Is your website ready for India's DPDP law? Check it free.
Enter your website's address. We read your privacy notice and the forms on your pages, and check them against the Digital Personal Data Protection Act and Rules 2025. You get a clear list of what's in place and what's missing, in a few minutes.
Free. Results in about 5 minutes, with a full website health check alongside.
Key dates
The DPDP Act became law in 2023. The Rules that put it into practice were notified on 13 November 2025, and apply in stages. The government has proposed bringing some dates forward; as of November 2026, none has changed, so treat May 2027 as the latest date, not the target.
13 November 2025
The DPDP Rules were notified, and the Data Protection Board of India was set up.
13 November 2026
The rules for Consent Managers start: registered companies that help people give, manage and withdraw consent. If someone uses one, your website must accept their consent and withdrawals through it.
13 May 2027
Most duties apply: the privacy notice, consent, keeping personal data safe, reporting breaches, deleting data you no longer need, children's data, and people's rights to see, correct and erase their data.
What the DPDP law asks of your website
If your website collects personal details from people in India, such as a name, email or phone number in a contact form, these apply to you. Our free check looks for each one.
A clear privacy notice
In plain language: what personal data you collect and why, before or when you collect it. It should stand on its own, not be buried in your terms.
Consent where data is collected
People should agree to what you'll do with their details, clearly and for a stated purpose, at the form or sign-up.
An easy way to withdraw consent
Withdrawing should be as easy as giving consent, and the notice should say how.
People's rights
A way for people to see a summary of their data, have it corrected or erased, and name someone to act for them.
A contact for questions and complaints
The contact details of your Data Protection Officer or a person who can answer questions about personal data, and how complaints are handled.
How to complain to the Board
The notice should tell people they can complain to the Data Protection Board of India.
Retention, processors and breaches
How long you keep data, which other companies process it for you, and that you'll tell people and the Board if there's a breach.
Children's data
If children may use your website, verifiable consent from a parent before you process their data.
Why it's worth checking now
The penalties under the Act are set per breach of duty, and they are large. Most of what the law asks of a website is simple to put in place once you know what's missing.
Up to ₹250 crore
For not taking reasonable security safeguards to prevent a personal data breach.
Up to ₹200 crore
For not telling the Board and the people affected about a breach, or for not meeting the duties for children's data.
Up to ₹50 crore
For other breaches of the Act or the Rules.
Three ways to check your app
Start free, from the outside, the way any visitor sees your app. Then let us in as a test user to check the app itself, or as two or three users for the audit-ready check.
Security from the outside
- Secret keys in your app's code, and databases anyone can read
- Private files left online (.env, .git), published source code
- Security headers, sign-in cookies and the certificate
- API docs, diagnostics and folders open to anyone
- Libraries with known vulnerabilities, error pages that leak details
- Load speed, and your public pages if you have any
The product itself
- Access control: can a normal user reach admin screens or other customers' data?
- What your server sends the browser: password data, codes, secret keys
- Personal data in addresses or sent to third parties; cookies, CORS, GraphQL
- Errors, failed requests and broken screens
- Numbers and calculations checked across every screen
- Usability and layout on a computer and a phone
Offered on your report once the free check sees an app. Money back if we can't sign in.
Audit-ready check
- Everything in the ₹299 check
- Two or three test users: every request repeated as each one, to see who can read what
- Safe security tests on your test copy, such as injection and cross-site scripting
- Sign-in, sessions and tokens
- Accessibility (WCAG 2.2) and India's data protection law (DPDP)
- OWASP, WSTG and ASVS references on every finding, and a free re-check after you fix things
Runs on a test copy of your app, with your written permission. Full refund if we can't complete your report.
FAQ
What is the DPDP Act?
The Digital Personal Data Protection Act, 2023 is India's data protection law. It sets out how organisations may collect and use people's digital personal data, and the rights people have over it. The DPDP Rules 2025 put it into practice.
Does the DPDP Act apply to my website?
It applies if your website collects digital personal data of people in India: a contact or enquiry form, a sign-up, a newsletter, a booking or a chat that asks for a name, email or phone number. It also applies to businesses outside India that offer goods or services to people in India.
When do I need to comply?
Most duties apply from 13 May 2027, including the privacy notice, consent, security, breach reporting and people's rights. The rules for Consent Managers start on 13 November 2026. Starting early gives you time to fix your forms, notice and processes.
Is this a DPDP compliance checker?
Yes, for what visitors can see. We find your privacy notice and the forms that ask for personal details, and check them against what the Act and Rules ask for. Each item is marked in place, unclear or missing, with a short quote or the page we looked at.
Is this legal advice?
No. It's a checklist from what's visible on your website, to show you what to fix first. Have your privacy notice and processes reviewed by a lawyer before you rely on them.
What does the check not cover?
What happens inside your business: how data is stored and secured, contracts with your vendors, logs, and how you answer requests. For apps people sign in to, the ₹999 audit-ready check also reads the account and settings screens, such as deleting an account or downloading your data.
Do I need a Data Protection Officer?
Only organisations the government names as Significant Data Fiduciaries must appoint one. Everyone else needs to publish the contact details of a person who can answer questions about personal data.
Is the check really free?
Yes. You get the DPDP checklist and a full website health check: a grade, speed, Google, security and accessibility. We ask only for your email to unlock the full technical list.
Check your website for DPDP in a few minutes.
Free. Your privacy notice and forms, checked against the DPDP Act and Rules 2025.