Skip to content

ISO 27001, SOC 2, the DPDP Act and manual VAPT. Book a Free Scoping Call

Scoping checklist

Privacy Assessment Scoping Checklist: What to Have Ready Before the Call

Before scoping a privacy assessment, have ready the markets you operate in and the legal entities involved, the categories of personal data you handle, how that data flows between systems, entities and countries, the processors and vendors who handle it for you, your current notices and consent flows, and any correspondence with a regulator. SecureRoot uses that to agree a written scope and a fixed price after one call of 30 to 45 minutes. No credentials, keys, personal data or customer datasets are needed at scoping: describe the data, do not send it.

Request a privacy assessmentContact SecureRoot

About this help article

Written by SecureRoot Risk Advisory LLP.

Start here

Markets and legal entities

  • Every country or market where you have users, customers or employees whose personal data you process, and where you are established.
  • The legal entities involved: parent, subsidiaries, branches and any group company that receives the data.
  • Which law or request started this: the DPDP Act, a customer's contract, GDPR for European users, or another market's law. Our coverage directory lists the Asia-Pacific markets and the rules we have verified at source, and our regional inputs guide lists what to gather per market.
  • Whether any entity acts for others (as a processor) as well as for itself.

Data

Categories of personal data

List categories and rough volumes, never records. A sentence such as "customer names, phone numbers and order history for about 200,000 users" is exactly enough.

  • Whose data: customers, end users, employees, candidates, vendors' staff.
  • What data: contact details, identity documents, financial, health, location, biometric or behavioural data.
  • Whether you process children's data. The DPDP Act sets separate duties for it, so say so even if the numbers are small.
  • Approximate volumes by category, since data volume is one of the things that moves the price.

Flows

How the data flows

  • Where personal data comes in: websites, apps, forms, sales tools, partners, imports.
  • The main systems where it is stored and used, including spreadsheets, exports and internal tools.
  • Who it is shared with, inside the group and outside it.
  • Which countries it is stored in or accessed from. Cross-border transfers move the scope and the price, and the DPDP Act lets the Central Government restrict transfers to notified countries.
  • Any existing data map or record of processing, even an incomplete one.

Third parties

Processors and vendors

  • Vendors that process personal data for you: cloud hosting, CRM, payment, messaging, analytics, support desk, payroll, background checks.
  • Whether each has a signed contract covering data protection. Under the DPDP Act a Data Fiduciary may use a Data Processor only under a valid contract, and stays responsible for safeguards over what the processor handles.
  • Rough count of processors, since the number of systems and processors is one of the main drivers of effort.

Current practice

Notices and consent

  • Links to your current privacy notice, cookie banner and in-app or form-level notices, in each language you publish them.
  • How consent is captured and withdrawn today, and where the record of it is kept. Under the DPDP Act a request for consent must be accompanied or preceded by a notice.
  • How access, correction and erasure requests and grievances are received and answered today.
  • Your breach response procedure, if one exists.

Regulators

Regulator correspondence

  • Any notice, inquiry or letter from a data protection authority, including the Data Protection Board of India, or a sector regulator about personal data.
  • Any personal data breach you have notified, or are considering notifying, and to whom.
  • Your counsel's contact, where one is already involved.

Tell us that correspondence exists and what it concerns; do not forward documents containing personal data before an engagement is agreed. SecureRoot is not a law firm and not a CERT-In empanelled auditing organisation, so legal opinions, filings and representation before the Board stay with your counsel.

Not needed

What you do not need to send

No credentials, keys, personal data or customer datasets are needed at scoping. Do not send passwords, API keys, tokens, database extracts, sample records or screenshots containing personal data. Categories, counts and system names are enough.

What happens next

After the call

SecureRoot sends a one-page written scope and then a fixed price. For the DPDP Act, a gap assessment can be bought on its own or as the start of a full programme; bought alone it takes under two weeks for a startup and three to five weeks for an SME, as on our pricing page. There is no DPDP certificate and no certifying body, so no third-party audit fee applies. There is also no universal GDPR certification, and no assessment makes an organisation compliant on its own.

Scope boundaries

What this does not cover

  • No firm, SecureRoot included, can certify DPDP Act compliance: there is no DPDP certificate in Indian law and no accredited DPDP certification body.
  • SecureRoot is not a law firm; legal advice and representation before any regulator stay with your counsel.
  • SecureRoot works from India and has no offices outside India; for markets beyond India, legal advice comes from counsel qualified in that market.
  • An assessment identifies gaps and a remediation plan; it does not guarantee compliance with any law.

Primary Sources

Where the Figures on This Page Come From

Figures and requirements above are taken from the sources below, linked to the primary text wherever one exists rather than to a summary of it.

Related

Services and help that go with this

Have the checklist ready?

Bring it to a 30 to 45 minute call. SecureRoot follows with a written scope and a fixed price.

Request a privacy assessmentContact SecureRoot