{
  "language": "en",
  "texts": {
    "config.lead_data_owner": "Deepak Chakravarthy, Director",
    "ui.answers.yes": "Yes",
    "ui.answers.partly": "Partly",
    "ui.answers.no": "No",
    "ui.answers.not_sure": "Not sure",
    "ui.progress": "Question {n} of {total}",
    "ui.why_we_ask": "Why we ask",
    "ui.partly_means": "\"Partly\" means",
    "ui.about_you_progress": "About you · {n} of {total}",
    "ui.start_eyebrow": "Data protection (DPDP Act) 15-minute check",
    "ui.start_title": "Is your organisation ready for India's new Data Protection Law (DPDP)?",
    "ui.start_sections.law.heading": "What is this law?",
    "ui.start_sections.law.body": "The Digital Personal Data Protection Act, 2023 (DPDP Act) is India's law on how organisations collect, use, keep and delete people's personal details. Personal details include names, phone numbers, Aadhaar numbers, photos, bank details, and health or fee records.",
    "ui.start_sections.starts.heading": "When does it start?",
    "ui.start_sections.starts.body": "Most duties start on 13 May 2027. Some parts, such as the Data Protection Board, have already started.",
    "ui.start_sections.applies.heading": "Does it apply to me?",
    "ui.start_sections.applies.body": "Yes, if you keep people's details on a computer, phone, software or cloud. This includes paper records that you later type in or scan. There is no general exemption for small organisations.",
    "ui.start_sections.matters.heading": "Why it matters",
    "ui.start_sections.matters.body": "The Data Protection Board can fine up to ₹250 crore for the most serious failures, such as not protecting data properly. Not informing the Board and the affected people about a data leak can bring a fine of up to ₹200 crore. The Board decides the amount based on how serious the failure is. If an outside company handles data for you, such as your software provider or IT support, you are still responsible for keeping it safe. Your customers, parents and business partners may also want to know how you protect their data.",
    "ui.start_about.heading": "About this check",
    "ui.start_about.items.0": "17 to 20 short questions. It takes about 10 to 15 minutes.",
    "ui.start_about.items.1": "At the end, you see your readiness level (1 = Starting out, 4 = Well prepared) and the 3 most important things to fix.",
    "ui.start_about.items.2": "This check is not legal advice and does not cover every duty in the law.",
    "ui.start_about.before": "Before you start: We first ask for your name and contact details, so Qivant can contact you about your result. The first 5 questions are about your organisation. The next 12 to 15 check your DPDP readiness, depending on your answers.",
    "ui.start_button": "Start",
    "ui.resume_button": "Continue where you left off ({progress})",
    "ui.new_check": "Start a new check",
    "ui.new_check_confirm": "Tap again to clear your answers",
    "ui.cleared_notice": "Your earlier answers were cleared from this device.",
    "ui.back": "Back",
    "ui.continue": "Continue",
    "ui.page_title": "DPDP 15-minute check · Qivant Secure",
    "ui.last_two_progress": "Last two questions · {n} of 2",
    "ui.progress_result": "Your result",
    "ui.privacy_link": "How we use your details",
    "ui.privacy_back": "Back to the check",
    "ui.local_storage_note": "Your answers are kept on this device so you can continue. Your contact details are not. They are cleared when you next open the check after 24 hours of inactivity, or once your result is saved.",
    "ui.review_banner": "Preview for internal review - not for clients.",
    "ui.review_send_off": "Sending results is switched off in this preview.",
    "bands.1.label": "Starting out",
    "bands.1.says": "Most basics are not yet in place. Start now with the three gaps below.",
    "bands.2.label": "Foundations in place",
    "bands.2.says": "Some good habits exist, but key protections are missing.",
    "bands.3.label": "Good progress",
    "bands.3.says": "Most basics are in place. The gaps below are the ones that could cost you most if something goes wrong.",
    "bands.4.label": "Well prepared",
    "bands.4.says": "You appear well prepared. A full assessment would check this against your documents and records.",
    "modules.children.label": "children's data",
    "modules.surveillance.label": "CCTV, biometrics and GPS",
    "modules.website_app.label": "website and app",
    "modules.processor.label": "handling data for your clients",
    "modules.healthcare.label": "patient records",
    "notes.children_not_sure.text": "You were not sure whether you hold details of anyone under 18. We have treated this as Yes, because schools, clinics and shops often do. Please check this first.",
    "notes.website_watch_out.text": "You have a website or app that collects people's details. Check that it shows a short privacy notice, that consent boxes are not ticked in advance, and that tracking cookies stay off until people agree.",
    "notes.higher_scrutiny.text": "Your organisation may get closer attention from the regulator. We will talk about this at the walkthrough.",
    "notes.walkthrough_first.text": "You answered Not sure to several questions, so this result is only a rough guide. A free 30-minute walkthrough with us will give you a clearer picture.",
    "result.eyebrow": "Qivant Secure · DPDP 15-Minute Check",
    "result.band_heading": "Your readiness band",
    "result.countdown": "{days} days until the main duties apply in May 2027. Starting now gives you time to prepare.",
    "result.gaps_heading": "Your top three gaps",
    "result.gap_columns.title": "Gap",
    "result.gap_columns.means": "What it means",
    "result.gap_columns.first_step": "First step",
    "result.confirm_label": "Confirm with evidence",
    "result.going_well_heading": "What is going well",
    "result.applies_heading": "What applies to you",
    "result.applies_suffix": "A full assessment would also cover these areas.",
    "result.next_step": "Next step: book a free 30-minute walkthrough. We explain these gaps and what a full assessment would cover.",
    "result.disclaimer": "This is an indicative check based on your answers. It is not an audit, a certification or legal advice. Not sure answers count as gaps until confirmed. Qivant Secure · qivant.com",
    "result.countdown_one": "{days} day until the main duties apply in May 2027. Starting now gives you time to prepare.",
    "result.booking_label": "Booking link",
    "result.months.0": "January",
    "result.months.1": "February",
    "result.months.2": "March",
    "result.months.3": "April",
    "result.months.4": "May",
    "result.months.5": "June",
    "result.months.6": "July",
    "result.months.7": "August",
    "result.months.8": "September",
    "result.months.9": "October",
    "result.months.10": "November",
    "result.months.11": "December",
    "result.confirm.title_pattern": "{topic}: confirm with evidence",
    "result.confirm.meaning": "You told us this is in place. If there is a complaint or a leak, the government may ask you to show proof.",
    "result.confirm.first_step": "Keep the proof ready to show at the walkthrough.",
    "contact.button": "Send me my result",
    "contact.fields.name.label": "Name",
    "contact.fields.role.label": "Role",
    "contact.fields.role.options.owner.label": "Owner",
    "contact.fields.role.options.principal.label": "Principal",
    "contact.fields.role.options.director.label": "Director",
    "contact.fields.role.options.it.label": "IT",
    "contact.fields.role.options.hr.label": "HR",
    "contact.fields.role.options.other.label": "Other",
    "contact.fields.role.placeholder": "Choose your role",
    "contact.fields.organisation.label": "Organisation",
    "contact.fields.organisation.hint": "The name people know you by.",
    "contact.fields.whatsapp.label": "WhatsApp number",
    "contact.fields.email.label": "Email (optional)",
    "contact.consent.label": "I agree that Qivant Secure may use my name, role, organisation, WhatsApp number, email (if given) and my answers to this check to prepare my result and contact me about it. I can withdraw this consent at any time by writing to {contact}.",
    "contact.privacy_line": "Qivant Secure is responsible for keeping your details safe. We keep them for {months} months. You can ask to see, correct or delete them, or complain, by writing to {contact}. If you are not satisfied, you can complain to the Data Protection Board of India.",
    "contact.notice_link": "Read the full privacy notice",
    "contact.heading": "Your details",
    "contact.intro": "We need a few details to prepare your result. It takes 1 minute.",
    "contact.sending": "Sending...",
    "contact.errors.name_required": "Please enter your name.",
    "contact.errors.role_required": "Please choose your role.",
    "contact.errors.organisation_required": "Please enter your organisation.",
    "contact.errors.whatsapp_invalid": "Enter a 10-digit Indian mobile number.",
    "contact.errors.email_invalid": "Enter a valid email address, or leave it empty.",
    "contact.errors.consent_required": "Please tick the box to continue.",
    "contact.errors.network": "We could not send this. Check your signal and try again. Your answers are still here.",
    "contact.errors.too_many": "You sent a result a moment ago. Please wait a few minutes before sending again.",
    "contact.errors.stale": "This page is out of date. Please refresh the page and send again.",
    "contact.errors.failed": "Something went wrong on our side. Please try again later.",
    "contact.confirmation.title": "Thank you",
    "contact.confirmation.with_contact": "We have your details. Qivant will WhatsApp you about this result.",
    "export.heading": "Save or share your result",
    "export.hint": "Optional. This appears only on your PDF or image. It is not saved or sent.",
    "export.checked_label": "Name of the person who helped (optional)",
    "export.checked_print_label": "Checked with / Run by",
    "export.pdf_button": "Download PDF",
    "export.image_button": "Save image",
    "export.making": "Preparing your file...",
    "export.failed": "Could not make the file. Please try again.",
    "export.number_heading": "#",
    "export.details_line": "Full details in your PDF report",
    "ui.language_label": "Language",
    "ui.language_failed": "Could not load Tamil. Check your signal and try again.",
    "ui.answers.not_applicable": "Not applicable",
    "profile.P1.text": "What type of organisation are you?",
    "profile.P1.options_hint": "Choose Other for labs and pharmacies.",
    "profile.P1.options.school.label": "School or college",
    "profile.P1.options.hospital.label": "Hospital or clinic",
    "profile.P1.options.manufacturing_trading.label": "Manufacturing or trading",
    "profile.P1.options.shops.label": "Shops",
    "profile.P1.options.software_it.label": "Software, IT or ERP company",
    "profile.P1.options.other.label": "Other",
    "profile.P2.text": "About how many people's details do you have today?",
    "profile.P2.hint": "Add everyone: customers, students and parents, patients, job applicants, and present and past staff. A rough guess is fine.",
    "profile.P2.options.under_100.label": "Under 100",
    "profile.P2.options.100_to_999.label": "100 to 999",
    "profile.P2.options.1000_to_9999.label": "1,000 to 9,999",
    "profile.P2.options.10k_to_1l.label": "10,000 to 1 lakh",
    "profile.P2.options.over_1l.label": "Over 1 lakh",
    "profile.P3.text": "How many staff do you have?",
    "profile.P3.options.under_100.label": "Under 100",
    "profile.P3.options.100_to_500.label": "100 to 500",
    "profile.P3.options.501_to_1000.label": "501 to 1,000",
    "profile.P3.options.over_1000.label": "More than 1,000",
    "profile.P4.text": "Do you keep personal details of anyone under 18 years old?",
    "profile.P4.hint": "For example: students, young patients or young customers.",
    "profile.P4.options.yes.label": "Yes",
    "profile.P4.options.no.label": "No",
    "profile.P4.options.not_sure.label": "Not sure",
    "profile.P5.text": "Which of these do you use? Tick all that apply.",
    "profile.P5.options.website_app.label": "A website, software, app or online form that collects people's details",
    "profile.P5.options.cctv.label": "CCTV cameras",
    "profile.P5.options.biometric.label": "Fingerprint or face scan for attendance or entry",
    "profile.P5.options.gps.label": "GPS tracking of vehicles, buses or staff",
    "profile.P5.options.none.label": "None of these",
    "readiness.Q1.text": "Have you written down what personal details you collect and where you keep them?",
    "readiness.Q1.details.0": "For example: names, phone numbers, Aadhaar, bank details, photos. These may be kept in ERP, Excel, Google Drive or other online drives, staff phones, or paper forms that are later typed or scanned into a computer.",
    "readiness.Q1.partly_means": "There is a list, but it covers only some systems or places, or it is more than a year old.",
    "readiness.Q1.why_we_ask": "You cannot protect, explain or delete data you have not listed.",
    "readiness.Q1.reference": "s.8(1); Rule 6",
    "readiness.Q1.notes.BR-3": "Note for software and IT companies: For the next questions, think only about your own company's data, such as your staff, job applicants and customers. The last question asks about the data you handle for your clients.",
    "readiness.Q1.result.topic": "Data list",
    "readiness.Q1.result.gap.no.title": "You don't have a list of the personal data you hold",
    "readiness.Q1.result.gap.no.means": "If you don't know what personal data you hold and where it is stored, you can't protect it, explain it to people or delete it on time.",
    "readiness.Q1.result.gap.no.first_step": "List each system you use (ERP, Tally, Excel files, Google Drive or other online drives such as OneDrive or Dropbox, staff phones) and write down what personal data each one holds.",
    "readiness.Q1.result.gap.partly.title": "Your data list is incomplete or out of date",
    "readiness.Q1.result.gap.partly.means": "Personal data in a system that is missing from your data list is easily forgotten. It can leak, or be kept long after it should be deleted, without anyone noticing.",
    "readiness.Q1.result.gap.partly.first_step": "Add the missing systems to your data list, update anything that has changed, and write today's date on it.",
    "readiness.Q1.result.gap.not_sure.title": "You may not have a data list",
    "readiness.Q1.result.gap.not_sure.means": "If no one can show you a data list, you can't tell a customer or the Data Protection Board where their personal data is kept.",
    "readiness.Q1.result.gap.not_sure.first_step": "Ask your office manager or IT person whether a data list exists. If there isn't one, start a data list this week.",
    "readiness.Q1.result.going_well": "You keep a current list of the personal data you hold and where it is.",
    "readiness.Q2.text": "Do you collect only the details you really need?",
    "readiness.Q2.details.0": "For example, you don't take Aadhaar copies or bank details unless you actually need them.",
    "readiness.Q2.partly_means": "Some of your forms ask only for what you need, but others still ask for details you don't use.",
    "readiness.Q2.why_we_ask": "The DPDP Act allows you to collect and use only the personal data that your stated purpose needs. Anything extra adds risk without benefit.",
    "readiness.Q2.reference": "s.4(1), s.6(1)",
    "readiness.Q2.result.topic": "Collecting only what you need",
    "readiness.Q2.result.gap.no.title": "Your forms ask for more personal data than you need",
    "readiness.Q2.result.gap.no.means": "You should collect only the personal data you really need. Every extra detail you collect is one more detail that could leak.",
    "readiness.Q2.result.gap.no.first_step": "Start with your most-used form. Remove the fields you don't use, such as Aadhaar or bank details collected 'just in case'.",
    "readiness.Q2.result.gap.partly.title": "Some of your forms still ask for details you don't use",
    "readiness.Q2.result.gap.partly.means": "A detail you collect but never use gives you no benefit, but you are still responsible if it leaks.",
    "readiness.Q2.result.gap.partly.first_step": "For the forms you haven't checked yet, list every field and who uses it. Remove the fields nobody uses.",
    "readiness.Q2.result.gap.not_sure.title": "You may be collecting more personal data than you need",
    "readiness.Q2.result.gap.not_sure.means": "If no one has checked your forms, they may be asking for details you don't need. Each extra detail is one more that could leak.",
    "readiness.Q2.result.gap.not_sure.first_step": "Take your most-used form and check what each field is used for.",
    "readiness.Q2.result.going_well": "You collect only the details you need.",
    "readiness.Q3.text": "On your forms that collect personal details, do you explain in simple words what you collect, why you need it, and whom to contact with questions or complaints?",
    "readiness.Q3.details.0": "Forms such as admission, registration, job application or website sign-up.",
    "readiness.Q3.details.1": "You don't need this for a normal bill or delivery, where people give details only to get your service.",
    "readiness.Q3.partly_means": "Only some forms have this note, or it is hidden inside a long policy.",
    "readiness.Q3.why_we_ask": "People must be told clearly what you collect, why, and how to contact you, in a note of its own.",
    "readiness.Q3.reference": "s.5; Rule 3; s.7(a)",
    "readiness.Q3.result.topic": "Notice on forms",
    "readiness.Q3.result.gap.no.title": "Your forms don't have a privacy note",
    "readiness.Q3.result.gap.no.means": "When you ask people for consent to use their personal data, you must first give them a short, separate privacy note. It must say what you collect, why, and how they can withdraw consent or complain. A line inside a long privacy policy is not enough.",
    "readiness.Q3.result.gap.no.first_step": "Start with your most-used form. Write a short privacy note saying what you collect, why, and whom to contact.",
    "readiness.Q3.result.gap.partly.title": "Some of your forms don't have a privacy note",
    "readiness.Q3.result.gap.partly.means": "People who fill in a form without a privacy note, or with the note hidden in a long policy, have not been properly told how their data will be used.",
    "readiness.Q3.result.gap.partly.first_step": "Add a short privacy note to each form that doesn't have one. If the note is hidden in a long policy, put it on the form itself.",
    "readiness.Q3.result.gap.not_sure.title": "Your forms may not have a privacy note",
    "readiness.Q3.result.gap.not_sure.means": "If you can't show the privacy note on a form, you can't prove that people were told how their data would be used.",
    "readiness.Q3.result.gap.not_sure.first_step": "Check each form, paper and online, and look for the privacy note.",
    "readiness.Q3.result.going_well": "People are told what you collect and why when they give their details.",
    "readiness.Q4.text": "Do you ask people separately before using their details for anything other than your main work with them, and let them say no?",
    "readiness.Q4.details.0": "For example: marketing messages, posting their photos on social media, or adding them to WhatsApp groups.",
    "readiness.Q4.partly_means": "Some uses have a separate choice, but not all, or the 'yes' box is already ticked.",
    "readiness.Q4.why_we_ask": "Agreement only counts if people give it freely, separately for each use, and can refuse.",
    "readiness.Q4.reference": "s.6(1), s.6(4)",
    "readiness.Q4.result.topic": "Separate choices",
    "readiness.Q4.result.gap.no.title": "One \"I agree\" box covers all uses of personal data",
    "readiness.Q4.result.gap.no.means": "Consent is valid only if people can say yes or no separately to each use of their data, such as marketing or photos.",
    "readiness.Q4.result.gap.no.first_step": "Give marketing messages, photos and adding people to WhatsApp groups a separate consent box each, left unticked.",
    "readiness.Q4.result.gap.partly.title": "Some uses of personal data don't have a separate consent box",
    "readiness.Q4.result.gap.partly.means": "A consent box that is already ticked, or one box that covers several uses, is not valid consent.",
    "readiness.Q4.result.gap.partly.first_step": "Untick any pre-ticked consent boxes, and give each use its own box.",
    "readiness.Q4.result.gap.not_sure.title": "You may not be asking for consent separately for each use",
    "readiness.Q4.result.gap.not_sure.means": "If you can't show a separate consent for each use, you can't prove that consent was given.",
    "readiness.Q4.result.gap.not_sure.first_step": "Check your forms and WhatsApp group sign-ups. Make sure marketing, photos and adding people to groups each have their own consent box.",
    "readiness.Q4.result.going_well": "People get a separate choice for each extra, such as marketing and photos.",
    "readiness.Q5.text": "If someone wants to see, correct or delete their details, or wants to complain:",
    "readiness.Q5.details.0.items.0": "Have you shown a contact person's name and phone number or email? (On your website if you have one, and also on your forms.)",
    "readiness.Q5.details.0.items.1": "Do you reply within a fixed time? (No later than 90 days for complaints.)",
    "readiness.Q5.partly_means": "A contact is shown, but not everywhere, or there is no fixed reply time.",
    "readiness.Q5.why_we_ask": "People can ask to see, correct or delete their data, or complain, so they need a named contact and a timely reply.",
    "readiness.Q5.reference": "s.8(9)–(10), s.11–13; Rules 9, 14",
    "readiness.Q5.result.topic": "Contact for data requests",
    "readiness.Q5.result.gap.no.title": "You haven't published a contact for data requests",
    "readiness.Q5.result.gap.no.means": "People have the right to see, correct or delete their personal data, and to complain. They need a named contact for these requests.",
    "readiness.Q5.result.gap.no.first_step": "Publish the name and email or phone number of the person who handles data requests, on your website, forms and notice board.",
    "readiness.Q5.result.gap.partly.title": "Your data-request contact is hard to find, or has no reply deadline",
    "readiness.Q5.result.gap.partly.means": "If people can't find who to contact, or don't hear back in time, their requests and complaints go unanswered. Complaints must be answered within 90 days.",
    "readiness.Q5.result.gap.partly.first_step": "Show the same contact on your website and every form, and set a reply time (no more than 90 days for complaints).",
    "readiness.Q5.result.gap.not_sure.title": "You may not have a published contact for data requests",
    "readiness.Q5.result.gap.not_sure.means": "People who can't find your data-request contact can't use their rights.",
    "readiness.Q5.result.gap.not_sure.first_step": "Check your website and forms for a data-request contact. If there isn't one, add it this week.",
    "readiness.Q5.result.going_well": "People can find a named contact for data requests and complaints.",
    "readiness.Q6.text": "Does every staff member have their own login, with no shared passwords?",
    "readiness.Q6.details.0": "And do staff need a code on their phone (OTP) or an authenticator app, as well as a password, to sign in to email and other important accounts?",
    "readiness.Q6.partly_means": "Own logins or the second check on some systems only, or some logins are still shared.",
    "readiness.Q6.why_we_ask": "Shared or stolen passwords are the most common way data gets out.",
    "readiness.Q6.reference": "Rule 6(1)(b)",
    "readiness.Q6.result.topic": "Own logins and second login step",
    "readiness.Q6.result.gap.no.title": "Staff share logins, and no account asks for an OTP",
    "readiness.Q6.result.gap.no.means": "When staff share a password, you can't tell who opened the data. Without OTP, anyone who steals or guesses a password can get into your email and records.",
    "readiness.Q6.result.gap.no.first_step": "This week, turn on OTP or an authenticator app for email and admin accounts. Then give each staff member their own login.",
    "readiness.Q6.result.gap.partly.title": "Only some systems have individual logins or OTP",
    "readiness.Q6.result.gap.partly.means": "One shared login, such as on the ERP or CCTV recorder, or one email account without OTP, can be the gap an attacker uses to get in.",
    "readiness.Q6.result.gap.partly.first_step": "List the shared logins and the accounts without OTP. Fix email and admin accounts first.",
    "readiness.Q6.result.gap.not_sure.title": "You may not know which logins are shared or have OTP",
    "readiness.Q6.result.gap.not_sure.means": "If you can't say who uses a login, or whether OTP is on, treat that login as unsafe.",
    "readiness.Q6.result.gap.not_sure.first_step": "Ask your IT person for a list of each system, who logs in to it, and whether OTP is turned on.",
    "readiness.Q6.result.going_well": "Every staff member has their own login, and email and admin accounts need a second login step.",
    "readiness.Q7.text": "Do your computer systems keep a record of who opened or changed personal details, and do you keep this record for at least 1 year?",
    "readiness.Q7.details.0": "Most software, such as Tally, ERP, Google Workspace or Microsoft 365, can keep this record. If you don't know, choose Not sure.",
    "readiness.Q7.partly_means": "Some systems keep this record, or it is kept for less than a year.",
    "readiness.Q7.why_we_ask": "The Rules require records of who accessed personal data, kept for at least one year, so a leak can be traced.",
    "readiness.Q7.reference": "Rule 6(1)(c), (e)",
    "readiness.Q7.result.topic": "Access records",
    "readiness.Q7.result.gap.no.title": "Your systems don't record who opens or changes personal data",
    "readiness.Q7.result.gap.no.means": "The DPDP Rules require a record (access log) of who accessed personal data, kept for at least one year, so that a leak can be traced.",
    "readiness.Q7.result.gap.no.first_step": "Start with your main system (Tally, ERP, Google Workspace or Microsoft 365). Turn on its activity log and set it to keep records for one year.",
    "readiness.Q7.result.gap.partly.title": "Only some systems keep access logs, or logs are kept for less than a year",
    "readiness.Q7.result.gap.partly.means": "If a leak happens on a system without access logs, or after the logs are deleted, you can't find out who accessed the data.",
    "readiness.Q7.result.gap.partly.first_step": "List the systems without access logs. Turn logs on and set them to be kept for one year.",
    "readiness.Q7.result.gap.not_sure.title": "You may not be keeping access logs",
    "readiness.Q7.result.gap.not_sure.means": "If you can't confirm that access logs exist, you can't show who saw the personal data.",
    "readiness.Q7.result.gap.not_sure.first_step": "Ask your IT person or software vendor whether access logs are on, and how long they are kept.",
    "readiness.Q7.result.going_well": "Your systems record who opens or changes personal details, and you keep the records for at least 1 year.",
    "readiness.Q8.text": "Do all laptops and phones that hold personal details have:",
    "readiness.Q8.details.0.items.0": "a screen lock (PIN, password or fingerprint), and",
    "readiness.Q8.details.0.items.1": "encryption switched on in the laptops (BitLocker on Windows, FileVault on Mac)?",
    "readiness.Q8.details.1": "Most phones encrypt automatically once a screen lock is set. If you don't know, choose Not sure.",
    "readiness.Q8.partly_means": "Some devices are protected, or they have a lock but no encryption.",
    "readiness.Q8.why_we_ask": "A lost laptop or phone without protection counts as a data leak.",
    "readiness.Q8.reference": "Rule 6(1)(a)",
    "readiness.Q8.result.topic": "Device encryption",
    "readiness.Q8.result.gap.no.title": "Your laptops and phones aren't encrypted",
    "readiness.Q8.result.gap.no.means": "If a laptop or phone without encryption is lost or stolen, anyone who has it can read the personal data on it. You may then have to treat it as a data leak.",
    "readiness.Q8.result.gap.no.first_step": "List staff laptops and phones. Turn on built-in encryption (such as BitLocker on Windows or FileVault on Mac) and a screen lock on each one.",
    "readiness.Q8.result.gap.partly.title": "Only some laptops and phones are encrypted",
    "readiness.Q8.result.gap.partly.means": "Each unencrypted laptop or phone can expose personal data if it is lost or stolen.",
    "readiness.Q8.result.gap.partly.first_step": "Find the laptops and phones without encryption and turn encryption on, starting with those used by your accounts or HR team.",
    "readiness.Q8.result.gap.not_sure.title": "Your laptops and phones may not be encrypted",
    "readiness.Q8.result.gap.not_sure.means": "If you don't know whether a laptop is encrypted, assume that anyone who finds it can read the data on it.",
    "readiness.Q8.result.gap.not_sure.first_step": "Check each staff laptop and confirm that built-in encryption is turned on, and that each phone has a screen lock.",
    "readiness.Q8.result.going_well": "Staff laptops and phones holding personal data are locked and encrypted.",
    "readiness.Q9.text": "Do you keep a recent backup of important data in a separate place, and have you checked that you can restore it?",
    "readiness.Q9.partly_means": "Backups are taken but never tested, or they are kept in the same place as the original.",
    "readiness.Q9.why_we_ask": "You must be able to recover data and keep working after an attack or failure.",
    "readiness.Q9.reference": "Rule 6(1)(d)",
    "readiness.Q9.result.topic": "Backups",
    "readiness.Q9.result.gap.no.title": "You have no recent backup kept in a separate place",
    "readiness.Q9.result.gap.no.means": "Without a backup, a cyber attack or system failure could wipe out your data and stop your work.",
    "readiness.Q9.result.gap.no.first_step": "Back up important data on a fixed schedule to a separate place, such as a cloud account or an external drive kept outside the office.",
    "readiness.Q9.result.gap.partly.title": "Your backup is untested, or kept in the same place as the original data",
    "readiness.Q9.result.gap.partly.means": "A backup that has never been restored may not work. A backup kept next to the original data can be lost in the same attack, fire or theft.",
    "readiness.Q9.result.gap.partly.first_step": "This month, restore one file or system from the backup to check that it works. Keep one copy in a separate place.",
    "readiness.Q9.result.gap.not_sure.title": "You may not have a working backup",
    "readiness.Q9.result.gap.not_sure.means": "If no one has tested the backup, assume it can't be restored.",
    "readiness.Q9.result.gap.not_sure.first_step": "Ask who takes the backup, where it is stored and when it was last restored.",
    "readiness.Q9.result.going_well": "You keep a recent backup in a separate place and have checked that you can restore it.",
    "readiness.Q10.text": "If personal data leaked or was hacked tomorrow, do you have a written process that covers:",
    "readiness.Q10.details.0.items.0": "who decides what to do",
    "readiness.Q10.details.0.items.1": "how you will find out whose data was affected",
    "readiness.Q10.details.0.items.2": "who will inform those people and the Data Protection Board without delay, and send the Board a full report within 72 hours?",
    "readiness.Q10.details.1": "If the leak is a cyber attack, it must also be reported to CERT-In (the government's cyber security agency) within 6 hours.",
    "readiness.Q10.partly_means": "Someone is understood to be in charge, but the steps are not written down.",
    "readiness.Q10.why_we_ask": "Every leak must be reported to the Board and to each person affected; the Board needs a full report within 72 hours.",
    "readiness.Q10.reference": "s.8(6); Rule 7; CERT-In Directions, 28 April 2022",
    "readiness.Q10.result.topic": "Leak plan",
    "readiness.Q10.result.gap.no.title": "You have no written plan for a data leak",
    "readiness.Q10.result.gap.no.means": "Without a written plan, no one knows who decides, or who informs the affected people and the Data Protection Board. You must send the Board a full report within 72 hours of finding out about the leak.",
    "readiness.Q10.result.gap.no.first_step": "Write a one-page leak plan covering who decides, how you find whose data was affected, and who informs them and the Board. For a cyber attack, also report to CERT-In within 6 hours.",
    "readiness.Q10.result.gap.partly.title": "Your leak plan isn't fully written down",
    "readiness.Q10.result.gap.partly.means": "A plan that exists only in people's heads often fails under pressure, and no one is responsible for the 72-hour report to the Board.",
    "readiness.Q10.result.gap.partly.first_step": "Write down who decides, how you find the affected people, and who informs them and the Board. Test the plan once with a practice run.",
    "readiness.Q10.result.gap.not_sure.title": "You may not have a leak plan",
    "readiness.Q10.result.gap.not_sure.means": "If no one knows who is in charge during a leak, hours are lost while the 72-hour deadline runs.",
    "readiness.Q10.result.gap.not_sure.first_step": "Ask your team who they would call first if personal data leaked, and write the answer down.",
    "readiness.Q10.result.going_well": "You have a written leak plan: who decides, how you find the people affected, and who informs them and the Board.",
    "readiness.Q11.text": "Do any outside companies or people handle personal details for you?",
    "readiness.Q11.details.0": "For example: your website or cloud host, payroll or accounting software, IT support person, or bulk SMS or WhatsApp service.",
    "readiness.Q11.details.1": "If yes, does each one have a signed agreement saying they must:",
    "readiness.Q11.details.2.items.0": "keep the data safe",
    "readiness.Q11.details.2.items.1": "tell you immediately if it leaks",
    "readiness.Q11.details.2.items.2": "delete it when the work ends?",
    "readiness.Q11.details.3": "Choose \"Not applicable\" if no outside company handles your data.",
    "readiness.Q11.partly_means": "Only some of these companies have an agreement, or it does not cover safety, leaks and deletion.",
    "readiness.Q11.why_we_ask": "Under the DPDP Act you remain responsible for personal data that outside companies handle for you, so each one should be bound by a written agreement.",
    "readiness.Q11.reference": "s.8(1)–(2); Rule 6(1)(f)",
    "readiness.Q11.result.topic": "Agreements with outside companies",
    "readiness.Q11.result.gap.no.title": "You have no signed agreements with outside companies that handle your data",
    "readiness.Q11.result.gap.no.means": "The law requires a valid contract with each company that handles personal data for you, and you remain responsible for what they do with it.",
    "readiness.Q11.result.gap.no.first_step": "List the outside companies that handle your personal data. Start with the one that handles the most and ask it to sign an agreement saying it will keep the data safe, tell you immediately if it leaks, and delete it when the work ends.",
    "readiness.Q11.result.gap.partly.title": "Some outside companies that handle your data have no proper agreement",
    "readiness.Q11.result.gap.partly.means": "Without an agreement that covers data safety and leaks, a company may not tell you when your data leaks. You would still have to inform the affected people and the Data Protection Board, and it would be harder to claim your losses from the company.",
    "readiness.Q11.result.gap.partly.first_step": "Start with the company that handles the most data. Sign an agreement with it, or add terms to the one you have, saying it will keep the data safe, tell you immediately if it leaks, and delete it when the work ends.",
    "readiness.Q11.result.gap.not_sure.title": "You may not have signed agreements with outside companies",
    "readiness.Q11.result.gap.not_sure.means": "If you can't produce a signed agreement, assume there isn't one.",
    "readiness.Q11.result.gap.not_sure.first_step": "Ask each outside company that handles your data for a copy of the signed agreement.",
    "readiness.Q11.result.going_well": "The outside companies that handle your data have signed agreements covering security and leak reporting.",
    "readiness.Q12.text": "Do you delete personal details you no longer need, on a fixed schedule?",
    "readiness.Q12.details.0": "For example: old job applications, ex-staff files and old CCTV footage.",
    "readiness.Q12.details.1": "Do NOT delete records that a law requires you to keep (school, medical, tax or staff records). Also do not delete system records (logs) that are less than 1 year old.",
    "readiness.Q12.partly_means": "We delete old data now and then, but not on a fixed schedule.",
    "readiness.Q12.why_we_ask": "Data must be deleted once it is no longer needed, unless a law says keep it.",
    "readiness.Q12.reference": "s.8(7); Rule 8",
    "readiness.Q12.result.topic": "Deleting old data",
    "readiness.Q12.result.gap.no.title": "You never delete old personal data",
    "readiness.Q12.result.gap.no.means": "Personal data must be deleted once it is no longer needed, unless a law requires you to keep it. But do not delete personal data or logs that are less than one year old.",
    "readiness.Q12.result.gap.no.first_step": "List old job applications, former staff files and CCTV footage older than one year. Delete what you no longer need and no law requires you to keep.",
    "readiness.Q12.result.gap.partly.title": "You delete old personal data now and then, but not on a schedule",
    "readiness.Q12.result.gap.partly.means": "Without a deletion schedule, old data builds up, and you can't show it was deleted on time.",
    "readiness.Q12.result.gap.partly.first_step": "Decide how long to keep each type of personal data (at least one year for the logs and records the Rules require), and set a yearly reminder to delete.",
    "readiness.Q12.result.gap.not_sure.title": "You may not be deleting old personal data",
    "readiness.Q12.result.gap.not_sure.means": "Old job applications, former staff files and CCTV footage usually pile up unnoticed, and each old file is one more that could leak.",
    "readiness.Q12.result.gap.not_sure.first_step": "Pick one folder or system and check the date of its oldest personal data.",
    "readiness.Q12.result.going_well": "You delete personal details you no longer need on a set schedule.",
    "readiness.Q13.text": "Before using a child's details, do you get the parent's consent?",
    "readiness.Q13.details.0": "Keep proof of consent, such as a signed form checked against the parent details you hold. Do not track children online or show them targeted ads.",
    "readiness.Q13.variants.school_health.text": "Before using a child's details for anything other than education, health care or the child's safety, do you get the parent's consent?",
    "readiness.Q13.variants.school_health.details.0": "For example: photos on social media, or marketing.",
    "readiness.Q13.variants.school_health.details.1": "Keep proof of consent, such as a signed form checked against the parent details you hold. Do not track children online or show them targeted ads.",
    "readiness.Q13.partly_means": "Consent is taken for some uses only, or it is not recorded.",
    "readiness.Q13.why_we_ask": "A parent's consent that you can prove is required before using a child's personal data. Tracking children or showing them targeted advertising is not permitted.",
    "readiness.Q13.reference": "s.9; Rules 10, 12; Fourth Schedule",
    "readiness.Q13.result.topic": "Parent consent",
    "readiness.Q13.result.gap.no.title": "You don't take provable parent consent before using a child's data",
    "readiness.Q13.result.gap.no.means": "Anyone under the age of 18 is considered a child. Before using a child's personal data, you must get the parent's consent. You must also confirm who the parent is, and keep proof of both. You must not track children's behaviour or show them targeted ads.",
    "readiness.Q13.result.gap.no.first_step": "Take parent consent on a signed form, check the parent's details against records you already hold, and keep the record.",
    "readiness.Q13.variants.school_health.result.gap.no.title": "You don't take parent consent for uses such as photos or marketing",
    "readiness.Q13.variants.school_health.result.gap.no.means": "Anyone under the age of 18 is considered a child. Schools, colleges, hospitals and clinics do not need separate parent consent for some uses linked to education, health care or the child's safety. But for other uses, such as photos on social media or marketing, you need the parent's consent and must be able to prove it.",
    "readiness.Q13.variants.school_health.result.gap.no.first_step": "Take parent consent on a signed form for these other uses, check it against the parent details in your admission or patient records, and keep the record.",
    "readiness.Q13.result.gap.partly.title": "Parent consent is taken for some uses only, or isn't recorded",
    "readiness.Q13.result.gap.partly.means": "Parent consent that you can't prove is treated as not taken.",
    "readiness.Q13.result.gap.partly.first_step": "Record each parent consent: who gave it, when, and for what use. Start with photos, marketing and apps.",
    "readiness.Q13.result.gap.not_sure.title": "You may not have provable parent consent",
    "readiness.Q13.result.gap.not_sure.means": "If you can't show a parent's consent, assume you don't have it.",
    "readiness.Q13.result.gap.not_sure.first_step": "Pick one use (photos, marketing or an app) and check whether you can produce the parent's consent for it.",
    "readiness.Q13.result.going_well": "You get a parent's consent you can prove before using a child's details.",
    "readiness.Q14.text": "Can only staff you have named see CCTV footage, fingerprint or face data, and GPS location data?",
    "readiness.Q14.details.0": "Is this data kept off staff members' personal phones and WhatsApp? (The owner's own secured app is fine.)",
    "readiness.Q14.partly_means": "Viewing is limited, but copies still reach personal phones, or not every site is controlled.",
    "readiness.Q14.why_we_ask": "Camera, fingerprint and location data are some of the most private data you hold.",
    "readiness.Q14.reference": "s.8(5); Rule 6(1)(b)–(c)",
    "readiness.Q14.result.topic": "Footage and location access",
    "readiness.Q14.result.gap.no.title": "Access to CCTV, fingerprint, face scan or location data isn't limited to named staff",
    "readiness.Q14.result.gap.no.means": "CCTV footage, fingerprints, face scans and location data are among the most sensitive data you hold. Only named staff should be able to view them.",
    "readiness.Q14.result.gap.no.first_step": "Allow only named staff, each with their own login, to view this data. Stop copying footage to personal phones or WhatsApp.",
    "readiness.Q14.result.gap.partly.title": "Viewing is limited, but footage is still copied to phones or WhatsApp",
    "readiness.Q14.result.gap.partly.means": "Footage copied to personal phones or WhatsApp is a common way it leaks.",
    "readiness.Q14.result.gap.partly.first_step": "Stop copying footage to personal phones and WhatsApp. Agree one controlled way to share footage when someone asks for it.",
    "readiness.Q14.result.gap.not_sure.title": "You may not control who can view CCTV, fingerprint, face scan or location data",
    "readiness.Q14.result.gap.not_sure.means": "If you can't say who can view this data, assume anyone can.",
    "readiness.Q14.result.gap.not_sure.first_step": "Find out who has the CCTV recorder login and who has copied footage to a phone.",
    "readiness.Q14.result.going_well": "Only named staff can view CCTV, biometric and location data, and it isn't copied to personal phones.",
    "readiness.Q15.text": "For data you handle for your clients, do your client contracts say:",
    "readiness.Q15.details.0.items.0": "what you may and may not do with the data",
    "readiness.Q15.details.0.items.1": "how fast you will tell them about a leak (for example, within 24 hours)",
    "readiness.Q15.details.0.items.2": "which outside companies you use",
    "readiness.Q15.details.0.items.3": "that you will help them answer people's requests",
    "readiness.Q15.details.0.items.4": "that you will return or delete the data when the contract ends?",
    "readiness.Q15.partly_means": "Some contracts cover this, or they have only a general confidentiality clause.",
    "readiness.Q15.why_we_ask": "Your clients are legally responsible for the personal data you handle for them, so they will expect these terms in your contract.",
    "readiness.Q15.reference": "s.8(2); Rule 6(1)(f)",
    "readiness.Q15.result.topic": "Client contract terms",
    "readiness.Q15.result.gap.no.title": "Your client contracts don't say how you handle their customers' data",
    "readiness.Q15.result.gap.no.means": "When you handle personal data for clients, the clients remain responsible for it and will expect your contract to cover it.",
    "readiness.Q15.result.gap.no.first_step": "Add three clauses: use the data only as the client instructs, tell the client about a leak within an agreed time (for example, 24 hours), and delete or return the data when the contract ends.",
    "readiness.Q15.result.gap.partly.title": "Only some client contracts cover data handling, or they have only a confidentiality clause",
    "readiness.Q15.result.gap.partly.means": "A confidentiality clause alone doesn't say how fast you must tell the client about a leak, or that you must delete their data when the contract ends.",
    "readiness.Q15.result.gap.partly.first_step": "In the contracts that don't have them, add clauses saying you will tell the client about a leak within an agreed time and delete their data when the contract ends.",
    "readiness.Q15.result.gap.not_sure.title": "Your client contracts may not have data handling clauses",
    "readiness.Q15.result.gap.not_sure.means": "If a client asks for these clauses and you can't show them, you could lose the contract.",
    "readiness.Q15.result.gap.not_sure.first_step": "Take your three biggest client contracts and check for three clauses: using the data only as the client instructs, telling the client about a leak within an agreed time, and deleting or returning the data at the end.",
    "readiness.Q15.result.going_well": "Your client contracts say how you use their data, how fast you report a leak, and that you delete it at the end.",
    "lead_questions.L1.text": "What made you check data protection now?",
    "lead_questions.L1.options.customer_asked.label": "A customer, parent or partner asked",
    "lead_questions.L1.options.contract_requires.label": "A contract or tender needs it",
    "lead_questions.L1.options.incident.label": "We had a data leak or a close call",
    "lead_questions.L1.options.management_auditor.label": "Management or our auditor asked",
    "lead_questions.L1.options.heard_new_law.label": "Heard about the new data protection law (DPDP)",
    "lead_questions.L1.options.other.label": "Other",
    "lead_questions.L2.text": "By when do you want to be DPDP compliant?",
    "lead_questions.L2.options.within_3_months.label": "Within 3 months",
    "lead_questions.L2.options.before_may_2027.label": "Before 13 May 2027",
    "lead_questions.L2.options.no_fixed_date.label": "No fixed date",
    "lead_questions.L2.options.just_exploring.label": "Just exploring",
    "contact.notice.heading": "About your details",
    "contact.notice.who.0": "This form is run by Qivant Secure.",
    "contact.notice.who.entity": "This check is run by Qivant Secure, a unit of DSSA Solutions LLP, Coimbatore.",
    "contact.notice.who.1": "The person responsible for your details at Qivant is {owner}.",
    "contact.notice.who.2": "For the contact details you give us, Qivant Secure is the Data Fiduciary: it decides how they are used and is responsible for keeping them safe. Your answers to the check are used only to produce your result and to help us advise you.",
    "contact.notice.contact_line": "Questions about your details: {contact}.",
    "contact.notice.collected.heading": "What we collect",
    "contact.notice.collected.items.0": "Your name.",
    "contact.notice.collected.items.1": "Your role.",
    "contact.notice.collected.items.2": "Your organisation.",
    "contact.notice.collected.items.3": "Your WhatsApp number.",
    "contact.notice.collected.items.4": "Your email address, only if you choose to give it.",
    "contact.notice.collected.items.5": "Your answers to the check questions.",
    "contact.notice.collected.items.6": "Your readiness level (1 to 4).",
    "contact.notice.collected.items.7": "Why you are looking at data protection now, and when you want to be ready.",
    "contact.notice.collected.items.8": "The time you gave your consent, and the language you used.",
    "contact.notice.purpose.heading": "Why we collect it",
    "contact.notice.purpose.items.0": "To contact you about your result.",
    "contact.notice.retention.heading": "How long we keep it",
    "contact.notice.retention.paras.0": "We keep your details for {months} months from the day you finish the check. Then we delete them.",
    "contact.notice.retention.paras.1": "If you become our client, we move your details to your client record and delete them from this system within {converted_days} days.",
    "contact.notice.withdraw.heading": "Changing your mind",
    "contact.notice.withdraw.paras.0": "You can withdraw your consent at any time by writing to {contact}.",
    "contact.notice.rights.heading": "Your rights",
    "contact.notice.rights.intro": "You can ask us to:",
    "contact.notice.rights.items.0": "show you the details we hold about you",
    "contact.notice.rights.items.1": "correct them",
    "contact.notice.rights.items.2": "delete them",
    "contact.notice.rights.items.3": "deal with your request through another person you name.",
    "contact.notice.rights.paras.0": "Send your request to {contact}.",
    "contact.notice.grievance.heading": "Complaints",
    "contact.notice.grievance.paras.0": "If you have a complaint, write to {grievance_contact}. We will reply within {grievance_days} days.",
    "contact.notice.board.heading": "If you are not satisfied",
    "contact.notice.board.paras.0": "If you are not happy with our reply, you can complain to the Data Protection Board of India through its official website or app."
  }
}