Drop in your website URL. We crawl your home page and policy pages, then check 13 weighted DPDP categories and return a 0–100 score with evidence and a fix for each gap.
Automated, heuristic & indicative — not a legal audit. We only read publicly reachable pages; we can't see content behind a login or rendered by JavaScript. We do not store your website data — the scan result is returned to you and nothing is kept on our side.
No signup, no card. Just your public website address.
Public pages are checked across 13 weighted DPDP categories.
A score, findings and practical next steps in one report.
13 weighted categories, drawn directly from the Act and its 2025 Rules — the same ones used to score every scan.
Make your data practices visible.
Put people in control of their choices.
Give every request a clear path.
Look for safeguards on the public surface.
Significant gaps in publicly visible signals. Start with the priority fixes in your report.
Some safeguards are visible, with gaps that need attention. Review the evidence for each finding.
Stronger publicly visible signals. Internal policies and operational compliance still need a separate assessment.
A high score is not a certificate and not a legal opinion. It means the things a person can check from outside your organisation look right.
We would rather say this on the page than in a footnote. A website scan covers the outward facing part of DPDP. It cannot see:
Those need a proper assessment against your systems and your records. A clean scan is a good sign. It is not the whole obligation.
MeitY notified the DPDP Rules 2025 on 13 November 2025. The Data Protection Board of India was set up on the same day and can receive complaints from now. Consent manager provisions start from 13 November 2026. Everything else, which is most of what applies to your website, takes effect on 13 May 2027.
That is the build window. Nothing about it is going to get easier by waiting.
The regulatory framework is established.
Consent manager provisions commence.
Substantive website obligations take effect.
Source: Digital Personal Data Protection Act 2023 (Schedule) and Digital Personal Data Protection Rules 2025, notified by MeitY on 13 November 2025.
Send us your report and a SecComply consultant will go through it with you on a call. We explain what each finding means for your business, where the real exposure sits, and what the sequence of work looks like. No cost and no obligation.
Where you want to go further, our DPDP work is advisory. We assess your current position against the Act and the Rules, design the consent flows, notices, records and workflows you need, and recommend the controls. Your teams carry out the changes with our guidance and review.
30 minutes. A consultant, not a sales call.
Penalty exposure under DPDP is not spread evenly. Sectors holding financial, health or children's data sit in the highest bands, usually with a sector regulator on top of DPDP.
Payment data, KYC records and credit profiles, with RBI and SEBI expectations layered over DPDP.
Health records are the most sensitive category, and ABDM obligations sit alongside DPDP.
Trackers, checkout data and post purchase marketing are where scans fail most often.
You are accountable alongside your customers, and processor contracts down your own supply chain are usually the bottleneck.
Yes. No signup, no card, no trial. You can run it as often as you like.
No. The scan runs against your public pages and the result is returned to you. We do not keep a copy of your site content.
No. It means the outward facing obligations look right. Retention, vendor contracts, breach response and rights handling all sit behind the website and need a separate assessment.
The scan only reads pages that are already public, so yes. It is most useful on your own site, where you can act on the findings.
It is when the substantive obligations of the DPDP Act take effect, 18 months after the Rules were notified on 13 November 2025. The Data Protection Board has been operating since November 2025.
Up to Rs 250 crore for failing to take reasonable security safeguards, up to Rs 200 crore for failing to notify a breach or for children's data failures, and up to Rs 50 crore for other duty failures. Penalties apply per instance.
After any change to your consent banner, your privacy notice, or your analytics and marketing tags. In practice, once a quarter is a reasonable rhythm.
No. It is guidance based on the text of the Act and the Rules. For decisions that carry legal consequence, take advice from a qualified lawyer.
Free, about 5 seconds, no signup.
