How is the DPDPA quiz scored?

Each question maps to a DPDP Act obligation, such as the Section 5 notice, Section 6 consent and withdrawal, prior blocking, Section 9 children's protection, verifiable records and data-principal rights. Your score reflects how many you have in place, weighted by enforcement risk.

Is the DPDPA quiz legal advice?

No. It is a fast self-check that shows where your obvious gaps are against the DPDP Act. It is a useful starting point, not legal advice, and you should confirm specifics with counsel.

Does the DPDP Act require parental consent and an age-gate?

In effect, yes. Section 9 requires verifiable parental consent for users under 18 and bans tracking, behavioral monitoring and targeted advertising directed at children, which means you need an age-gate and a parental consent flow.

What should I do with a low DPDPA score?

Work down the prioritized fixes. Most low scores come from trackers firing before consent, a missing Section 5 notice, or no verifiable consent records, all of which ConsentX addresses out of the box.

Free tool

Are you DPDPA-ready?

Ten quick questions mapped to India's DPDP Act. Get a 0 to 100 readiness score and a section-by-section list of what to fix first.

In short

The DPDPA quiz scores your setup from 0 to 100 against India's Digital Personal Data Protection Act: notice (Section 5), consent and withdrawal (Section 6), prior blocking, children's protection (Section 9), verifiable records, data-principal rights (Sections 11-14), grievance and breach readiness. It then lists the highest-impact fixes first. It is a self-check, not legal advice.

DPDPA self-check

0 / 10

1.Do you give an itemized, plain-language notice (what data, which purposes, how to withdraw, how to complain) before collecting personal data?

2.Is your consent free, specific, informed, unambiguous and captured by a clear affirmative action (not pre-ticked or bundled)?

3.Do you block non-essential trackers and processing until the data principal consents?

4.Can a person withdraw consent as easily as they gave it, with processing stopping promptly after?

5.If minors may use your service, do you verify age and obtain verifiable parental consent, with no tracking or targeted ads at children?

6.Do you keep verifiable consent records you could produce for the Data Protection Board (who consented, to what, when, under which notice)?

7.Can data principals exercise access, correction, erasure and grievance rights through a working request process with deadlines?

8.Does your notice tell people how to raise a grievance and complain to the Data Protection Board?

9.Do you have a breach response that can notify the Board and affected people within the Rules' timelines?

10.Do you delete personal data once its purpose is served (and apply retention limits), rather than keeping it indefinitely?

DPDPA quiz questions

ConsentX

DPDPA quiz questions