Answer six classification questions about your business — size (turnover-based), whether you process children's data, health/financial/government ID data, and whether you transfer data outside India. The tool maps your answers to the applicable compliance tier: all entities must address Consent & Notice (Section 6), Data Principal Rights (Sections 11-14), and Data Security (Section 8). Entities processing children's data must add parental consent verification (Section 9). Large enterprises or those processing sensitive categories may be designated Significant Data Fiduciaries, triggering additional obligations including a DPO appointment, DPIAs, and annual audits.

Each checklist item shows the relevant DPDPA section reference and a plain-English explanation of what compliance looks like in practice. The RAG (Red/Amber/Green) status per section lets you quickly identify which areas need the most urgent attention. The penalty exposure estimate provides a directional sense of regulatory risk based on your current completion ratio — not a legal assessment.