What is the DPDP Act 2023?

The Digital Personal Data Protection Act 2023 is India's primary data privacy law. It requires websites to obtain informed, granular consent before collecting personal data and mandates a grievance officer, data principal rights, and breach notification within 72 hours.

Is checkDPDP free to use?

Yes. The compliance scanner, penalty calculator, gap analysis, privacy notice generator, and DPA generator are all free with no signup required.

When is the DPDP compliance deadline?

The full DPDP Act compliance deadline is 13 May 2027, as notified by MeitY under the DPDP Rules 2025 on 13-14 November 2025.

What does the DPDP scanner check?

The scanner checks 10 categories: cookie consent banner, privacy notice, consent withdrawal, data collection transparency, third-party trackers, grievance officer, data principal rights, cross-border transfer disclosure, children age-gate, and security signals (HTTPS, HSTS, CSP).

What is a Trustify certificate from checkDPDP?

The checkDPDP DPDP-Verified badge is awarded to consent management platforms and websites that pass a 40-point technical and legal audit against the DPDP Act 2023 and Rules 2025. It is independently issued, publicly verifiable, and renewed annually.

What is the maximum penalty under the DPDP Act?

The highest penalty band is ₹250 crore for failure of reasonable security safeguards. Breach notification failures carry up to ₹200 crore, and children's data violations also carry up to ₹200 crore.

DPDP Act 2023 · Rules 2025 now in effect

Is your website DPDP-compliant? Find out in 60 seconds.

Name: checkDPDP
Author: checkDPDP

A free, plain-English scorecard for any Indian website. We'll show you the gaps against the DPDP Act 2023 + Rules 2025 — and exactly what to fix first — well before the 13 May 2027 deadline.

Free · No signup · Results instant

Trusted by 10+ Indian websites already DPDP-certified by checkDPDP.

Sample report

acme.in

Sample

62/ 100Needs Work

HTTPS & basic security headersPass
Privacy notice — missing grievance officerWarning
Trackers firing before consentFail
No withdraw-consent mechanismWarning

DPDP Act 2023 · in force in India

Time left until India's DPDP full-compliance deadline.

MeitY notified the DPDP Rules on 13–14 November 2025 with an 18-month phased rollout. Every Indian website needs to be defensible by 13 May 2027. Start with a free scan today.

Scan my website — free →Calculate your risk

———

Days

——

Hours

——

Minutes

——

Seconds

Target: 13 May 2027 · 00:00 IST

Counting in your browser

Framework

DPDP Act 2023 · Rules 2025 · Sections 5–11

Storage

Scans run server-side · we don't persist your site data

Jurisdiction

India-built · Grievance Officer published per Section 8(10)

India's most generous free DPDP audit

Free DPDP audit — we send admin credentials by email.

Most DPDP audits cost ₹50,000–₹3 lakh. This one is free. Send a query with your website URL. Within 1 business day a checkDPDP specialist emails you a personal admin-dashboard URL and sign-in credentials. Walk through every Pass, Warn and Fail across all 10 DPDP categories — and the exact fix for each.

All 10 DPDP categories — same framework the Board will test
Personal admin dashboard, single-use credentials
1 business day SLA · real specialist, not a bot
Exact 30-minute fix per Fail · with the free tool linked
Re-scan from the dashboard, score updates live
Free certificate eligibility at 70+

Request free audit →Run a free scan →

₹0. No card. No signup. The audit is free — anyone asking you to pay for it in our name is phishing.

01
Send a query
Name, email, website URL. 60 seconds.
02
Admin gets your query · emails back
Within 1 business day · audit-dashboard URL + sign-in credentials.
03
Walk through the report
All 10 categories. Exact fix per Fail. Re-scan on demand.

Used by SMBs, edtech, fintech and SaaS founders prepping for the 13 May 2027 deadline.

Why now

2026 is the build year. The clock is real.

The DPDP Rules were notified on 13–14 November 2025 with an 18-month phased rollout. Full compliance is required by 13 May 2027.

13 May 2027

Full compliance deadline

₹250 cr

Max penalty — failure of security safeguards

₹200 cr

Max penalty — failure to notify a breach

72 hrs

Detailed breach report to the Data Protection Board

Sources: Digital Personal Data Protection Act, 2023 (Schedule); Digital Personal Data Protection Rules, 2025 (notified by MeitY, 13–14 Nov 2025). See our DPDP Act guide for citations.

Ten categories. One score. Zero guesswork.

Every checkDPDP scan maps to a specific obligation under the DPDP Act or Rules. We tell you what we found, why it matters, and how to fix it.

01
Cookie consent banner
Granular, prior consent with reject as easy as accept — no pre-ticked boxes, no dark patterns.
02
Privacy / consent notice
A clear notice in plain language listing purposes, categories of personal data and how to exercise rights.
03
Consent withdrawal
An obvious mechanism to withdraw consent — and it must be as easy as giving it in the first place.
04
Data collection transparency
All forms, trackers and integrations that collect personal data are disclosed before collection.
05
Third-party trackers
No analytics, ads or pixels load before the user opts in. Reject = nothing fires.
06
Grievance officer / contact
A Grievance Officer or contact point is published, with an SLA for response.
07
Data Principal rights
Access, correction, erasure, nomination and grievance — all reachable in one place.
08
Cross-border transfer disclosure
If data leaves India, the notice says where and why — and the destination is not on the blacklist.
09
Children & age-gate
Verifiable parental consent for users under 18. No behavioural tracking, no targeted ads.
10
Security signals
HTTPS, modern headers (HSTS, CSP, X-Content-Type), and no obvious leakage of personal data.

Scan my website — free

Refreshed daily · 2 PM IST

India's top consent managers, ranked daily.

We rank them so you don't have to. Pick one, ship a banner, then run the scanner to confirm. The rest of compliance sits in your backend, retention and breach process.

See the full ranking →

10+ Indian websites already certified by checkDPDP

Earn a publicly verifiable DPDP certificate for your website.

Open to any Indian website — SaaS, BFSI, healthtech, edtech, D2C, publishers, consent platforms. We audit your site against the DPDP Act 2023 + Rules 2025 and issue a live, signed certificate (Gold, Verified or Aligned). Free first round. If you don't pass, the prioritised fix-list is free too.

Get DPDP certified See certified websites

DPDP GoldScore 85–100 · Top tierDPDP VerifiedScore 70–84 · Production-readyDPDP AlignedScore 55–69 · Right direction

Which industries the DPDP Act hits hardest

The penalty exposure for ignoring the DPDP Act is wildly uneven by sector. BFSI, healthtech and edtech sit in the ₹250 cr / ₹200 cr bands with sector-regulator overlays on top. Find your sector below for the specific obligations, controls and realistic effort.

#1 most exposed