Work out where you actually stand.
Before tooling, it helps to know which parts of the obligation you have covered and which you have not looked at. These are the questions worth answering honestly.
Six questions that reveal most of it.
If you cannot answer one of these without asking three people, that is the finding.
Can you list the personal data you hold?
Not the systems, but the categories of personal data, and where each one lives.
Do you know why you hold each category?
A stated purpose per category, rather than "it was in the signup form".
Can a user withdraw consent as easily as they gave it?
And does withdrawal actually change what your systems do afterwards?
Could you answer an access request in the required time?
Including finding every copy of that person’s data across your systems.
Do you know which vendors receive personal data?
With current agreements, and a record of what each one gets.
Could you show evidence six months from now?
For a decision made today, without reconstructing it from memory.
The interactive assessment is being rebuilt.
An earlier version of this site scored your answers and told you how quickly Shastra would fix each gap. We have taken it down while Shastra is pre-launch, because a scored result implying a product-shaped remedy that does not exist yet is not a useful thing to give anybody.
More detail
The questions above are the substance of it. If you want to talk through where you stand with a person, that offer is real.
Shastra is pre-launch.
Pre-registration is open, and no pricing is published while the product is still being built.
Related: the DPDP Act explained · the Compliance Copilot