Free DPDP Scanner for Indian Websites

Paste your website URL into the form above and press Scan. The free DPDP scanner fetches the public-facing pages, runs ~40 deterministic checks plus heuristic page-content analysis, and returns a 0–100 DPDP Act 2023 compliance score with a 10-category gap report — usually inside 60 seconds. No signup, no account, no credit card.

Most scans return results in 10–18 seconds. The crawler fetches up to five pages (home + privacy + cookie + grievance + rights) with an 8-second timeout each, then runs heuristic analysis plus an LLM-refined narrative. Worst case is 60 seconds — beyond that the scan is cancelled and you can re-run.

Yes. The scanner only reads publicly-fetched HTML, HTTP headers and policy pages — exactly what any browser sees on a normal page load. It does not bypass authentication, attempt login, or send any payload to the target site. You can scan competitors, partners, vendors or your own properties for free.

Yes. The scanner is industry-agnostic for the core 10 DPDP categories. For sector overlays (BFSI under RBI, healthtech under HIPAA-equivalent rules, e-commerce under consumer-protection rules), pair the scan with the industry guide at /industries — each sector has a dedicated DPDP exposure profile.

Yes. The full 10-category scan returns a 0–100 score and per-category findings with no signup, no credit card and no usage cap. We do not store the URL you scanned or its content. There is no premium tier hidden behind the scanner — the same scan that runs for a one-person founder runs for an enterprise compliance team.

checkDPDP is the only free DPDP scanner built specifically for the Indian Digital Personal Data Protection Act 2023 and the Rules 2025 — not a generic GDPR scanner re-skinned for India. Every check is mapped to a named DPDP section (5, 6, 8, 9, 11, 16) and the recommendations point to India-built consent management platforms (Tsaaro, CookieYes, Privado.ai) rather than US/EU tools that may not fit the Indian regulatory mandate.

Yes. The scanner is anchored to the Act and the November 2025 Rules. It checks for: Section 5 privacy notice itemisation, Section 6 consent UX, Section 6(4) withdrawal equality, Section 8(5) reasonable security safeguards, Section 8(10) Grievance Officer publication, Section 9 children-data treatment, Sections 11–14 data principal rights, and Section 16 cross-border transfer disclosure. Every finding cites the section by number.

The scanner runs ~40 deterministic technical checks (HTTPS, HSTS, CSP, consent banner presence, pre-consent tracker fires, grievance officer disclosure, etc.) plus heuristic page-content analysis. It surfaces what is verifiable from the public-facing site — it cannot inspect backend records, vendor contracts, or DPIAs. For a full audit of those, use Free Audit. Realistic catch rate on Indian sites is ~85% for static and server-rendered pages; full SPAs are lower due to client-side hydration.

Every gap links to a plain-English fix and, where useful, a free tool — banner builder, privacy notice generator, DPA template, breach notification template. You can also book a follow-up audit, ask the DPDP AI assistant, or apply for a publicly verifiable DPDP-Verified certificate.

No. The scan runs server-side, results are returned to your browser, and we do not log the URL, the content or any personal data. We do not sell or share scan data with vendors or any third party.