4

Compliance Command Center

Department of Citizen Services & Public Welfare — a single view of where this organisation stands against every operative obligation in the DPDP Act, 2023 and the DPDP Rules, 2025.

Generate reportCompliance register
DPDP readiness

The weighted proportion of applicable obligations actually discharged. Clauses carrying a penalty ceiling count double. Obligations recorded as not applicable are excluded from the denominator rather than scored as zero.

DPDP Act, 2023
56%
DPDP Rules, 2025
50%
Schedule
100%
Indicative penalty exposureEstimate

The Schedule's ceilings weighted by how far each obligation is from being discharged. Not a prediction — a way to rank what to fix first.

₹508 Cr

against a theoretical maximum of ₹1650 Cr

  • S.9Personal data of children₹120 Cr
  • R.10Verifiable consent for children and persons with disability₹120 Cr
  • S.10Additional obligations of a Significant Data Fiduciary₹90 Cr
  • R.12Additional obligations of a Significant Data Fiduciary₹90 Cr
Full breakdown
Critical gaps
6

Open or in remediation

View
Open rights requests
50

35 past the statutory period

View
Open incidents
2

Including one active breach

View
Unconsented elements
54

No active consent or legitimate use

View
Children's data elements
38

Require verifiable guardian consent

View
Active consents
6.43 L

Across all purposes

View
Clause coverage

Every operative obligation in the Act and the Rules. Click any cell to see what the clause requires, what we do about it, and the evidence behind the status.

DPDP Act, 2023 — rights and transfer
S.11S.12S.13S.14S.15S.16S.17
CompliantPartially compliantIn progressGapNot assessedNot applicable
Top risks

By residual level, then exposure.

All 15
CriticalUnlawful processing by the AI assistantDr. Kavya Menon · ₹200 CrCriticalChildren's data processed without verifiable parental consentArjun Malhotra · ₹200 CrCriticalDPIA cadence lapsedVikram Saxena · ₹150 CrHighShadow AI exfiltrationImran Sethi · ₹250 CrHighPrivileged standing access to health dataRohit Verma · ₹250 Cr
Readiness by obligation area

Where the weakness actually is.

Cross-border transfer
0%
Children's data
0%
Retention & erasure
25%
Governance
36%
Security safeguards
50%
Data Principal rights
63%
Accountability
71%
Consent
83%
Lawful basis
83%
Notice
100%
Breach response
100%
Open risk by category

Residual level after mitigation.

Recent activity

From the immutable audit trail.

Audit trail
  1. Consent withdrawn by the Data Principal from the portalyesterday

    ConsentArtefact · ConsentArtefact 2912

    06 Aug 2026, 09:30Dr. Kavya Menon
  2. Request moved to in progressyesterday

    RightsRequest · RightsRequest 6338

    06 Aug 2026, 05:30Sanjay Chauhan
  3. Access response dispatched to the Data Principalyesterday

    RightsRequest · RightsRequest 1794

    06 Aug 2026, 02:30Sunita Bhardwaj
  4. Clause status updated following remediationyesterday

    Clause · Clause 2032

    06 Aug 2026, 00:30Deepika Joshi
  5. Gap raised from an assessment answer2 days ago

    Gap · Gap 1791

    05 Aug 2026, 19:30Deepika Joshi
  6. Discovery scan completed2 days ago

    ScanRun · ScanRun 8527

    05 Aug 2026, 17:30Sunita Bhardwaj
  7. Classification overridden by an analyst2 days ago

    DataElement · DataElement 7565

    05 Aug 2026, 13:30Vikram Saxena
Needs attention

Deadlines inside the next fortnight.

OverdueDSR-2026-004820Address change not reflected in the ration entitlement3 months agoOverdueDSR-2026-004832Withdrawal of consent for service notifications3 months agoOverdueDSR-2026-004847Withdrawal of consent for service notifications29 days agoCriticalAI assistant processes personal data with no recorded legal basisPriya Nair · target in 9 daysCriticalEight processor contracts lack the prescribed security provisionsVikram Saxena · target next monthCriticalUnencrypted personal data columns in three legacy databasesNaveen Kulkarni · target in 2 months

Where to go next

The three screens that most often change the readiness number.

Data DiscoveryEverything downstream depends on knowing what personal data exists and where. Unscanned sources are blind spots in every other module.Gap registerClosing a gap moves the clauses it blocked, which moves the readiness score. This is the shortest path from work to measured progress.Rights queueThe most visible obligation to a citizen and the most measurable to a regulator. Missing the published period is directly observable.