After a DPDP Gap Assessment: How Businesses Can Build a 90-Day Compliance Roadmap

India’s Digital Personal Data Protection (DPDP) framework has made personal data protection an important operational responsibility for businesses. Organisations that collect customer information, manage employee records, process candidate applications, or work with third-party vendors need to understand how personal data is handled across their operations.

For many businesses, the first step is a DPDP gap assessment. It helps identify weaknesses in existing processes, documentation, consent practices, vendor agreements, and data security arrangements.

However, identifying gaps is only the beginning. The real challenge is turning assessment findings into practical improvements without overwhelming internal teams or disrupting everyday business activities.

A structured 90-day roadmap can help organisations prioritise issues, assign responsibilities, implement corrective measures, and establish a repeatable compliance process.

Why a DPDP Gap Assessment Is Only the First Step

A gap assessment provides a snapshot of an organisation’s current privacy practices. It can highlight where personal data is stored, how it is collected, whether privacy notices are appropriate, and whether processes exist to handle individual rights requests and potential data breaches.

The assessment may also identify weaknesses in supplier contracts, retention policies, employee training, and internal accountability.

Yet a report alone does not resolve these issues. A business may understand what needs to change but still struggle to determine which actions should come first, who should implement them, and how progress should be measured.

This is particularly challenging for small and medium-sized enterprises, hospitals, SaaS companies, logistics businesses, and other organisations where compliance responsibilities often fall to people who already manage IT, HR, administration, or legal operations.

The next step is to convert the assessment into a prioritised action plan.

Businesses looking for an overview of the initial process can refer to this guide to DPDP gap assessments.

Step 1: Organise Findings by Risk and Business Impact

Not every gap requires the same level of urgency. Some findings may concern missing documentation, while others may affect how an organisation collects consent, shares personal data, or responds to a security incident.

A practical remediation plan should group findings into clear categories.

Data discovery and documentation: Identify where personal data is collected, stored, accessed, and shared. Create or update a data inventory and the record of processing activities.

Privacy notices and consent: Review notices presented to customers, employees, and other individuals. Check whether purposes are clearly communicated and whether consent processes are appropriate for the relevant processing activity.

Vendor and processor management: Identify third parties that handle personal data and review whether the relevant contractual safeguards and responsibilities are documented.

Individual rights and grievances: Establish clear ownership and procedures for handling requests, complaints, correction, erasure, and other applicable rights.

Breach preparedness: Develop an incident response process that defines responsibilities, escalation routes, evidence preservation, and applicable notification requirements.

Training and accountability: Make sure employees understand their responsibilities and that the organisation can demonstrate relevant training and compliance activities.

Prioritisation should reflect legal obligations, potential harm, operational dependencies, and the effort required to resolve each finding. Organisations should also distinguish urgent issues from improvements that can reasonably be scheduled for a later phase.

Step 2: Build a Practical 90-Day Implementation Plan

A 90-day programme offers one way to organise remediation work into manageable stages. The timeline should be adjusted to the organisation’s size, complexity, existing controls, and assessment findings. It should not be treated as a statutory deadline or a guarantee that every organisation can complete all compliance work within three months.

Days 1–30: Assess and Establish Priorities

The first phase focuses on understanding the current environment and establishing a reliable baseline.

Typical activities include:

• Consolidating assessment findings into a remediation register.
• Mapping personal data across business processes and systems.
• Identifying missing documentation and unclear responsibilities.
• Reviewing privacy notices, consent practices, and vendor arrangements.
• Assessing whether additional obligations may apply to the organisation.
• Assigning an owner, target date, and completion criteria to each action.

At the end of this phase, management should have a prioritised roadmap that explains what needs to be fixed, why it matters, who is responsible, and how completion will be verified.

Days 31–75: Implement the Required Changes

The second phase focuses on correcting the gaps identified during the assessment.

Depending on the findings, this may involve updating privacy notices, documenting processing activities, reviewing supplier agreements, establishing retention schedules, and creating processes for individual rights requests.

Organisations should also clarify who receives grievances, who escalates incidents, and who approves changes to privacy documentation.

Where consent is required, the process should be designed around the relevant purposes and applicable legal requirements. Businesses should avoid treating every processing activity as consent-based without examining whether another lawful basis under the DPDP framework applies.

Technology can help manage consent records, data inventories, vendor information, and requests. However, software alone cannot determine every legal or operational decision. Internal teams must remain involved in decisions about business purposes, approvals, and accountability.

Days 76–90: Test, Document, and Prepare for Ongoing Compliance

The final phase focuses on checking whether the changes work in practice.

Activities may include:

• Testing the process for receiving and responding to rights requests.
• Reviewing the breach response playbook and escalation arrangements.
• Checking whether updated notices and agreements are in use.
• Training relevant employees and retaining training records.
• Organising evidence of completed remediation activities.
• Documenting outstanding issues and assigning follow-up actions.

The organisation should finish with more than a completed checklist. It should have working processes, identifiable owners, supporting evidence, and a plan for maintaining those processes after the initial project ends.

Step 3: Decide Who Owns Each Responsibility

A common reason compliance programmes lose momentum is that responsibilities are not clearly allocated.

An external consultant may prepare documents and recommend improvements, but the organisation still needs internal ownership. Business leaders must approve relevant decisions, IT teams need to implement technical changes, HR may manage employee-data processes, and procurement or legal teams may handle supplier contracts.

A responsibility matrix can help prevent gaps from being overlooked.

For example:

• Management: Approves priorities, allocates resources, and oversees progress.
• IT and security: Implements relevant technical safeguards and supports incident response.
• HR and administration: Reviews employee-data handling, recruitment records, and related procedures.
• Legal and procurement: Reviews contractual obligations and supports interpretation of applicable requirements.
• Privacy or compliance owner: Coordinates the remediation register, tracks evidence, and monitors recurring activities.

Smaller organisations may assign several of these responsibilities to one person. The important point is to establish clear ownership and escalation routes rather than assume that an external adviser will make every operational decision.

A formal Data Protection Officer should not automatically be treated as a requirement for every business. The appointment obligation under Section 10 of the DPDP Act applies to Significant Data Fiduciaries. Other applicable contact and accountability requirements should be assessed separately.

Step 4: Build Evidence Into Everyday Operations

Compliance should not depend on somebody reconstructing events whenever management, an auditor, or another authorised party asks for proof.

Businesses should maintain evidence as part of normal operations. Depending on their activities and applicable requirements, this may include:

• Current data inventories and records of processing.
• Approved privacy notices and version histories.
• Consent records and documented processing purposes.
• Data processing agreements and vendor review records.
• Retention and erasure schedules.
• Records of rights requests and grievance handling.
• Incident reports and response documentation.
• Employee training records and remediation sign-offs.

The purpose of this evidence is not simply to create more paperwork. It is to show what the organisation has implemented, who is responsible, and whether its processes are being followed.

A centralised register or compliance platform may help keep these records organised. Businesses should also confirm that they can access and export their information and maintain it when a service provider or consultant is no longer involved.

Step 5: Avoid Common Post-Assessment Mistakes

Several mistakes can undermine an otherwise useful gap assessment.

Treating the report as the final deliverable. Findings need owners, deadlines, and verification criteria before they become actionable.

Trying to fix everything simultaneously. Prioritisation helps businesses address important risks while managing limited budgets and staff capacity.

Purchasing software before understanding the gaps. Technology should support identified requirements rather than become a substitute for understanding the organisation’s actual data practices.

Outsourcing every decision. External specialists can provide expertise, but the business must retain ownership of decisions about its operations and responsibilities.

Ignoring vendor relationships. Third-party processing arrangements should be reviewed rather than assumed to be adequate simply because a supplier is established or well known.

Failing to maintain records. Policies and processes are more useful when the organisation can demonstrate that they have been implemented and maintained.

Treating the 90-day plan as the end of compliance. Privacy obligations may continue to require reviews, employee training, rights-request handling, incident preparedness, and updates when business practices change.

Turning Assessment Findings Into a Sustainable Compliance Programme

The most useful outcome of a DPDP gap assessment is not a long list of deficiencies. It is a practical understanding of what needs to change and how the organisation will manage those changes.

A structured implementation programme helps businesses move from identifying weaknesses to assigning responsibilities, correcting processes, documenting evidence, and establishing ongoing oversight.

Organisations that need specialist support can explore DPDP compliance services and implementation options to understand how assessment, privacy operations, contractual reviews, and audit preparation may fit into their requirements.

RuleExpert also provides a free DPDP Scorecard that businesses can use as an initial readiness check. A scorecard is a starting point rather than a substitute for a detailed assessment.

Ultimately, successful DPDP implementation depends on matching the work to the organisation’s actual risks, keeping responsibilities clear, and ensuring that the systems and processes established today remain useful as the business evolves.