DPDP Website Check
Is your website DPDP ready? Find out for free
Send us your website link. We tell you for free whether it passes our five point DPDP readiness checklist: Ready or Not ready. If it is Not ready, the detailed report shows what to fix, on which page, in what order.
The problem, as we usually find it
What is actually going wrong on most of the sites we are called into, before anything about what we would charge.
The Digital Personal Data Protection Act, 2023 is about personal data: anything that identifies a person, such as a name, a phone number, an email address, or an identifier your tracking tools attach to a visitor. A website with a contact form, a newsletter signup, a checkout or an analytics pixel collects personal data every day.
Most website owners we talk to are not ignoring the Act. They do not know where they stand, and the first answer they get is a long legal document or a quote for a compliance project. What they need first is simpler: does the website pass the basics, yes or no.
That is what the free verdict is. We look at your public website against five checks that a visitor or an auditor can see, and tell you whether it passes. The paid report turns that answer into a work list.
What the work covers
Everything below is included. If something is not on this list, we quote it separately rather than leaving you to find out later.
Free verdict
Pass or fail on each of the five checks and an overall Ready or Not ready, within 2 working days.
Every gap, on its page
The detailed report names the exact page, form or tool where each gap is.
The fix in plain words
Written so you can hand it to a developer or do it yourself.
Priority order
Fixes numbered in the order to do them, biggest risk first.
A PDF you can keep
One document for you, your developer and your lawyer.
Fixing, if you want it
From ₹9,999 per website, quoted after the report. Optional.
The detail that decides it
The part most quotes leave out, because it takes experience rather than a price list.
The five checks, and what each one looks for
Privacy notice. Is there one, is it linked from every place that collects data, and does it say what you take and why? A footer link to a template page that talks about a different business does not count.
Clear consent. Forms that pre tick a box, bundle several permissions into one tick, or collect more than the form needs fail here. Consent should be a clear action by the person, for a stated purpose.
Cookie and tracking choice. Can a visitor decline, and what has already loaded before they chose? A banner with only an Accept button, or one that fires every pixel first and asks afterwards, is the common fail.
A way to ask for removal. Can a person ask you to correct or delete what you hold on them, and is there somewhere to send that request? An email address buried in a policy is the minimum. A working request form is better.
Security basics. HTTPS everywhere, forms that do not email data in plain text to a shared inbox, and no publicly reachable files containing customer data. The Act puts the heaviest penalties on failing to protect data, which is why this one is on the list.
What a Ready or Not ready verdict means
Ready means your public website passes all five checks as we can see them. Not ready means at least one fails, and the verdict says which of the five. It is a technical and content check of the website, not a legal opinion.
A website can pass and the business can still have a problem, for example if data is stored or shared carelessly behind the form. That part is outside what a website check can see and is a question for your lawyer.
Why the free verdict stops where it does
The verdict tells you the answer. It does not tell you which page has the problem or how to fix it, because that is the actual work: opening your pages, forms and tools one by one and writing down what is wrong in a way your developer can act on.
The detailed report does that. Each gap comes with the page it is on, what is wrong in plain words, how to fix it, and a number showing the order to do it in, so the changes that matter most come first.
Cookies are the grey area
The Act does not mention cookies by name. A cookie or tracking pixel that lets you recognise an individual can be personal data, so we treat what loads on your pages as part of the check. We list what loads before a visitor chooses, and whether the choice they make is respected.
What we do not do
We are a web agency, not a law firm, and no certificate of DPDP compliance exists for a website. We do not issue one and you should be careful with anyone selling one. Where a fix needs legal wording, we can draft a starting version from what your site actually does, for your own lawyer to review.
Ready to order?
The short version of this page, with the report and fix prices, is on our services site. The free verdict is the same either way: send your website link on WhatsApp or email.
What we need from you
Short, and worth reading before you start. What delays this work is almost never the work : it is waiting on access or a decision.
Your website link
The public address is all we need for the verdict and the report. No logins.
The platform
WordPress, Shopify, Wix or custom, so the fixes in the report match what you can change.
Tools that collect data
Newsletter, CRM, chat widget, ad pixels. We find most ourselves, but a list saves a round of questions.
Whether this is right for you
We would rather lose the enquiry than take work we would do badly, so the right-hand column is as honest as the left.
This is for you if
- Your website has a contact form, newsletter signup, checkout or account login
- You run analytics, ad pixels or a chat widget and have never reviewed what they collect
- A client, investor or partner asked whether your website is DPDP compliant
- You want to know the answer before spending on a compliance project
- Your developer needs a clear list of what to change
This is not for you if
- You need a legal opinion on your whole business: speak to a lawyer, we check the website only
- You want a compliance certificate: none exists for a website, and we will not sell you one
- Your website collects no personal data at all, in which case there is little to check
How it runs
Four steps, in this order, every time.
- You send your website link and the platform it runs on, by WhatsApp or email.
- We check the five points on your public website and send you the verdict within 2 working days: Ready or Not ready, free.
- If you want the detail, you pay for the report. You get each gap, the page, the fix and the order, as a PDF.
- If you want us to do the fixing, we quote it from the report. You can also take the report to your own developer.
The Stack We
Work In Every Day
Every platform below is one we build on, maintain, rank and report from, not a logo wall.
Questions
The verdict is free: pass or fail on each of the five checks and an overall Ready or Not ready. The detailed report is paid, from ₹2,999 per website. It adds the page, the fix and the priority order for every gap. No GST is added on top of our prices.
No. We check your website against a technical and content checklist. For questions about your business as a whole, speak to a lawyer. Any notice text we draft is a starting version for your lawyer to review.
If your website collects personal data, such as a name, phone number or email through a form, checkout or newsletter signup, it is likely to. The verdict starts from what your site actually collects.
The Act sets penalties in a Schedule, with the highest amounts for failing to keep personal data secure. Read the Act text or ask your lawyer how it applies to you.
Not for the verdict or the report. We look at the public website. If you ask us to do the fixing, we agree access with you first.
No official certificate exists for a website. Treat any seller of one with care. What you can do is fix the visible gaps and keep a record of what you changed and when.
Want free stats on your site first?
Send us the URL. We pull the numbers from your own accounts and tell you what is wrong before there is any quote, and before there is any contract.
No pitch deck, no obligation. Bring your URL and we will look at it together.