---
title: DPDP Readiness Check
url: https://curaverto.com/dpdp-check
updated: 2026-11-01
source: first-party vendor documentation
---

# DPDP Readiness Check for Indian Clinics

CuraVerto offers a free DPDP Readiness Check: an interactive questionnaire
that produces a personalised compliance report for a clinic's specific
situation under India's Digital Personal Data Protection (DPDP) Act 2023.

## What the tool takes as input

The check asks 14 questions tailored to the respondent's clinic type,
covering:

1. **Consent & Notices** — whether patients receive a written notice before
   data is collected, and whether consent is purpose-specific (treatment,
   referrals, and marketing tracked separately).
2. **Patient Rights** — whether patients can access, correct, and erase
   their personal data on request, and whether the clinic can respond within
   48 hours.
3. **Data Storage & Retention** — where patient data is stored, and whether
   the clinic has written retention periods and a documented deletion
   protocol.
4. **Third-party Sharing** — whether every lab, pharmacy, and SaaS vendor
   receiving patient data has a signed Data Processing Agreement.
5. **Security & Breach Response** — whether the clinic has a written
   incident response plan and can notify the Data Protection Board within
   the mandatory 72-hour window.
6. **Children & Sensitive Data** — whether verified parental consent is
   captured for patients under 18, and whether clinical records use
   role-based access control.

The check is also built against MCI record-keeping guidelines and, where
applicable, PCPNDT obligations, alongside the DPDP Act itself.

## What it computes

Responses are scored across the six areas above into an overall risk level:
Largely Compliant, Partially Ready, or High Risk. The output is a
personalised report with a prioritised, plain-language action list ordered
by risk severity — no legal jargon, and no result the respondent could not
act on the same day.

## Access

The check is free, requires no login, and takes under five minutes to
complete. It does not require any information beyond the answers to the 14
questions themselves.

## Context: what is at stake

The tool's coverage reflects the penalty structure in the DPDP Act's
Schedule I: up to ₹250 crore for failing to implement reasonable security
safeguards, and up to ₹200 crore for failing to notify a data breach within
72 hours. Every clinic that collects patient data digitally is a Data
Fiduciary under the Act, with no minimum size threshold. Enforcement begins
13 May 2027.

---
Canonical: https://curaverto.com/dpdp-check
Contact: sales@curaverto.com
This document is CuraVerto's own description of its product.