Meetanshi AI
Free preparation checklist

DPDP Store Readiness Quiz

Ten questions to find gaps in your Shopify or Magento store's preparation. Get a score and a checklist you can act on.

Self-reported, not a scan. No signup, API key or customer data needed.

Answer from evidence, not intention

Yes = 2 points, Partly = 1, No / Not sure = 0. All questions carry equal weight. The critical flags below are our preparation priorities, not a statutory rating. If a special obligation does not apply, answer Yes only after a documented applicability review.

Your answers are processed locally and are not saved by this tool. Site analytics may record page visits.

Have you mapped the personal data your store and apps process?

1. Have you mapped the personal data your store and apps process?

Critical topic

Include checkout, accounts, support, cookies, pixels, cart emails and vendors. Keep an owner for each data flow.

Reference: Act sections 4 and 8; Rule 3

Has each purpose's legal basis been reviewed?

2. Has each purpose's legal basis been reviewed?

Critical topic

Separate consent-based uses from section 7 certain legitimate uses. Do not assume one checkbox covers every purpose.

Reference: Act sections 4, 6 and 7

Are clear, separate notices ready at each consent point?

3. Are clear, separate notices ready at each consent point?

Critical topic

List the data and specific purpose, withdrawal and rights route, contact and Board complaint means. A footer policy alone is not enough.

Reference: Act sections 5-6; Rule 3

Have optional choices and withdrawal been tested?

4. Have optional choices and withdrawal been tested?

Critical topic

Test decline, accept and withdrawal for analytics, pixels, cart reminders and marketing. Do not bundle optional uses with checkout.

Reference: Act section 6

Are vendor roles and processor contracts documented?

5. Are vendor roles and processor contracts documented?

Check hosting, payment, fulfilment, email and apps. Record what each provider receives, where it processes data and how it deletes it.

Reference: Act sections 8(2) and 16; Rules 6 and 15

Are retention and erasure workflows ready?

6. Are retention and erasure workflows ready?

Cover store copies, processors and backups. Identify lawful record-retention needs rather than inventing one universal period.

Reference: Act section 8(7); Rule 8

Can customers exercise rights and raise grievances?

7. Can customers exercise rights and raise grievances?

Publish request routes and identity checks, authorised contact details and grievance response period. Rule 14(3)'s 90-day limit concerns grievances.

Reference: Act sections 11-14; Rules 9 and 14

Have security and breach workflows been tested?

8. Have security and breach workflows been tested?

Critical topic

Check access control, encryption or equivalent safeguards, logging, backups and processor controls. Assign breach-response owners.

Reference: Act sections 8(4)-8(6); Rules 6-7

Have you reviewed children, guardians and special obligations?

9. Have you reviewed children, guardians and special obligations?

A child is under 18 under the Act. Confirm whether child/guardian, sector, Significant Data Fiduciary or other special rules apply, with reasons if not applicable.

Reference: Act sections 9-10; Rules 10-13

Do you have an owner, evidence and a phased rollout plan?

10. Do you have an owner, evidence and a phased rollout plan?

Recheck official commencement notifications. Core processing duties and most operational Rules start eighteen months after November 2025 Gazette publication.

Reference: Act commencement G.S.R. 843(E); Rule 1 and corrigendum

Sources and scope

Checked October 12, 2026. Core processing obligations and most operational Rules start eighteen months after November 2025 Gazette publication; some start earlier. Recheck the official notifications and obtain advice for your own applicable dates and special obligations.

Frequently asked questions

Does a high score mean my store complies with DPDP?

No. This is a self-reported preparation score, not a legal compliance percentage, certificate or store audit. We do not inspect your notices, scripts, vendors or evidence. Even a full score needs legal review and testing.

How is the score calculated?

Every question has equal weight: Yes earns 2 points, Partly 1, and No or Not sure 0. All ten questions must be answered. Topics flagged as critical are editorial priorities, not statutory risk ratings. Any critical gap remains visible regardless of the total score.

Does the quiz scan my Shopify or Magento store?

No. There is no URL scan, AI API or form submission. Answers stay in this browser session and are not saved by this tool. Standard site analytics may record page visits.

What should I do with the checklist?

Give it to your store owner, technical team and qualified legal adviser. Confirm applicability, map real data flows, fix gaps, test controls and keep evidence. Use the policy generator for drafting text, not implementing controls.

Are all DPDP provisions in force now?

No. Commencement is phased. Core processing provisions and most operational Rules start eighteen months after November 2025 Gazette publication; some provisions start earlier. Check the official notifications for the provisions relevant to your store.

DPDP policy and notice draftsTerms & Conditions draftAll free tools