A readiness score you can defend line by line

What the assessment tests, mapped to DPDP §8

Section 8 is where the general obligations of a Data Fiduciary live: accuracy and completeness where the data is used to make a decision or is shared, reasonable security safeguards, breach intimation, erasure when the purpose is served or consent is withdrawn, a published contact for the person answering questions, and a grievance mechanism. Nearly everything an assessment can usefully ask about is downstream of that list.

The free check is 35 questions across nine areas, weighted so that notice and consent carries the most and children's data and cross-border the least. Each question offers four options scoring on a fixed scale, so two organisations answering identically get the same number. The deep dive goes considerably further and is chosen for you by two facts about your organisation rather than by which package you clicked.

Fiduciary questions and Processor questions are different banks

Your organisation records whether it acts as a Data Fiduciary, a Data Processor, or both, and the deep-dive questions are filtered accordingly. This is not cosmetic: a processor bank is roughly a third the size of the matching fiduciary bank, because most of §8 does not attach to a processor at all. An organisation marked as both gets a curated combined bank rather than the union of two, which would have asked many of the same things twice.

The banks vary substantially in size — from around a hundred questions for a processor in one sector to several hundred for a fiduciary in another — because the obligations genuinely differ. Any vendor quoting you one question count for every customer is quoting a brochure.

• Healthcare has the deepest coverage: the sector bank reaches into ABDM and ABHA integration, telemedicine, clinical research, connected medical devices, paediatric records, and sharing with insurers and third-party administrators.
• Fintech and the wider BFSI mapping, and real estate, each have their own deep-dive banks split by role.
• Anything that does not match a sector — SaaS, e-commerce, education, manufacturing — runs on the generic bank rather than being told a tailored bank exists.
• Follow-up questions are branch-gated on earlier answers, and questions that are gated off are excluded from the denominator rather than being scored as zero.

How the score is calculated, and what it deliberately ignores

Per question, the option you chose is divided by the best option available and multiplied by the question's weight. Per section, the earned total is divided by the available total and expressed as a percentage, which then contributes according to that section's weight. The overall figure is the sum of those contributions normalised to a hundred. Bands are fixed: seventy and above is green, forty and above is amber, below forty is red.

There is no model anywhere in that path. The same answers always produce the same number, which is the property that lets you show the calculation to an auditor. Multi-select answers average their options. Unanswered questions score zero but stay in the denominator, so a half-finished assessment reads as a low score rather than a flattering partial one.

What it ignores is as important. The score measures what you told it, weighted by how much that thing matters. It does not measure whether the answer was true. That is the job of evidence, and evidence is attached to the questions where a document is the only sensible proof rather than to all of them.

Evidence upload, and what the validation actually reads

Questions flagged as requiring evidence open an upload slot. Images go to a vision model; PDFs are sent as native pages alongside extracted text; Word, spreadsheet and plain-text formats are extracted. The validation is given three things at once — the exact question, the answer you selected, and the relevant provisions — and returns a verdict of valid, needs work, or invalid, with a reason that cites a section, a confidence, the facts it extracted, and which clauses it considered satisfied or missing.

Low-confidence or ambiguous verdicts are escalated to a stronger model with a stricter second-pass prompt before anything is recorded. A verdict other than valid opens a follow-up task for the DPO rather than silently lowering the score, and any evidence-required question submitted with no upload opens a missing-evidence task at submission. You can revalidate a file after replacing it.

Getting the answers out of people's heads

The blocker on a long assessment is rarely the questions; it is that eight of them belong to the infrastructure team, six to HR and four to whoever owns the vendor contracts. Whole sections can be assigned to named team members, each assignment spawning a task and an email with a deep link straight to that section. People outside the tenant get a tokenised invite and can answer on a public page without an account, and their answers attach to their assignment if they later sign up.

Assignment is at section granularity, not per question. Assignees work from an inbox; the owner sees what is outstanding and who has it.

What you get out at the end

The readiness PDF runs to eight parts: a cover carrying the score dial, an executive summary, a domain scorecard with a radar chart, a prioritised action plan with an impact-versus-effort view, two parts of question-by-question domain detail, an evidence checklist framed for an inspection, and a twelve-month roadmap with a KPI tracker. It picks up your logo and colours, and it is cached so regenerating is explicit rather than accidental.

Separately there is a remediation playbook, where each recommendation expands into a structured plan, and a longer recommendation report covering findings, risk and impact, recommended actions, tooling, implementation priority and timeline. Both are exports you can hand to someone. Neither is a board pack, and we do not describe them as one — that framing implies a governance artefact this does not produce.

Where readiness assessments break

The mechanics are the easy part. These are the ways the exercise loses its value.

• One person answers all 300 questions from memory over two evenings. The score is precise and the underlying facts are guesses.
• The optimistic option is chosen everywhere because the assessment is treated as a test to pass rather than a survey to complete. A green score with no evidence attached is worth less than an honest amber one.
• Evidence is uploaded that proves a policy exists rather than that it operates — a signed retention policy attached to a question about whether retention is enforced.
• The assessment is completed once and never re-run, so it describes an organisation that has since changed three systems and acquired a company.
• Sections are assigned to people who then leave, and the assignment sits in an inbox nobody inherits.
• The score is reported upward without the section breakdown, so the two red domains vanish into a respectable average.

What the assessment does not do

It is not an audit and it is not the independent data audit that attaches to Significant Data Fiduciaries. That obligation is discharged by an independent data auditor, and independence means someone who did not build your programme. A readiness assessment is an input to that, not a substitute for it.

It does not verify the answers you did not attach evidence to, and evidence is required only on the questions where a document is the sensible proof. Treat the score as a structured self-report with spot verification.

It does not decide whether you are a Significant Data Fiduciary. It records the designation and seeds the duties that follow from it, but the classification is a judgement made outside the tool.

It does not produce a certificate. Nobody certifies DPDP compliance, and a vendor offering to is selling something that does not exist.