What is DPDP compliance testing?

It is technical testing of an application's privacy-related behaviour, such as consent, rights requests, deletion, access control and breach workflows, against requirements your organisation has identified under the DPDP Act and Rules.

What does a DPDP readiness assessment include?

A scoped review of data flows, a prioritised set of test scenarios, execution with evidence, a findings report and a retest. The exact content depends on your product and agreed scope.

Can Testriq certify that we are DPDP compliant?

No. There is no official DPDP certificate for ordinary businesses, and we do not issue legal determinations. We provide a technical test report on defined behaviours and controls.

What applications can be tested?

Web applications, mobile apps, APIs and the supporting back-end systems, plus test environments that may hold personal data.

How do you test consent management?

We check that consent options are specific, that declining or withdrawing actually stops the related processing (including third-party calls), and that consent records are created and updated correctly.

How are data deletion workflows verified?

We trigger deletion and erasure requests and then check every connected store and integration. We also test retention behaviour, because some data and logs may need to be kept for a defined period under the Rules or other laws.

Does DPDP testing include penetration testing?

It can. Security safeguards testing may include API security and application penetration testing within the agreed scope.

What deliverables do we receive?

Findings with evidence, a prioritised defect list, remediation recommendations, retest results and a statement of scope and limits.

How long does it take, and what does it cost?

Both depend on scope, complexity, integrations and the deliverables agreed. We confirm them after a scoping conversation.

Does technical testing replace legal advice?

No. It complements legal and privacy advice. Please consult qualified professionals about your full obligations.

HomeDPDP Compliance Testing Services

Privacy-Focused QA

DPDP Compliance Testing Services for Applications and Platforms

Check how your product actually handles personal data, with test evidence your team can act on.

India's Digital Personal Data Protection (DPDP) Act and Rules set expectations for consent, notices, security safeguards, data rights and breach response. Policies describe intent. Your application is where those promises either work or fail.

Testriq QA Lab provides technical verification of consent flows, data rights workflows, deletion behaviour, access controls and breach-response processes inside your web, mobile and API-based products. You receive reproducible findings, evidence and a retest, within an agreed scope.

Book a DPDP Readiness Assessment Discuss Your Testing Requirements

Technical testing service. Not legal advice, not a legal determination of compliance and not a government certification.

What a DPDP readiness assessment covers

Consent capture, withdrawal and the processing that follows
Data Principal rights: access, correction, erasure, grievance
Deletion and retention behaviour across every connected store
API and application security safeguards
Personal data in logs, exports and non-production environments
Breach detection and notification workflows

Every finding ships with steps to reproduce, evidence and a severity, then a retest once your team has fixed it.

Where DPDP risk hides inside your product

Most privacy failures are software defects, not policy gaps. Teams usually find them late, after a release or an incident. Typical examples:

Consent that does not behave as shown

A user withdraws consent, but analytics or marketing tags keep firing. The Rules expect withdrawal to be as easy as giving consent (Rule 3).

Personal data in the wrong places

Names, phone numbers or ID details appear in logs, error messages, URLs, exports or non-production databases.

Deletion that leaves copies behind

An account is “deleted” in the UI, but the data survives in search indexes, caches, backups or a connected CRM.

Weak access control

An API returns another user’s record when an ID is changed, or support roles can see more than they need.

Privacy regressions

A release quietly re-enables a tracker, breaks the rights-request form or removes a notice.

Unknown third-party data flows

SDKs and integrations send personal data to vendors nobody reviewed.

We describe these as technical risks. Legal consequences depend on your facts and should be assessed by qualified counsel.

What is DPDP technical readiness testing?

DPDP technical readiness testing is a structured set of tests that checks whether specific application behaviours and security controls work as intended for the privacy obligations your team has identified.

It is one layer of a wider effort:

Layer	Who does it	Example
Legal interpretation	Lawyers and privacy counsel	Does the Act apply to us? Which obligations?
Privacy governance	Your DPO, compliance team	Policies, contracts, training, records
Technical verification	Testriq (QA)	Does consent withdrawal really stop processing? Does deletion reach every system?

We work with the requirements your legal or privacy team provides, and can map tests to the relevant DPDP Rules. Where interpretation is needed, we flag it rather than guess. The testing itself draws on our security testing and test automation practices.

DPDP testing services offered by Testriq

Each engagement is scoped to your product. These are the areas we test, what a typical scenario looks like, and what you receive.

1. DPDP technical readiness gap assessment

We map where personal data enters, moves and is stored in your product, then test a prioritised set of controls against the obligations you define.

Example scenarios:: Data inventory walkthrough, trace of a sign-up record across services, review of what each role can see.
Can reveal:: Undocumented data stores, over-collection, unclear ownership of data.
Outcome:: A risk-ranked list of technical gaps with evidence.

2. Consent and privacy notice testing

The Rules expect notices to be clear and independently understandable, itemise the personal data and purposes, and explain how to withdraw consent and exercise rights (Rule 3).

Example scenarios:: Purpose-wise consent options, no pre-ticked boxes, withdrawal path versus giving path, behaviour after withdrawal, notice display on web and mobile, consent record created and updated.
Can reveal:: Trackers firing before consent, withdrawal that only hides a banner, missing notice elements.
Outcome:: Pass/fail results per scenario with screenshots, network traces and logs.

3. Data Principal rights workflow testing

Users need published ways to exercise their rights, and organisations must publish a grievance mechanism with a response period that does not exceed ninety days (Rule 14).

Example scenarios:: Access, correction and erasure requests end to end; nominee flow; identity checks; request status tracking; grievance form and acknowledgement; contact details of the responsible person (Rule 9).
Can reveal:: Requests that go nowhere, partial fulfilment, missing audit trail.
Outcome:: Workflow test report and defect log.

4. Data deletion and retention behaviour verification

Deletion is not simply “delete everything”. For defined purposes the Rules require erasure after set periods with prior notice (Rule 8), and also require certain personal data and logs to be kept for a minimum of one year for specified purposes (Rule 8(3)), unless other law requires otherwise. Your tests must reflect your retention rules.

Example scenarios:: Account deletion across primary DB, replicas, caches, search indexes, file stores, analytics and third-party tools; scheduled-erasure jobs; the 48-hour advance notice where applicable; retained-data access restrictions.
Can reveal:: Orphaned records, deletion that skips connected systems, retention rules implemented inconsistently.
Outcome:: Evidence matrix of what was deleted, what was retained and why.

5. Security safeguards verification (API and application)

Rule 6 lists minimum safeguards: encryption, obfuscation, masking or tokens; access control; logging and monitoring; backups for continuity; one-year log retention; and safeguard clauses in processor contracts.

Example scenarios:: Broken access control on APIs, personal data in responses and logs, encryption in transit, role-based access checks, log completeness for access to personal data.
Can reveal:: Exposure of personal data, missing audit logs, weak authorisation.
Outcome:: Security findings with severity and remediation advice.

6. Test data masking and synthetic data validation

Many exposures start in QA and staging environments that contain copied production data. We check that test environments use masked or synthetic data and that masking is irreversible where required.

Example scenarios:: Scan staging databases, fixtures and logs for real personal data; verify masking cannot be reversed.
Can reveal:: Production data sitting in non-production systems.
Outcome:: A non-production data exposure report.

7. Breach detection and notification workflow testing

Under Rule 7, affected Data Principals must be informed without delay and the Board must be notified without delay, with detailed information within seventy-two hours. We test whether your technical workflow can support this.

Example scenarios:: Alert triggers, escalation paths, templated notices, and whether the required facts can be pulled from logs quickly.
Can reveal:: Missing owners, delays, incomplete information.
Outcome:: A tabletop-style technical test and gap list. We do not decide what counts as a reportable breach.

8. Privacy regression testing in CI/CD

We automate the checks that matter — consent behaviour, rights-request flows, personal data in logs and APIs — so every release is tested before it ships.

Example scenarios:: Privacy test suite re-run on each build, with failures blocking the pipeline.
Can reveal:: Regressions after updates.
Outcome:: An automated privacy suite running in your pipeline.

Also available where applicable

Age gate and verifiable parental consent testing for products used by children (Rule 10).
Third-party SDK and API data-flow testing, to see which vendors receive personal data and when.

Security safeguards testing builds directly on our security testing and penetration testing and API testing services.

Technical testing scenarios

These show the level of detail you can expect. Scenarios are tailored to your product.

Area	Example test	Looks for
Consent capture	Accept only “service” purpose; monitor network calls	Marketing or analytics calls despite no consent
Consent withdrawal	Withdraw in settings; repeat actions; check backend flags	Processing continuing after withdrawal
Notice	Open notice on small screen and in each supported language	Missing itemised data or purposes; unreadable layout
Access and correction	Request own data, correct a field	Wrong data returned, change not propagated
Erasure	Delete an account; query every store and integration	Residual personal data
Retention	Trigger scheduled erasure; check pre-notice and retained logs	Early deletion of data that must be kept, or late deletion
API access control	Change record IDs and roles in requests	Access to other users’ personal data
Test environments	Scan staging databases and logs	Real personal data in non-production
Third parties	Record outbound calls on key journeys	Unknown recipients of personal data
Breach workflow	Simulate an alert; time the steps to a draft notice	Missing owners, delays, incomplete information
Release safety	Re-run privacy tests on each build	Regressions after updates

A technical test result is not a legal determination. A pass means a defined behaviour worked in the tested conditions. It does not mean the organisation meets every obligation under the Act.

Industries we support

Testing needs differ by product type. These are the areas we prioritise in each.

SaaS and technology

Multi-tenant data separation, admin and support access, API access control, data export and deletion across tenants.

Fintech

KYC data handling, masking in logs and statements, consent for data sharing, audit trails for access to personal data.

Healthcare technology

Sensitive patient-record access control, role-based views, retention and deletion behaviour. The Rules contain specific provisions for health-related processing of children’s data, so your counsel should confirm which apply.

EdTech

Child-user flows, age gates, parental consent steps (Rule 10), and tracking or monitoring features. Certain exemptions exist for educational institutions; qualified counsel should decide whether they apply.

E-commerce

Consent for marketing and profiling, order and account deletion, and retention of transaction logs. Some classes of large platforms have defined erasure periods under the Third Schedule, which your legal team can assess.

Digital platforms and apps

Notification and consent on web and mobile, third-party SDKs, and in-app rights requests.

Our testing process

1
Discovery and scope
We agree which applications, environments, user roles and requirements are in scope.
2
Data-flow understanding
We trace personal data through the product with your engineers.
3
Test planning and control mapping
We turn the requirements you provide into test scenarios, mapped to the relevant DPDP Rules where you want that traceability.
4
Test execution
Manual and automated tests, including API and security testing.
5
Findings and evidence
Each result is documented with steps, screenshots, logs and severity.
6
Remediation support (where agreed)
We clarify defects with your developers.
7
Retest and final report
Fixed issues are retested and the final report records what changed.

Where a finding depends on legal interpretation, we mark it for your legal or privacy specialist instead of deciding it ourselves.

Why choose Testriq

Testriq QA Lab LLP is a software testing company that has been working in QA since 2010.

Established QA practice

Manual, automation, API, regression, performance, ETL, IoT and AI application testing, delivered since 2010.

Existing security testing capability

Penetration testing, API security testing and OWASP Top 10-based assessment, which underpin the safeguards testing above.

Evidence-first reporting

Findings you can reproduce, fix and retest — not a score or a rating.

Quality and security credentials

ISTQB-certified engineers, with ISO 9001 and ISO 27001 certification held by the company.

Honest scope

We say what testing can and cannot establish, and mark anything that needs legal interpretation for your counsel.

We have not listed DPDP-specific case studies or testimonials on this page, because we will not present work we cannot show you. You can review our published case studies for how we report findings in other engagements.

Technical testing is not legal compliance

Technical testing can show how an application behaves in defined situations, and whether specific controls work. It cannot, on its own, show that an organisation meets every obligation under the DPDP Act. The following need qualified legal or privacy professionals:

Legal interpretation of the Act and which obligations apply to you
Notices, contracts and vendor arrangements
Governance, records and training
Cross-border transfer questions
Whether your organisation is a Significant Data Fiduciary

Testriq works alongside your counsel and DPO. Think of it as the engineering check on what they decide.

Frequently asked questions

Ready to test how your product handles personal data?

Tell us about your application, your privacy-related concerns and your readiness goals. We will respond with a proposed scope and next steps.

Book a DPDP Readiness Assessment Discuss Your Testing Requirements

Disclaimer:Testriq's DPDP technical readiness and testing services assess defined application behaviours and technical controls within the agreed scope. They do not constitute legal advice, a legal determination of compliance, or government-issued certification. Organisations should consult qualified legal or privacy professionals regarding their complete obligations under applicable law.

DPDP Compliance Testing Services for Applications and Platforms

What a DPDP readiness assessment covers