Most centres are strong on functional excellence and early AI adoption, but short of the autonomous, self-optimizing model GCC 4.0 describes. This tool turns the framework into a diagnostic so you can see exactly where the distance is.
Strong certifications are not Indian law
ISO 27001 and SOC 2 are control frameworks, and ISO 27701 is built around GDPR. DPDP adds obligations they do not address.
Roles
Who is the Data Fiduciary and who is the Processor, under the s.17(1)(d) outsourcing exemption
Lawful basis
Consent or ‘legitimate use’, not ‘legitimate interest’
Breaches
Intimation to every affected person, with no materiality threshold
Evidence
One-year log retention, a 90-day grievance ceiling, children’s data rules and Board-facing proof
Strong certifications are not Indian law
ISO 27001 and SOC 2 are control frameworks, and ISO 27701 is built around GDPR. DPDP adds obligations they do not address.
Roles
Who is the Data Fiduciary and who is the Processor, under the s.17(1)(d) outsourcing exemption
Lawful basis
Consent or ‘legitimate use’, not ‘legitimate interest’
Breaches
Intimation to every affected person, with no materiality threshold
Evidence
One-year log retention, a 90-day grievance ceiling, children’s data rules and Board-facing proof
What gets assessed
Eight compliance domains
Applicability
Scope, Parent ↔ GCC Roles & Data Inventory
Which personal data you process, whose it is, and whether the GCC is a Data Fiduciary or a Data Processor for each flow
Lawfulness
Lawful Basis, Notice & Consent
Processing only on consent (s.6) or a closed list of legitimate uses (s.7), with clear notice
Rights
Data Principal Rights & Grievance Officer
Access, correction, erasure and nomination rights, with grievance redressal inside 90 days
Rule 6
Security Safeguards & Logging
Reasonable safeguards under s.8(5): encryption, access control, monitoring, and one-year log retention
Rule 7
Breach Detection & Notification
Every breach, with no materiality threshold, reported to each affected person and to the Board
Storage Limitation
Retention, Erasure & Minimisation
Erase personal data once its purpose is served or consent is withdrawn, including at processors
Third Parties
Processors, Intra-group & Cross-border
Accountability for processors, valid contracts, intra-group sharing and cross-border flows
Accountability
Governance, Accountability & Special Categories
Named ownership, training and evidence, plus children’s data and Significant Data Fiduciary readiness
What gets assessed
Eight compliance domains
Applicability
Scope, Parent ↔ GCC Roles & Data Inventory
Lawfulness
Lawful Basis, Notice & Consent
Rights
Data Principal Rights & Grievance Officer
Rule 6
Security Safeguards & Logging
Rule 7
Breach Detection & Notification
Storage Limitation
Retention, Erasure & Minimisation
Third Parties
Processors, Intra-group & Cross-border
Accountability
Governance, Accountability & Special Categories
What gets assessed
Eight compliance domains
Applicability
Scope, Parent ↔ GCC Roles & Data Inventory
Which personal data you process, whose it is, and whether the GCC is a Data Fiduciary or a Data Processor for each flow
Lawfulness
Lawful Basis, Notice & Consent
Processing only on consent (s.6) or a closed list of legitimate uses (s.7), with clear notice
Rights
Data Principal Rights & Grievance Officer
Access, correction, erasure and nomination rights, with grievance redressal inside 90 days
Rule 6
Security Safeguards & Logging
Reasonable safeguards under s.8(5): encryption, access control, monitoring, and one-year log retention
Rule 7
Breach Detection & Notification
Every breach, with no materiality threshold, reported to each affected person and to the Board
Storage Limitation
Retention, Erasure & Minimisation
Erase personal data once its purpose is served or consent is withdrawn, including at processors
Third Parties
Processors, Intra-group & Cross-border
Accountability for processors, valid contracts, intra-group sharing and cross-border flows
Accountability
Governance, Accountability & Special Categories
Named ownership, training and evidence, plus children’s data and Significant Data Fiduciary readiness
What gets assessed
Eight compliance domains
Applicability
Scope, Parent ↔ GCC Roles & Data Inventory
Lawfulness
Lawful Basis, Notice & Consent
Rights
Data Principal Rights & Grievance Officer
Rule 6
Security Safeguards & Logging
Rule 7
Breach Detection & Notification
Storage Limitation
Retention, Erasure & Minimisation
Third Parties
Processors, Intra-group & Cross-border
Accountability
Governance, Accountability & Special Categories
How it works
1
DPDP briefing
A two-minute read of the Act and what it means for a GCC
2
GCC profile
Certifications held, your likely DPDP role, and Indian Data Principals processed
3
Rate controls
Score each control across D1 to D8
4
Part 1 report
Readiness score, scorecard, top gaps and brief fixes
5
Part 2 report
Detailed actions with Act and Rules references, owners and timelines
Part 1: free, instant
Your readiness score, key requirement scorecard, and the clearly visible gaps with brief steps to fix them
Part 2
Detailed actions with Act and Rules references, owners and timelines
*Your answers are processed only in this browser and are never sent to a server. Nothing reaches P.R. GLOlinks unless you choose to email us
Ready to see where you stand?
Start with a two-minute briefing, then go straight into the self-assessment. About 15 minutes in total
