(2): no processing likely to cause detrimental effect | **Manual** DPIA-lite on features used by minors | Disable risky features (public profiles, location) for minors |
| CH-04 | Medium | Special Data Children & Special Handling | DPDP has no "special category" tier, but SDF/risk and GDPR Art. 9 apply | **Manual**: biometric/health/financial data identified in sensitive register | Apply stricter access, encryption, retention; GDPR Art. 9(2) condition recorded |
| DM-01 | High | Minimization Data Minimization & Retention | DPDP s.6(1) (only data necessary for specified purpose); GDPR Art. 5(1)(c) | **Hybrid**: each form field maps to a purpose in the register; unmapped fields flagged | Drop or make optional; delay collection until needed (progressive profiling) |
| DM-02 | High | Minimization Data Minimization & Retention | DPDP s.5/s.6 purpose limitation; GDPR Art. 5(1)(b) | **Manual**: purpose register vs. actual use (analytics queries, ML training) | Add purpose tags to data warehouse; block secondary use without fresh consent |
| DM-03 | High | Retention Data Minimization & Retention | DPDP s.8(7): erase when purpose served / consent withdrawn unless law requires retention; GDPR Art. 5(1)(e) | **Auto**: age-of-data query vs. schedule (counts only) | Implement scheduled deletion jobs; document legal holds |
| DM-04 | Medium | Retention Data Minimization & Retention | Rules: fiduciaries of certain classes (e-commerce, online gaming, social media above user thresholds) erase after 3 years of inactivity with 48-hr prior notice | **Manual**: determine if class applies; if yes **Auto** inactivity job | Build inactivity detector + warning email |
| DM-05 | High | Retention Data Minimization & Retention | Rules: retain logs & personal data traces ≥ 1 year for investigation | **Auto**: log retention config ≥ 365 days | Set CloudWatch/Stackdriver retention; archive to cold storage |
| DM-06 | Medium | Minimization Data Minimization & Retention | Aadhaar-specific: Aadhaar Act & UIDAI rules; don't store full Aadhaar number unless authorized | **Auto**: regex+Verhoeff scan on schemas/logs; **Manual** | Use masked/virtual ID or tokenization; delete raw numbers |
| DM-07 | Medium | Minimization Data Minimization & Retention | GDPR Art. 25 privacy by design | **Manual**: design-review record for new features | Add privacy checklist to PR template |
| DM-08 | High | Logging Data Minimization & Retention | GDPR Art. 5(1)(f), DPDP s.8(5); SOC 2 C1.1 | **Auto**: log scan finds PII in app logs | Add log scrubbing middleware; rotate leaked tokens |
| DR-01 | Critical | Rights: Access Data Principal Rights & Grievance | DPDP s.11; GDPR Art. 15; CCPA §1798.110/.115 | **Auto**: DSR e2e test files ACCESS request; summary returned, with processors and consent history | Deploy DSR portal + connectors |
| DR-02 | Critical | Rights: Correction Data Principal Rights & Grievance | DPDP s.12(1); GDPR Art. 16; CCPA §1798.106 | **Auto**: e2e correction propagates to all systems | Webhook propagation + ack tracking |
| DR-03 | Critical | Rights: Erasure Data Principal Rights & Grievance | DPDP s.12(3); GDPR Art. 17; CCPA §1798.105 | **Auto**: erasure probe across DB, search, analytics, vendors | Implement erase connectors; crypto-shred for backups |
| DR-04 | High | Rights: Nomination Data Principal Rights & Grievance | DPDP s.14 | **Manual**: process exists to let principal nominate a representative | Add nominee field in account settings; document handling on death/incapacity |
| DR-05 | Critical | Grievance Data Principal Rights & Grievance | DPDP s.8(9): publish business contact of person answering questions; s.13 grievance mechanism; Rules: respond within 90 days max | **Auto**: contact present in notice, footer and widget; **Manual** monitored mailbox test | Publish named role + monitored mailbox; set SLA ≤ 30d |
| DR-06 | High | Grievance Data Principal Rights & Grievance | DPDP s.13(3): principal must exhaust grievance process before approaching Board | **Manual**: closure letters mention Board | Add Board language to templates |
| DR-07 | High | Identity Data Principal Rights & Grievance | GDPR Art. 12(6); DPDP general security | **Manual**: verification method doesn't collect new sensitive IDs | OTP to existing contact |
| DR-08 | Medium | Rights Metrics Data Principal Rights & Grievance | SOC 2 P5/P6 | **Auto**: DSR SLA dashboard | Monthly report |
| DR-09 | High | CCPA Data Principal Rights & Grievance | CCPA §1798.120/.135: "Do Not Sell or Share" link; GPC honoured (if CCPA applies) | **Auto**: GPC test suppresses trackers | Add link + GPC handler |
| DR-10 | Medium | Portability Data Principal Rights & Grievance | GDPR Art. 20 | **Auto**: export in JSON/CSV | Add export endpoint |
| SE-01 | Critical | Encryption Security Safeguards (DPDP s.8(5), GDPR Art. 32, SOC 2 Security) | DPDP Rules: encryption/obfuscation/masking/tokens; GDPR Art. 32(1)(a); SOC 2 CC6.1 | **Auto**: cloud posture, DB/volume/bucket encryption flags | Enable KMS encryption; rotate keys annually |
| SE-02 | Critical | Transit Security Safeguards (DPDP s.8(5), GDPR Art. 32, SOC 2 Security) | Rules; SOC 2 CC6.7 | **Auto**: TLS ≥ 1.2, HSTS, no mixed content (testssl) | Enforce at LB/CDN; HSTS preload |
| SE-03 | Critical | Access Control Security Safeguards (DPDP s.8(5), GDPR Art. 32, SOC 2 Security) | Rules: control of access to computer resources; SOC 2 CC6.1–6.3 | **Auto**: IAM review (wildcards, root keys, stale users); **Manual** quarterly access review | Least-privilege roles; remove stale accounts |
| SE-04 | Critical | Authentication Security Safeguards (DPDP s.8(5), GDPR Art. 32, SOC 2 Security) | SOC 2 CC6.1 | **Auto**: MFA enforced for admin/cloud/repo/email | Enforce SSO+MFA org-wide |
| SE-05 | High | Monitoring Security Safeguards (DPDP s.8(5), GDPR Art. 32, SOC 2 Security) | Rules: visibility on access; logs; SOC 2 CC7.2 | **Auto**: audit logs on (CloudTrail etc.), alerting rules exist | Enable and route to SIEM/Slack |
| SE-06 | High | Backups Security Safeguards (DPDP s.8(5), GDPR Art. 32, SOC 2 Security) | Rules: continued processing in event of compromise; SOC 2 A1.2 | **Hybrid**: backup config + restore test evidence | Quarterly restore test; immutable backups |
| SE-07 | High | Vulnerability Mgmt Security Safeguards (DPDP s.8(5), GDPR Art. 32, SOC 2 Security) | SOC 2 CC7.1 | **Auto**: SCA/DAST/SAST results; critical CVEs patched ≤ 15 days | Dependabot/Renovate; SLA policy |
| SE-08 | High | Secure SDLC Security Safeguards (DPDP s.8(5), GDPR Art. 32, SOC 2 Security) | SOC 2 CC8.1 | **Hybrid**: PR reviews required, branch protection, CI checks | Enable branch protection + required reviews |
| SE-09 | Medium | Endpoint Security Safeguards (DPDP s.8(5), GDPR Art. 32, SOC 2 Security) | SOC 2 CC6.8 | **Manual**: disk encryption/MDM attestations | Enrol devices; screen lock; remote wipe |
| SE-10 | High | Web Security Security Safeguards (DPDP s.8(5), GDPR Art. 32, SOC 2 Security) | OWASP ASVS L1; SOC 2 CC6.6 | **Auto**: security headers, cookie flags, CSP | Add headers via CDN/middleware |
| SE-11 | Critical | Secrets Security Safeguards (DPDP s.8(5), GDPR Art. 32, SOC 2 Security) | SOC 2 CC6.1 | **Auto**: secret scanning repo + history | Rotate leaked secrets; move to secrets manager |
| SE-12 | Medium | Physical/Remote Security Safeguards (DPDP s.8(5), GDPR Art. 32, SOC 2 Security) | SOC 2 CC6.4 | **Manual**: cloud-only attestation / co-working policy | Document |
| SE-13 | High | Data Segregation Security Safeguards (DPDP s.8(5), GDPR Art. 32, SOC 2 Security) | SOC 2 C1.1; multi-tenant leakage | **Manual** + test tenant isolation | Row-level security tests |
| SE-14 | Medium | Pen Test Security Safeguards (DPDP s.8(5), GDPR Art. 32, SOC 2 Security) | SOC 2 CC4.1 | **Manual**: annual third-party pen test report | Book CREST/CERT-In empanelled tester |
| BR-01 | Critical | Breach Notification Breach Notification & Incident Response | DPDP s.8(6): notify Board and each affected Data Principal; Rules: without delay, detailed report to Board within 72 hours; GDPR Art. 33/34 (72 hrs) | **Manual**: IR plan has clocks, templates, decision tree; tabletop evidence | Adopt Day-11 pack; name Incident Commander |
| BR-02 | High | Breach Breach Notification & Incident Response | CERT-In Directions 2022: report specified incidents within 6 hours; keep ICT logs 180 days in India | **Manual** + **Auto** (log region/retention) | Add CERT-In contact to runbook; store logs in India region |
| BR-03 | High | Breach Breach Notification & Incident Response | Sector regulators (RBI, SEBI, IRDAI) if regulated | **Manual** applicability memo | Add regulator timelines to IR plan |
| BR-04 | High | Detection Breach Notification & Incident Response | SOC 2 CC7.3–7.4 | **Auto**: alert test fires end-to-end | Tune alerts; on-call rota |
| BR-05 | Medium | Processor Duty Breach Notification & Incident Response | DPDP s.8(2); GDPR Art. 33(2): processor must notify promptly | **Manual**: DPAs include ≤ 24–48 hr breach notice | Update DPAs (Module 4) |
| BR-06 | Medium | Post-Incident Breach Notification & Incident Response | SOC 2 CC7.5 | **Manual**: after-action report template exists | Run annual tabletop |
| XB-01 | High | Cross-Border (Outbound from India) Cross-Border Transfers & Vendors | DPDP s.16: permitted except to countries restricted by Central Government notification; sectoral stricter laws prevail (e.g., RBI payment data localisation) | **Hybrid**: `transfer-map` + check against current notified list | Maintain transfer register; avoid restricted regions; keep RBI payment data in India |
| XB-02 | High | Cross-Border (EU → India) Cross-Border Transfers & Vendors | GDPR Art. 44–46: India has no adequacy decision; SCCs (2021/914) + TIA required | **Manual**: executed SCCs in customer DPAs | Include SCC Module 2/3 annex (Module 4 §1) |
| XB-03 | Medium | Cross-Border (UK) Cross-Border Transfers & Vendors | UK GDPR: IDTA or UK Addendum | **Manual** | Attach UK Addendum |
| XB-04 | High | Processor Contracts Cross-Border Transfers & Vendors | DPDP s.8(2): processor only under valid contract; GDPR Art. 28 | **Hybrid**: vendor register: DPA signed flag | Chase DPAs; swap vendors lacking DPAs |
| XB-05 | Medium | Sub-processors Cross-Border Transfers & Vendors | GDPR Art. 28(2),(4) | **Manual**: published sub-processor list + change notice mechanism | Create `/subprocessors` page with RSS/email notify |
| XB-06 | Medium | Vendor Risk Cross-Border Transfers & Vendors | SOC 2 CC9.2 | **Manual**: annual review of critical vendors' SOC2/ISO reports | Calendar + register |
| XB-07 | Medium | Data Location Cross-Border Transfers & Vendors | Procurement requirement | **Auto**: cloud-map regions | Prefer ap-south-1/asia-south1 for Indian principals' data |
| XB-08 | Medium | Pixel/Third-party Sharing Cross-Border Transfers & Vendors | CCPA "share"; DPDP s.6 specific consent | **Auto**: tracker report vs. consent | Gate behind consent; remove unneeded pixels |
| GV-01 | High | Accountability Governance, Accountability & SDF | DPDP s.8(1): fiduciary responsible for compliance incl. processors | **Manual**: policy set approved by founder | Adopt Module 4 policies |
| GV-02 | High | Governance Governance, Accountability & SDF | SOC 2 CC1.x | **Manual**: org chart, roles, code of conduct acknowledged | Annual acknowledgement |
| GV-03 | High | Training Governance, Accountability & SDF | SOC 2 CC1.4, GDPR Art. 39 | **Manual**: training attendance (Day 13) | Annual refresher + onboarding module |
| GV-04 | High | RoPA Governance, Accountability & SDF | GDPR Art. 30; DPDP best practice for s.8(1) evidence | **Auto/Manual**: RoPA exists, updated ≤ 6 months | Quarterly review |
| GV-05 | High | SDF Governance, Accountability & SDF | DPDP s.10: DPO in India, independent data auditor, periodic DPIA (if notified) | **Manual**: triage memo | If likely SDF: appoint, schedule audit |
| GV-06 | Medium | DPIA Governance, Accountability & SDF | GDPR Art. 35 | **Manual**: DPIA for high-risk (biometrics at scale, profiling) | Use Day-12 template |
| GV-07 | Medium | EU Rep Governance, Accountability & SDF | GDPR Art. 27 | **Manual**: representative appointed if applicable | Engage representative service |
| GV-08 | Medium | Accuracy Governance, Accountability & SDF | DPDP s.8(3): ensure completeness, accuracy, consistency when used for decisions or disclosure | **Manual** | Validation on forms; correction path |
| GV-09 | Medium | Disclosure Governance, Accountability & SDF | DPDP s.8(2)–(3) | **Manual**: data-sharing register | Each disclosure has recipient + purpose |
| GV-10 | Low | Risk Register Governance, Accountability & SDF | SOC 2 CC3.x | **Manual**: living risk register | Quarterly review |
| GV-11 | Medium | Change Mgmt Governance, Accountability & SDF | SOC 2 CC8.1 | **Auto**: PR-linked change record | Template |
| GV-12 | Medium | Availability Governance, Accountability & SDF | SOC 2 A1.1 | **Auto**: uptime monitoring + status page | Add status page; SLOs |
| GV-13 | Medium | Confidentiality Governance, Accountability & SDF | SOC 2 C1.1–1.2 | **Manual**: NDA templates, data classification policy | Adopt classification (Public/Internal/Confidential/Restricted) |
| GV-14 | Medium | Claims Hygiene Governance, Accountability & SDF | Consumer Protection Act 2019; ASCI guidelines (misleading claims) | **Manual**: all public "compliant/secure" claims reviewed | Replace absolute claims with dated, scoped statements |
Want these scored for you?
The 14-day program scores every control with automated checks, then helps you close the gaps.