Key dates
- 11 August 2023: the Digital Personal Data Protection Act, 2023 becomes law.
- 13 November 2025: the DPDP Rules, 2025 are published in the Gazette. Rules on the Data Protection Board apply immediately.
- 13 November 2026: Consent Manager rules (Rule 4) apply (22 days away).
- 13 May 2027: most obligations for businesses apply: notices (Rule 3), security safeguards, breach reporting, retention, children's data and the rights process (Rules 5 to 16).
Last reviewed . Sources below.
What the scan checks
| Check | Why it matters |
|---|---|
| Trackers before consent | Section 6: consent must be free, specific, informed and given by a clear affirmative action before data is collected. |
| Consent banner or tool | Section 6(4): withdrawing consent must be as easy as giving it. |
| Privacy notice is findable | Section 5 and Rule 3: a notice must accompany or precede every request for consent. |
| Notice contents | Rule 3: itemised data, purposes, withdrawal, rights, complaints to the Board. Section 5(3): Indian language option. |
| Privacy contact | Rule 9: publish the contact of your Data Protection Officer or a person who can answer questions. |
| Grievances and rights | Sections 11 to 14 and Rule 14: access, correction, erasure, nomination, grievances within 90 days. |
| Forms collecting personal data | Section 5: tell people what you collect and why at the point you collect it. |
| HTTPS | Rule 6: reasonable security safeguards, including encryption. |
The scan cannot see your internal processes, such as breach plans, access logs, vendor contracts and retention, so the report ends with a checklist for those. The full DPDP website checklist explains every item.
Frequently asked questions
When do websites have to comply with the DPDP Rules?
The Digital Personal Data Protection Rules, 2025 were published in the Gazette on 13 November 2025. Most obligations for businesses, including the notice (Rule 3), security safeguards, breach reporting, retention, children's data and the rights process, apply 18 months later, from 13 May 2027. The rules for Consent Managers apply from 13 November 2026.
Does the DPDP Act apply to my small business website?
Usually yes. It applies to digital personal data processed in India, and to processing outside India connected with offering goods or services to people in India. A contact form, newsletter sign-up, checkout or analytics tool that collects identifiers all involve personal data. The Act allows the government to exempt some classes of businesses, such as startups, from certain provisions, so check whether any exemption notification covers you.
Do I need a cookie banner under DPDP?
The Act does not mention cookies by name. But analytics, advertising and session-recording tools collect personal data such as device identifiers, and Section 6 requires consent before that collection unless a legitimate use under Section 7 applies. In practice that means holding these tools until the visitor agrees, with refusing and withdrawing made as easy as accepting.
What must a DPDP privacy notice contain?
Rule 3 says the notice must be understandable on its own and in clear, plain language. It must give an itemised description of the personal data, the specific purposes and the goods, services or uses they enable, and explain how to withdraw consent, exercise rights and complain to the Data Protection Board. Section 5(3) also requires offering the notice in English or any language in the Eighth Schedule.
What are the penalties?
The Act sets penalties by type of breach, up to ₹250 crore for failing to take reasonable security safeguards to prevent a personal data breach. Penalties are imposed by the Data Protection Board after an inquiry.
What does this scanner check, and what can it miss?
It loads your page like a first-time visitor and checks for trackers that run before consent, a consent tool, a findable privacy notice and what that notice covers, forms that collect personal data without a notice, and HTTPS. It cannot see your internal processes (breach plans, logs, vendor contracts, retention), so those appear as a checklist. Sites that build their pages entirely with JavaScript may show fewer details.
Is this legal advice?
No. The scan reports technical signals that suggest gaps. A good score does not mean you are compliant, and a gap does not mean you are breaking the law. Use it to prepare, then confirm with a qualified lawyer.