Stay DPDP-ready before the 13 May 2027 deadline

How it works

From a URL to a fix list

1. 01Enter your websiteWe open the homepage and find the privacy notice, contact and sign-up pages.
2. 02We test like a visitorWe list the trackers that load before any choice, check the consent banner and read the notice. With the live browser connected, we also click Reject and see what still loads.
3. 03You get the fixesA scored report with proof for every finding, mapped to the Act and the Rules, showing what applies today and what applies from 13 May 2027.

What we check

8 check modules

• Privacy noticeA clear, itemised notice: data, purposes, withdrawal, rights and the Board.
• Consent bannerConsent is asked for clearly, Reject is offered, nothing is pre-ticked and it can be withdrawn.
• Pre-consent trackingAnalytics, advertising and session-replay tools wait for consent and stop after Reject.
• Rights and grievanceA working route to access, correct and erase data, nominate someone and raise a grievance.
• Children’s dataVerifiable parental consent and no tracking or targeted ads for anyone under 18.
• Security hygieneHTTPS, modern TLS, security headers and safe cookies — the visible part of Rule 6.
• Third partiesEvery outside service, who runs it, and whether the notice discloses sharing and transfers.
• DisclosuresA published contact person or DPO, retention periods, and the duties only you can confirm.

Beyond the scan

A workspace to close the gaps and prove it

• Findings with ownersEvery gap gets an owner, a due date and a history. The next scan re-tests it and closes it only when it passes; exceptions need a reason and an approver.
• Evidence filesUpload the proof no scan can see: encryption settings, access reviews, log retention, restore tests, contracts and DPIAs. Stored privately.
• Four honest scoresApplicability, website controls, evidence and remediation, each with its formula. Missing evidence never counts as a pass, and nothing is called “certified”.
• Today or 13 May 2027Each finding shows when its provision applies and whether it applies to you only in some cases, such as children’s data or Significant Data Fiduciaries.
• Retention under Rule 8Record whether the Third Schedule applies to you, the 48-hour notice before erasure, and data you must keep longer by law.
• Your team, with rolesAdd your DPO, security lead, colleagues and a read-only auditor. Each role changes only its areas, and two-step sign-in protects every account.
• Exemptions, transfers, children, SDFAn exemptions register with clause and approver, processors outside India checked against Section 16 and sector rules, parental consent under Rule 10, and DPO, DPIA and audit dates if you are notified as an SDF.
• Processors told automaticallyWhen someone withdraws consent or you complete an erasure request, each processor gets a signed notice or an email, and the log is kept as evidence.
• Rights, consent and breachesA rights request page with your published response period, a consent banner and ledger, and a breach register with the 72-hour Board timer.

Questions

The DPDP Act in plain words

The law

Three dates that matter

• 13 Nov 2025DPDP Rules, 2025 notified; the provisions that set up the Data Protection Board take effect.
• 13 Nov 2026Consent Managers can register with the Board.
• 13 May 2027Notice, consent, security, breach, rights and children’s duties all apply. Penalties reach ₹250 crore.