Free · passive · result on screen

Free DPDP readiness check: what does your website show before anyone consents?

Reviewed by the Codesnag cyber team and the VirtualVakil legal team · Last reviewed:

What it does

The Codesnag DPDP readiness check is a free tool. It crawls your public website passively (public pages only, up to 25, robots.txt respected, no forms submitted), shows which trackers load before consent, whether a privacy notice, grievance contact and breach contact are published, and which forms collect personal data without a notice. Fifteen questions then cover your internal practice. You get a score, a red-amber-green status per area, the evidence and a plain-English fix for each gap, on screen, with no email needed.

  • Passive

    Public pages only, robots.txt respected, no forms submitted.

  • Evidence

    Every finding shows the URL or script it came from.

  • On screen

    Your report appears here. No email needed to see it.

Step 1 of 2 · Website check

Let our agents crawl your public website

Passive and read-only: public pages a visitor can open, up to 25, one at a time, obeying robots.txt. No forms submitted, no login, no attack traffic. Takes about two minutes. You can answer the questions below while it runs.

We fetch only what any visitor can open. Private and internal addresses are refused.

Step 2 of 2 · What a crawl cannot see

Fifteen short questions

Your internal practice: data inventory, consent records, processors, retention, rights, breach plan, children, Significant Data Fiduciary status and training. Answer honestly; "Not sure" counts as a gap because that is how an auditor would see it. Nothing here is sent anywhere until you choose to email us.

3 of 15 · Data inventory

Do you have a written inventory of the personal data you hold: what, where it sits, who can see it and which vendors touch it?

DPDP Act S. 5(1)(i); Rules, rule 3(b)(i)

4 of 15 · Purposes and lawful ground

For each kind of data, have you written down the specific purpose and whether you rely on consent or on a listed legitimate use?

DPDP Act S. 4(1), S. 6(1), S. 7

5 of 15 · Consent records

Can you show, for a given person, which notice they saw, when, and what they agreed to?

DPDP Act S. 6(10)

6 of 15 · Withdrawing consent

Can a person withdraw consent as easily as they gave it, and does processing then actually stop (including at your processors)?

DPDP Act S. 6(4), S. 6(6); Rules, rule 3(c)(i)

7 of 15 · Processors and contracts

Is every vendor that handles personal data for you (cloud, payments, SMS, email, CRM, accountants) under a written contract with security and deletion terms?

DPDP Act S. 8(1), S. 8(2); Rules, rule 6(1)(f)

8 of 15 · Retention and erasure

Do you have a retention schedule, and do you erase data when consent is withdrawn or the purpose ends (while keeping the one-year logs the Rules require)?

DPDP Act S. 8(7); Rules, rule 8

9 of 15 · Rights requests

Is there a published way to ask for access, correction, erasure or nomination, a named person who answers, and a tested routine?

DPDP Act S. 11 to S. 14; Rules, rule 14(1), 14(4)

10 of 15 · Grievance redressal

Do you publish a grievance route, answer within a stated time (not more than ninety days), and publish a business contact for data questions?

DPDP Act S. 8(9), S. 8(10), S. 13; Rules, rule 9 and rule 14(3)

11 of 15 · Security safeguards

Do you have encryption or masking of personal data, access control and MFA, logging you actually review, tested backups, and logs kept for one year?

DPDP Act S. 8(5); Rules, rule 6(1)

12 of 15 · Breach plan

Do you have a written breach plan: who decides, who tells the affected people and the Board, a detailed Board report within 72 hours, CERT-In within 6 hours, and has it been rehearsed?

DPDP Act S. 8(6); Rules, rule 7 (in force 13 May 2027); CERT-In Directions, 28 April 2022

13 of 15 · Children's data

Do you process data of anyone under 18? If yes, do you obtain verifiable parental consent and avoid tracking and targeted advertising aimed at them?

DPDP Act S. 2(f), S. 9; Rules, rules 10 and 12

14 of 15 · Significant Data Fiduciary

Have you checked whether you could be notified as a Significant Data Fiduciary (large volume or sensitive data), and could you appoint an India-based DPO, an independent auditor and run an annual DPIA?

DPDP Act S. 10; Rules, rule 13

15 of 15 · People and accountability

Is one person accountable for data protection, and has your staff been trained on it in the last 12 months?

DPDP Act S. 8(4)

0/13 answered · run or skip the website check

The checklist

A DPDP compliance checklist for your website

What the check tests, in plain language. Each line maps to a provision of the Act or the Rules; the report names it.

After the check

Our DPDP compliance service fixes what the report finds and re-scans your site weekly, backed by the incident response team that handles a breach if one happens first. Guides: DPDP Act and Rules 2025: what every Indian business must do; what a valid consent notice must say; Children's data under DPDP: parental consent for schools and edtech; Data breach under DPDP: who to tell, what to tell them and when.

FAQs

Yes. The website check and the questionnaire are free, and the full report is shown on screen without asking for an email. You only email us if you want the PDF or an assessment.

At the minimum: a privacy notice that itemises data and purposes and says how to withdraw consent, use rights and complain to the Board (rule 3); consent before non-essential trackers; a notice at every form; a published grievance or DPO contact (rule 9); a retention and sharing statement; verifiable parental consent if you reach children (S. 9, rule 10); reasonable security safeguards (rule 6); and a breach plan (rule 7). The check tests each of these on your public site.

Enter your domain above and confirm you are authorised to check it. Our agents load your public pages in a real browser, as a first-time visitor, and record which third-party scripts and cookies load before consent, then read your notice, forms and contact pages. A website check shows only what is public; the questionnaire covers your internal practice.

No. It loads at most 25 public pages, one at a time, waits at least a second between them, obeys robots.txt and any crawl delay, identifies itself as CodesnagDPDPCheck, submits no forms, logs in nowhere and sends no attack traffic.

No. The check sees only your public website and your own answers. It cannot see contracts, logs, consent records, internal processes, a DPO appointment or Significant Data Fiduciary status, and it is not legal advice. It tells you where to look first.

Every finding names the section of the DPDP Act, 2023 or the rule of the DPDP Rules, 2025 (G.S.R. 846(E), 13 November 2025) it relates to, checked against the Gazette texts. Where a line is our reading, for example applying consent to trackers, the report says so.

Primary sources

Where these rules come from

Last reviewed 20 Oct 2026. This is a readiness indication, not legal advice or a compliance certificate. If anything here differs from the official text, the official text prevails.