DPDPA Maturity Model vs Gap Assessment: Which One Do You Need First?
Both tools answer “where do we stand on DPDP compliance?” But they answer it differently, and running them in the wrong order usually costs a quarter. This piece sets out what a DPDPA maturity model and a gap assessment each measure, where each one misleads you, and the sequence we see work in Indian companies preparing for the DPDP Rules 2025.
Quick answer: a gap assessment compares you against the Act’s requirements, obligation by obligation: in place, partial or missing. A maturity model rates how well and how repeatably you meet each obligation, on a scale. Run the gap assessment first. Move to a maturity model once the gaps are closed and you need to show that controls keep working.
DPDPA maturity model vs gap assessment at a glance
| Gap assessment | Maturity model | |
|---|---|---|
| Question it answers | Which DPDP obligations are we not meeting? | How reliably do we meet each one, and is it improving? |
| Scoring | In place / partial / missing | A level on a ladder, usually five steps |
| Main output | A prioritised remediation list with owners and dates | A per-capability score and an improvement roadmap |
| Evidence it needs | Does the policy, process or control exist? | Does it run every time, and can you prove it? |
| Best moment | Programme start, or before a Rules deadline | After remediation, for boards and auditors |
| Cadence | Once, then after major change | Quarterly or half-yearly |
| Typical owner | DPO or compliance lead, often with legal counsel | DPO with process owners in each function |
| Where it misleads | A spreadsheet and an automated workflow both score “in place” | A high score on a capability you never needed hides a real gap elsewhere |
What a DPDP gap assessment actually checks
A gap assessment walks the obligations in the Digital Personal Data Protection Act, 2023 and the Rules notified in November 2025, and marks each one. The areas that matter for almost every Data Fiduciary:
- Notice and consent: is every collection point backed by a clear, itemised notice, and is consent specific to a purpose and as easy to withdraw as it was to give?
- Lawful basis: for processing that does not rely on consent, is the legitimate use documented?
- Records: do you know what personal data you hold, why, where it sits and who receives it? Without a record of processing activities, every other answer is a guess.
- Security safeguards: encryption or masking, access control, and logs you can actually retrieve.
- Breach response: can you inform the Data Protection Board and affected people, and file the detailed report within 72 hours?
- Rights and grievances: access, correction, erasure, nomination and grievance redressal, each with a working intake and a deadline someone owns.
- Retention and erasure: is data deleted once the purpose is served, and are processors told to do the same?
- Processors and vendors: contracts, instructions and evidence that third parties protect the data you share.
- Children’s data: verifiable parental consent where it applies, and no tracking or targeted advertising aimed at children.
The output is binary on purpose. It tells leadership what is missing, what it could cost under the Act’s penalty schedule, and who fixes it by when. If you have never done one, our DPDP gap analysis guide walks through the method, and the DPDP compliance assessment explains how to scope it.
How a DPDPA maturity model scores you
There is no official DPDP maturity model. Most borrow the five-level ladder from CMMI, the capability maturity framework used in software and security. Applied to a DPDP capability such as consent, it reads like this:
- Ad hoc. Consent is collected, but differently by each team. Nobody could produce last month’s consent records on request.
- Documented. A policy and a notice template exist. Whether teams follow them depends on who is asking.
- Managed. Consent runs through one workflow with an owner, versioned notices and a record for every grant and withdrawal.
- Measured. You track withdrawal turnaround, stale consents and notice coverage, and you review the numbers on a schedule.
- Optimised. Findings from audits, complaints and incidents feed back into the process, and the metrics show it.
That is why a maturity model tells the truth where a gap assessment cannot. Two organisations can both “have consent management”. One keeps it in a spreadsheet someone updates by hand. The other runs an automated workflow with tamper-evident records. A gap assessment marks both as done. A maturity model puts the first at level one and the second at three or four.
Where each approach goes wrong
Starting with a maturity model. This is the more common mistake, because maturity scores look good in a board deck. Teams spend weeks debating whether consent is at level two or three while the RoPA does not exist yet. You cannot score the reliability of a control you have not built.
Staying on gap assessments forever. Once every line says “in place”, a gap assessment has nothing left to tell you. It will not notice that rights requests now take 40 days instead of 20, or that half the vendor questionnaires came back blank. Those are maturity problems, and they are what a regulator or auditor finds first.
Self-scoring without evidence. Both tools fail when the answers are opinions. “Yes, we have a breach process” means little unless you can show the last drill, the timestamps and who signed off.
The sequence that works
- Gap assessment against the Act and the Rules 2025 timeline. Four to six weeks for a mid-sized company, most of it spent building the data inventory.
- Remediation, ordered by penalty exposure and effort. The DPDP compliance checklist is the working document.
- Baseline maturity score once the gaps are closed, so the first score measures real controls.
- Quarterly maturity reviews that push each capability from documented to managed, then measured.
- Aim for “measured” if you expect to be notified as a Significant Data Fiduciary. Periodic DPIAs and independent audits expect evidence of controls that run, not controls that exist.
Which one do you need first?
- You have never mapped your personal data: gap assessment.
- A customer, investor or auditor has asked where you stand: gap assessment, because they want the list of open items.
- You ran a gap assessment and closed most items: maturity model.
- Your board wants a trendline: maturity model, with the gap register kept alongside it.
- You are a group with several businesses at different stages: a gap assessment for the newest entities, a maturity review for the established ones.
How ProtectComply supports both
ProtectComply starts with a 35-question readiness check across nine weighted domains, scored green, amber or red. The full DPDP question bank goes deeper, with 440 questions across three levels, and there are sector-specific banks for industries such as healthcare. That covers the gap phase.
For maturity, the useful part is that the evidence comes from the workflows themselves: consent and RoPA changes are written to tamper-evident records, DPIAs are triggered by risk and carry DPO sign-off, and rights requests carry their own audit trail and deadline. That makes a maturity score something you can show rather than assert. See how the leading DPDP platforms compare, or talk to us about scoping an assessment.
Frequently asked questions
Is a DPDP maturity model mandatory?
No. Neither the Act nor the Rules require a maturity model or name one. They require the obligations to be met. A maturity model is a management tool for showing that they keep being met.
Can a gap assessment and a maturity assessment be run together?
Yes, and larger organisations often do. The practical version is one exercise: mark each obligation in place, partial or missing, and give the “in place” items a maturity level. Keep the missing items out of the maturity score, or the average hides them.
How long does a DPDP gap assessment take?
For a mid-sized company, usually four to six weeks. The questionnaire is quick. Building the inventory of what personal data you hold, where, and who receives it takes most of the time.
What maturity level should we target?
“Managed” for most Data Fiduciaries: one owned process, versioned records, evidence on request. “Measured” if you are likely to be a Significant Data Fiduciary or you process sensitive data at scale.