If your business keeps a customer list, an employee file, a WhatsApp enquiry log or a CRM, this Act applies to you — there is no small-business exemption. This kit tells you where you stand, drafts the notice you must publish, and builds the data inventory everything else depends on.
The three dates come from the commencement notification of 13 November 2025 (G.S.R. 843(E)). The Data Protection Board is constituted but, as reported at September 2026, has no Chairperson or Members appointed yet.
The notice, consent and safeguard duties that govern AI use on personal data are enforceable from 13 May 2027 (Rules 3, 6 and 7); the labelling duty under the IT Rules has been in force since 20 February 2026.
Answer honestly — a score you flatter yourself with is worth nothing.
A readiness score is a starting map, not a compliance programme. What it does not cover
Consent design, employee data, vendor contracts and a breach plan you can actually execute in 72 hours all need someone to look at how your business really runs — and if you are a Significant Data Fiduciary, the Data Protection Officer (DPO), audit and impact-assessment duties are a different order of work altogether.
The notice rule (Rule 3) requires the notice to stand on its own, in clear and plain language, with an itemised description of the data and a specific description of what it enables. The draft below assembles itself as you type.
No website is fine — put a WhatsApp number, a phone number or the shop address here instead. Leaving it empty is what is not fine.
What personal data do you collect? Tick everything that applies — the notice must itemise it, not describe it vaguely.
Why do you collect it? Each purpose must name the goods or services it enables.
Be specific. "As long as necessary" is not a retention policy.
Processors act on your instructions — you stay responsible for what they do.
Prepared as a preparation aid under the Digital Personal Data Protection Act, 2023 — verify against your actual processing.
One row per thing you actually do with personal data. Saved in this browser only.
This is not itself a statutory return — it is the working document every other obligation depends on. You cannot write an itemised notice, answer an erasure request, or scope a breach if you do not know what you hold and where.
| Activity | Data collected | Whose data | Purpose | Where it is kept | Retention | Shared with | Outside India? |
|---|
Your staff are already pasting client data into a chat tool. This builds the paper that says what they may and may not do.
An internal policy with a permitted / prohibited data table, an engagement-letter addendum, a client-consent paragraph, the labelling rule sheet for AI-generated media, and a one-page staff do/don't.
Nothing on this page is synthetically generated information: it prints computed text, which the MeitY FAQ puts outside the 2026 labelling rules. Deterministic text, no model, no key.
Answer honestly — a "no" becomes a line in the staff sheet, not a mark against you.
Tabs 1 to 4 are about your duties to other people's data. This one is about yours.
“repeated unsuccessful attempts were made recently to gain unauthorized access to its digital portals and digital information systems”
Members and students are to “avail ICAI digital services only through its official ICAI website and authorized applications” and to be cautious “against phishing emails, fake websites, fraudulent mobile applications or any other attempt to impersonate ICAI.”
ICAI public announcement, 17 July 2026. Unauthorised access, hacking, tampering, identity theft and impersonation are offences under the Information Technology Act, 2000 and the Bharatiya Nyaya Sanhita, 2023.
ICAI says the attempts were unsuccessful; the point is that the profession's platforms are targets, and yours hold the same data.
Every third party that receives your clients' documents. Two of these columns are the ones a breach notice ends up being written from. You stay responsible for what a processor does with data you gave it (s.8(2)). This page does not score or rate any vendor.
| Vendor | What of ours they hold | Hosted where (country) | Security clause in the contract? | How would they detect a year-long exfiltration? | How fast are we told, by contract? | If we left tomorrow, can we download our data today? | Last checked |
|---|
The three honest answers to the last column are: a licence they cannot revoke · a downloadable artefact · a hosted service with an export button. Anything else is a dependency, not a supplier.