Comply DPDPA

Let's start with the basics of privacy leadership and consent.

1. Do you have a designated Data Protection Officer (DPO) or privacy leader?

Yes - We have a dedicated DPO or privacy leader

Partially - Someone handles privacy but not full-time

No - We don't have anyone specifically handling privacy

2. How do you currently collect consent from users?

Granular consent - For each purpose with clear opt-out options

Basic consent - With general terms

No formal process - We don't have a formal consent process

3. Do you have a privacy policy that covers DPDPA requirements?

Comprehensive - Updated policy for DPDPA

Basic policy - Exists but needs DPDPA updates

No policy - No privacy policy or very outdated

Now, let's check your security and risk controls.

4. What level of data security controls do you have in place?

Comprehensive - Encryption, access controls, and monitoring

Basic measures - Some security in place

Minimal - No formal security controls

5. Do you conduct regular data protection impact assessments?

Regular assessments - For high-risk processing

Occasional - When needed

Never - Never conducted impact assessments

6. How do you handle data breaches and incident response?

Formal plan - With notification procedures

Basic procedures - But not formalized

No procedures - No formal breach response

Finally, let's look at transparency and staff awareness.

7. How transparent are you about data processing activities?

Very transparent - Detailed privacy notices and user rights

Somewhat transparent - Basic information provided

Minimal transparency - Limited information about data practices

8. Do you provide privacy training to employees?

Regular training - For all employees handling personal data

Occasional training - For key staff

No training - No privacy training provided

9. How do you handle user rights requests (access, correction, deletion)?

Formal process - Dedicated team and response timelines

Basic process - But not fully formalized

No formal process - No process for handling user rights