A linear path from not knowing DPDP exists to a fully maintained programme — eight stops, each mapped to the real services that get you there. It's advisory, not a gate: the point is helping you identify where you are today and what to do next, not forcing you through every step in strict order.
Not every organisation starts at stop one — the self-assessment further down this page is how you find out which stop you're actually at.
Get the 8-stop framework (PDF)Knowing DPDP exists, and its terminology — leadership understands roughly what the Act requires before anything gets built. This is a starting point, not a service on its own — the one thing that turns awareness into action is getting it in front of the people who decide budget and priority.
The real starting point for almost every organisation — an evidence-based read of where current practice actually stands against the Act, scored by exposure and remediation effort. Everything else on this path assumes you know where the gaps actually are first.
Once the gap assessment surfaces which systems and processing activities actually carry risk, each one gets tested properly — asset by asset, confirming whether a full impact assessment is warranted rather than assuming it either way.
Building the actual record of what data you hold and how it flows — RoPA at minimum, or the deeper DPDR/CDJR layer if that's the right fit. Privacy and Security Posture Assessments sit here too: both produce a roadmap as their real output, which is what this whole stop is about — turning findings into a concrete plan.
The technical and organisational foundation gets built: consent architecture designed and deployed, internal policy drafted, and the people who'll actually run it trained on both the code and the governance side.
Attention turns outward — to every vendor and processor relationship, the contracts that govern them, and whether the organisation could actually respond if something went wrong. Data Principal rights-request handling matures here too, alongside DPO-as-a-Service where ongoing operational support is needed.
Training rolls out organisation-wide, not just to the teams who built the foundation. Cross-regulatory obligations get mapped for anyone answering to more than one regulator, and Significant Data Fiduciary status gets addressed directly if it's realistically in view.
Not a level you complete once — an ongoing state. The programme gets sustained through a retained DPO function and an incident-response retainer that keeps the playbook tested through periodic simulations, not filed away after it's built.
Seven questions, same order as the path above. Answer Yes to move to the next one — a No or Maybe stops here and shows your stop right away.
An internal team is in place, with a leadership sponsor accountable for DPDP compliance.
We've completed an evidence-based Gap Assessment against the Act.
DPIAs have been run — or confirmed not warranted — for our processing activities.
RoPA (or the deeper DPDR/CDJR layer) and posture roadmaps are built and current.
Consent lifecycle management and internal governance are operational.
Vendor/processor agreements, rights-request handling and breach-readiness are mature.
Compliance is complete organisation-wide — training rolled out, cross-regulatory and SDF status addressed.
Sent — check your inbox.
This is a quick way to identify your stop, not a perfect one — real progress doesn't always happen in this exact order. Treat it as a starting point; a Gap Assessment gives you the definitive picture.
Rules changes, deadlines, and what they mean for you — no spam, unsubscribe any time.
A directional read on where you actually stand — not a substitute for a Gap Assessment, but a fast way to find your stop.
Take the Self-Assessment →