DPDP Checker

DPDP scanner › Checklist

DPDP compliance checklist for websites

India's Digital Personal Data Protection Rules apply to most businesses from 13 May 2027. These are the 13 things a website owner should have in place, in plain English, with the section or rule each one comes from.

Last reviewed . Not legal advice.

Scan your website first

  1. Publish a DPDP privacy notice. Write a notice that stands on its own in clear, plain language. List each kind of personal data you collect, the purpose for each, and the goods, services or uses it enables. Explain how to withdraw consent, how to exercise rights and how to complain to the Data Protection Board (Section 5, Rule 3).
  2. Offer the notice in Indian languages. Give people the option to read the notice in English or any language in the Eighth Schedule of the Constitution (Section 5(3)). Start with the languages your customers use most.
  3. Hold trackers until visitors consent. Analytics, advertising pixels and session recording collect personal data such as device identifiers. Load them only after the visitor accepts, using a consent tool that blocks them until then (Section 6).
  4. Make refusing and withdrawing as easy as accepting. Show "Reject" as prominently as "Accept", and add a link (often in the footer) that reopens the consent settings. Withdrawal must be as easy as giving consent (Section 6(4)).
  5. Add a notice to every form. Next to each form that collects personal data, add a line saying what you collect and why, with a link to the full notice. Use an unticked checkbox for optional uses such as marketing.
  6. Publish a privacy contact. Prominently publish the business contact of your Data Protection Officer, or of a person who can answer questions about your processing (Rule 9). Include the same contact in every response to a rights request.
  7. Set up a rights and grievance process. Publish how people can ask to access, correct, update or erase their data, and how to nominate someone to act for them. Resolve grievances within 90 days (Sections 11 to 14, Rule 14).
  8. Secure the data. Use HTTPS everywhere, encrypt or mask personal data where you can, restrict access, keep access logs, and keep backups (Rule 6). Penalties for failing to take reasonable security safeguards go up to ₹250 crore.
  9. Keep logs for one year. Keep personal data, traffic data and logs related to processing for at least one year, unless another law needs longer (Rules 6 and 8(3)).
  10. Prepare for breaches. Have a plan to inform affected people without delay, and the Data Protection Board without delay and with a detailed report within 72 hours (Rule 7).
  11. Erase data you no longer need. Delete personal data once its purpose is served or consent is withdrawn. Large e-commerce, online gaming and social media platforms have fixed periods and must warn users 48 hours before erasure (Section 8(7), Rule 8).
  12. Bind your vendors. Your hosting, CRM, email, payment and analytics providers process data for you. Your contracts with them must require reasonable security safeguards (Rule 6).
  13. Handle children's data carefully. If children may use your service, get verifiable consent from a parent, who must be an adult, before processing a child's data. Do not track, behaviourally monitor or target advertising at children (Section 9, Rule 10).

Which of these can a scan check?

Items 1 to 6 and part of item 8 show up on your public pages, so the scanner checks them. The rest are internal processes, so the scan report lists them as a checklist to work through with your team.

Key dates

Sources

Scan your website