DPDP readiness assessment

What the engagement delivers

We interview process owners, trace selected data flows and build a requirements register tied to operative dates. Findings identify the affected process, evidence, proposed action and accountable team.

1. Define the entities, products, teams and assessment period.
2. Map selected processing activities with their source systems and owners.
3. Compare supplied evidence with the requirements being assessed.
4. Prepare a prioritised action register with dependencies and unresolved questions.

Distinguish an unavailable record from an observed process gap. The findings should make clear which activities were examined and which remain outside the assessment boundary.

Information to organise

• Data inventory
• product journeys
• vendor list
• notices
• retention schedules
• contracts
• security responsibilities.

Identify operational copies, supplier access and manual exports alongside the main systems. Explain the purpose and retention practice for each selected process. Use examples with personal details removed where possible; the initial evidence request should not become an unnecessary copy of the underlying dataset.

A design or evidence issue to resolve

An organisation may know its main customer database but overlook support tickets, exports and employee spreadsheets. Include those operational copies when deciding where a control must work.

For example, customer records may flow from an application into support and billing tools with different owners. Map those paths and identify how a proposed change would reach each system. A control applied only to the main database may leave the operational copies unchanged.

Boundaries and next steps

This is a scoped readiness assessment, not certification or a guarantee of complete compliance. Technical implementation and detailed contract drafting are separately agreed.

The written scope identifies products, entities, jurisdictions, deliverables and fees. Share an initial description rather than confidential source code or personal datasets through the public enquiry form.

The handover can include the process inventory, evidence-based findings, phased actions and owners. Priorities should explain dependencies on product changes, supplier information or policy decisions. Closing an action requires appropriate implementation evidence; a readiness report alone does not establish that the change was made.