# DPDP Website Checker

> Free scanner that checks a website for readiness signals under India's Digital Personal Data Protection Act, 2023 and DPDP Rules, 2025: trackers that load before consent, consent tools, the privacy notice against Rule 3, privacy contact (Rule 9), rights and grievance process, forms collecting personal data, and HTTPS (Rule 6). Not legal advice. Last reviewed 2026-10-22.

## Tool
- [Scanner](https://dpdp-check.automationvault.net/): enter any URL. Direct link format: https://dpdp-check.automationvault.net/?url=example.in
- [DPDP website checklist](https://dpdp-check.automationvault.net/dpdp-website-checklist): 13 items with the section or rule each comes from.

## Key dates
- DPDP Act, 2023: assented 11 August 2023.
- DPDP Rules, 2025: published in the Gazette on 13 November 2025 (G.S.R. 846(E)). Rules 1, 2 and 17 to 21 apply on publication.
- Rule 4 (Consent Managers) applies from 13 November 2026.
- Rules 3, 5 to 16, 22 and 23 apply from 13 May 2027: notices, security safeguards, breach intimation, retention, children's data, rights and grievances.

## Key obligations for websites
- Rule 3: a standalone notice in clear, plain language with an itemised description of personal data, the specified purposes, and how to withdraw consent, exercise rights and complain to the Data Protection Board.
- Section 5(3): option to read the notice in English or any Eighth Schedule language.
- Section 6: consent must be free, specific, informed, unconditional and unambiguous, by clear affirmative action; withdrawal as easy as giving consent (6(4)).
- Rule 9: publish the business contact of the Data Protection Officer or a person who can answer questions.
- Rule 14: publish how to exercise rights; resolve grievances within 90 days; users may nominate others.
- Rule 6: reasonable security safeguards including encryption, access control, logs, backups; keep logs for one year.
- Rule 7: inform affected people without delay; report to the Board without delay and in detail within 72 hours.
- Section 9 and Rule 10: verifiable parental consent for children; no tracking, behavioural monitoring or targeted advertising directed at children.

## Sources
- DPDP Rules, 2025 (Gazette): https://www.meity.gov.in/static/uploads/2025/11/53450e6e5dc0bfa85ebd78686cadad39.pdf
- PIB explainer: https://static.pib.gov.in/WriteReadData/specificdocs/documents/2025/nov/doc20251117695301.pdf