Understand your gaps.
Put potential exposure in perspective.
Data Privacy Risk Score & Penalty Estimation. A practical starting point for prioritising privacy implementation and informed management conversations.
Clarity for your next decision.
As reviewed on 27 October 2026, the operational duties modelled here and section 33 are scheduled for commencement 18 months from the Gazette publication of G.S.R. 843(E), calculated as 13 May 2027. The Consent Manager phase is calculated as 13 November 2026. This tool models post-commencement scenarios; it does not calculate a presently payable penalty. Check later notifications before relying on these dates.
Read the official sources ↓Recommended implementation actions, based on your responses. These are not findings from an audit.
Complete the assessment to generate your priorities.
Online enquiries are not yet enabled. The contact page lets you prepare and download an enquiry.
DPCI screening methodology v1.0
Published and reviewed: 27 October 2026
Implemented and evidenced = 0; partly implemented = 0.5; not implemented or not sure = 1. Each domain averages its answers. The total is 100 × the weighted average of included domain gaps, rounded to a whole number.
Weights: security 30%, notification 20%, children 15%, SDF 15%, core operations 20%. Excluded domains are removed and remaining weights are normalised. Unknown applicability remains included provisionally.
0–24: lower reported gaps. 25–49: moderate gaps. 50–74: high gaps. 75–100: very high gaps. These are DPCI prioritisation bands, not statutory ratings or validated loss probabilities.
This short screening is not the DPCI Master Control Framework v2.1 enterprise audit. Responses are unverified and the questions do not exhaust every obligation. A zero score is not compliance assurance.
The tool includes one ceiling per selected Schedule category, subject to the scope gates. Optional planning amount = that arithmetic sum × your percentage ÷ 100.
There is no automatic discount, turnover multiplier, confidence interval or predicted fine. Legal characterisation, overlapping facts, separate findings, exemptions and the Board’s decision determine actual exposure.
No. A self-reported readiness gap is not a finding of a statutory breach. Applicability, commencement, evidence, inquiry and the Board’s decision matter. This calculator models hypothetical post-commencement scenarios.
No. SDF status depends on government notification under section 10. This tool cannot confer, predict or replace that designation.
The statutory framework does not prescribe the calculator’s percentage. Entering your own assumption can support a planning discussion, but the resulting amount is not an evidence-based prediction of enforcement.
Yes. Download a text summary or use Print / save as PDF. The report includes your responses, assumptions, methodology and sources. Review the contents before sharing; DPCI does not receive a copy.
Legal requirements come from the instruments below. The scoring weights, bands and suggested actions are DPCI recommendations. This is a dated source review, not live legislative monitoring.
