Privacy Compliance Self-Assessment

Step 1 of 20

Organization Profile

Tell us about your organization. This information will appear on your assessment report.

Organization / Company Name *

Industry / Sector

Organization Size (Employees)

Countries / Regions of Operation

Primary Contact Name *

Contact Role / Title

Contact Email *

Contact Phone

Assessment Date

Organisation Website / Domain

Brief Description (auto-filled from website, or type manually)

Step 2 of 20

Privacy Applicability Screening

Determine the scope and nature of personal data your organization processes.

Does your organization collect, use, store, or process personal data of individuals?

Yes No Unsure

Which categories of personal data does your organization process? (select all that apply)

Approximate number of individuals (data subjects) whose data you hold:

Do you process special category or sensitive personal data (health, biometric, financial)?

Yes No Unsure

Step 3 of 20

Privacy Role Determination

Identify whether your organization acts as a Data Controller, Processor, or both — this determines your legal obligations.

ℹ️ Your privacy role determines which legal obligations apply. Answer truthfully — the assessment will determine whether you are a Data Controller, Data Processor, Joint Controller, or a combination.

Does your organization decide WHY personal data is processed (the purpose) and HOW it is processed (the means)?

Yes — we decide purpose and means Sometimes — for some activities No — we follow another entity's instructions

Does your organization process personal data only on the instructions of another organization (a client or principal)?

Yes — we are purely a service provider No

Do you process data on behalf of multiple clients/customers AND also for your own business purposes?

Yes — we play both roles No

Do you jointly determine the purposes of processing with another organization (a partner, affiliate, or co-controller)?

Yes No

Your Determined Privacy Role

Answer questions above

Step 4 of 20

Personal Data Inventory

Assess your data inventory and mapping practices. A complete data inventory is the foundation of privacy compliance.

Do you maintain a documented inventory or register of all personal data your organization processes?

Yes — fully documented Partial — some data sets documented No

For each data set, have you documented the purpose of processing, legal basis, data categories, retention period, and data recipients?

Yes — all elements documented Partial — some elements missing No

Is your data inventory or register reviewed and kept up to date at least annually?

Yes We have an inventory but review it less often No

Have you created data flow maps or diagrams showing how personal data moves within and outside your organization?

Yes Partial — for some processes No

Are data owners or stewards formally assigned for each data category?

Yes Partially — for some categories No

Step 5 of 20

Data Lifecycle Management

Evaluate how personal data is managed from the moment of collection through to secure deletion.

Are your data collection procedures formally documented?

Yes Partial No

Are your data use and processing procedures formally documented?

Yes Partial No

Do you have documented procedures for data archiving?

Yes Partial No

Do you have documented procedures for data deletion and secure destruction (including verification)?

Yes Partial No

Do you operate a data classification scheme (e.g. Public, Internal, Confidential, Restricted)?

Yes Partial — informally applied No

Step 6 of 20

Data Sources

Identify and assess how and where personal data is collected across your organization.

Which channels does your organization use to collect personal data? (select all that apply)

Are all data collection channels documented and linked to your data inventory?

Yes Partial No

Is a privacy notice provided to individuals at each point of data collection?

Yes — at all collection points Partial — at some points No

Do you collect only the minimum personal data necessary for the stated purpose (data minimisation)?

Yes — we formally review data minimisation Partial — informally applied No formal minimisation process

Step 7 of 20

Data Storage

Evaluate where and how personal data is stored, and the security controls protecting it.

Where is personal data stored in your organization? (select all that apply)

On-premises servers / data centres Cloud infrastructure (AWS, Azure, GCP) Third-party SaaS applications (CRM, HRMS, ERP) Local workstations / laptops / desktops Mobile devices Physical files / paper records Removable media (USB, external drives) Email systems

Are all personal data storage locations formally documented and inventoried?

Yes Partial No

Is personal data encrypted at rest across all storage systems?

Yes — encrypted at rest everywhere Partial — for sensitive data only No

Are role-based access controls (RBAC) implemented to restrict access to personal data on a need-to-know basis?

Yes — consistently enforced Partial — some systems No formal access controls

Are data storage locations in India (for DPDPA compliance) or do you store data outside India?

Data stored only within India Data stored outside India Data stored both in and outside India Unsure

Step 8 of 20

Cross-Border Data Transfers

Assess your practices for transferring personal data across national or jurisdictional boundaries.

Does your organization transfer personal data to recipients in other countries or jurisdictions?

Yes No Unsure

Step 9 of 20

Third-Party Management

Evaluate how you manage data processors, sub-processors, and other third-party vendors who access personal data.

Does your organization share personal data with third-party vendors, service providers, or partners?

Yes No

Step 10 of 20

Legal Basis for Processing

Assess whether all processing activities have an identified and documented lawful basis.

ℹ️ Every data processing activity must have a legal basis. Without a documented lawful basis, processing is unlawful under DPDPA, GDPR, and most modern privacy laws.

Have you identified and documented a lawful basis for every personal data processing activity?

Yes — all activities have documented legal bases Partial — some activities documented No

Which legal bases does your organization rely on for processing personal data? (select all that apply)

Consent of the data principal / data subject Contractual necessity Compliance with a legal obligation Protection of vital interests Public task or exercise of official authority Legitimate interests (GDPR) / Deemed consent (DPDPA) Employment law obligations

Are the legal bases for processing disclosed to individuals in your privacy notice?

Yes Partial No

Where you rely on legitimate interests (GDPR) or deemed consent (DPDPA), have you conducted and documented a Legitimate Interests Assessment (LIA)?

Yes Partial No N/A — do not rely on legitimate interests

Step 11 of 20

Individual Rights Management

Evaluate your capability to receive, process, and respond to data subject rights requests within regulatory timeframes.

ℹ️ Under DPDPA 2023, data principals have rights to access, correction, erasure, grievance redressal, and nomination. GDPR adds portability and the right to object. You must have a working process to handle these.

Do you have a documented process for receiving and responding to data subject rights requests?

Yes — formal documented process Partial — ad hoc process No

Which data subject rights does your organization have processes to fulfil? (select all that apply)

Right to access / obtain information about personal data held Right to correction / rectification of inaccurate data Right to erasure / deletion ("right to be forgotten") Right to restrict processing Right to data portability Right to object to processing Right to nominate a person to exercise rights on death / incapacity (DPDPA S.14) Right to grievance redressal (DPDPA S.13) Right to withdraw consent

What is your defined SLA for responding to data subject rights requests?

Within 30 days (DPDPA / GDPR standard) Within 45 days Longer than 45 days No defined SLA

Are rights requests tracked, documented, and auditable?

Yes — tracked in a system/log Partial — informally tracked No

Is there a contact mechanism (email, form, portal) published to individuals for submitting rights requests?

Yes — clearly published Partial — available but not prominent No

Step 12 of 20

Consent Management

Assess how your organization obtains, records, and manages consent for personal data processing.

Does your organization obtain and rely on consent as a legal basis for any personal data processing?

Yes No — we rely on other legal bases only

Step 13 of 20

Data Retention

Evaluate your data retention policies and procedures for disposing of data once it is no longer needed.

Does your organization have a documented Data Retention Policy covering all data categories?

Yes — comprehensive written policy Partial — some categories covered No

Are specific retention periods defined, linked to a legal or regulatory basis, for every data category?

Yes — all categories have justified periods Partial No

Is personal data automatically or systematically deleted / anonymised when its retention period expires?

Yes — automated deletion / anonymisation Partial — manual review process No

Do you have a Legal Hold procedure to suspend deletion when data may be needed for litigation or regulatory investigation?

Yes Partial No

Step 14 of 20

Security Controls

Assess the technical and organisational measures your organisation has implemented to protect personal data.

Do you have a documented Information Security Policy covering personal data?

Yes — formally documented and approved Partial — draft or informal No

Which technical security controls are implemented? (select all that apply)

Which organisational security controls are in place? (select all that apply)

Employee privacy & security training Background checks for staff with data access NDAs / confidentiality agreements with staff Clean desk and clean screen policy Visitor management and physical security BYOD (Bring Your Own Device) policy ISO 27001 or equivalent certification SOC 2 Type II or equivalent report

Do you have a documented Incident Response Plan for security incidents involving personal data?

Yes — tested plan in place Partial — draft / untested No

Step 15 of 20

Privacy Governance

Evaluate your organisation's privacy governance framework, accountability structures, and privacy culture.

Has your organization appointed a Data Protection Officer (DPO) or equivalent privacy lead?

Yes — formally appointed DPO We have a privacy lead (not formally a DPO) No

Does your organization have a publicly available Privacy Policy / Privacy Notice?

Yes — published on website Partial — internal only / outdated No

Have Privacy Impact Assessments (PIAs) or Data Protection Impact Assessments (DPIAs) been conducted for high-risk processing activities?

Yes — for all high-risk activities Partial — for some activities No

Are employees and contractors provided with privacy awareness training?

Yes — mandatory at onboarding and annually Partial — available but not mandatory No formal training

Is Privacy by Design embedded in your product and system development process (new features, projects, systems reviewed for privacy impact before launch)?

Yes — formal Privacy by Design process Partial — informal checks No

Step 16 of 20

AI & Automated Decision Making

Assess your practices around AI systems, profiling, and automated decisions that affect individuals.

Does your organization use AI systems, machine learning models, or automated decision-making that affects individuals?

Yes No Unsure

Step 17 of 20

Breach & Incident Management

Evaluate your capability to detect, contain, respond to, and report personal data breaches.

Do you have a documented Personal Data Breach / Incident Response Procedure?

Yes — tested and documented Partial — draft / untested No

What is your target timeframe for notifying the data protection authority (regulator) of a qualifying breach?

Within 72 hours (GDPR / DPDPA standard) Within 48 hours Within 7 days Other / no defined timeframe

Do you have a process to notify affected individuals when a breach creates a high risk to their rights and freedoms?

Yes Partial No

Do you maintain a Breach / Incident Register logging all incidents (including near-misses and minor incidents, not just notifiable breaches)?

Yes — comprehensive register Partial — notifiable breaches only No

Has your organization experienced a personal data breach in the last 12 months?

Yes No

Step 18 of 20

Applicable Regulations

Identify which privacy and data protection regulations apply to your organisation based on your geography and activities.

ℹ️ Select all regulations that apply to your organization. Your responses, geography, and data subjects' locations determine applicability.

Which data protection / privacy regulations apply to your organization? (select all that apply)

Other applicable regulations or sector-specific rules (e.g. RBI guidelines, IRDAI, SEBI, HIPAA, PCI DSS):

Are you registered with the relevant data protection authority (e.g. notified ICO, registered with DPBI when operational)?

Yes N/A — not required in our jurisdiction No — not yet registered

Do you have a process to monitor regulatory updates (new laws, guidance, enforcement actions) in jurisdictions where you operate?

Yes — formal regulatory monitoring Partial — informal / ad hoc No

Step 19 of 20

Your Compliance Score

Automated compliance score based on your responses across 12 privacy domains.

Your compliance score is calculated across 12 privacy domains based on your responses in Steps 4–18. Each domain is scored out of 5, giving a maximum score of 60.

Score calculating…

Step 20 of 20

Compliance Roadmap & PDF Report

Your personalised compliance roadmap based on identified gaps, and your downloadable PDF report.

Your compliance roadmap highlights priority actions based on gaps identified in your assessment. Address High priority items first to reduce regulatory risk.

Roadmap generating…

Privacy Compliance Self-Assessment

Organization Profile

Privacy Applicability Screening

Privacy Role Determination

Personal Data Inventory

Data Lifecycle Management

Data Sources

Data Storage

Cross-Border Data Transfers

Third-Party Management

Legal Basis for Processing

Individual Rights Management

Consent Management

Data Retention

Security Controls

Privacy Governance

AI & Automated Decision Making

Breach & Incident Management

Applicable Regulations

Your Compliance Score

Compliance Roadmap & PDF Report

📄 Your Privacy Assessment Report is Ready