Free Tool · DPDP Act 2023

DPDP Website Scanner: Free Automated Audit

Enter any website URL and our scanner crawls the live page to check it against a 12-point checklist drawn from India’s Digital Personal Data Protection Act, 2023, consent, cookies, trackers, privacy policy, and grievance-officer disclosure. Instant, automated, and free.

An automated scan of your actual website, not a questionnaire.

This is a website scanner: you give it a URL, and it crawls that live page directly, reading its HTML, cookies, scripts, and links, to check for the technical signals the DPDP Act expects a compliant website to show. It does not ask you to answer questions about your business; it looks at what your website is actually doing right now.

That makes it different from a self-assessment questionnaire, which asks you to describe your practices. A scanner tells you what a visitor, or a regulator, would actually see if they looked at your site today: does it set tracking cookies before asking for consent, is there a working consent banner, is a Grievance Officer listed, does the privacy policy cover what the law expects.

If your website collects any personal data, names, emails, phone numbers, or tracks visitors through analytics and ad pixels, it likely falls within the DPDP Act’s scope as a “Data Fiduciary.” Run the scan below to see where your site stands.

Free Tool · DPDP Act 2023

DPDP Website Audit Scanner

Check any website or privacy-policy URL against India's Digital Personal Data Protection Act, 2023. Get an instant audit of consent, cookies, privacy policy, trackers, and grievance-officer disclosure.

12-point audit DPDP Act & Rules Instant result Free
Important: This audit is an automated, informational scan of publicly visible signals only. It is not legal advice and is not a certification of DPDP compliance. DPDP compliance depends on how your organisation actually collects, stores, and processes personal data, which cannot be assessed from a website scan. This tool reads the page's server HTML and may not detect signals loaded by JavaScript. For an accurate assessment, consult a data protection lawyer. My Legal Pal accepts no liability for reliance on this automated result.

How the website scanner works

One URL, a real crawl, an instant 12-point report.

Enter your URL

Paste your website or privacy-policy page address into the scanner above.

We crawl the live page

Our scanner fetches the page directly and reads its HTML, cookies, and scripts, the same way a visitor’s browser would load it.

We check 12 signals

Each element is checked against a requirement in the DPDP Act and Rules: consent, cookies, trackers, grievance officer, retention, rights, and more.

Get your score

An instant score out of 100, a plain-language summary, and a full checklist showing what passed, what needs review, and which section of the Act it relates to.

What the 12-point scan covers.

Each check maps to a specific requirement under the DPDP Act, 2023 and its Rules.

  • Privacy policy present. A published notice describing what data is collected and why (Section 5).
  • Cookies and trackers before consent. Whether tracking cookies or scripts load before the user consents (Section 6).
  • Consent banner or mechanism. Whether a clear consent request appears before data collection (Section 6).
  • Third-party trackers. Detection of common analytics and ad trackers that collect personal data.
  • Grievance Officer disclosed. Whether a contact for data-related grievances is published (Section 8(9)).
  • Consent withdrawal mechanism. Whether users can withdraw consent as easily as they gave it (Section 6(4)-(6)).
  • Data Principal rights explained. Whether the site explains the right to access, correct, or erase data (Sections 11-13).
  • Children’s data handling. Whether parental consent and protections for minors are addressed (Section 9).
  • Data retention stated. Whether the site says how long data is kept (Section 8(7)).
  • Purpose of collection stated. Whether the specific purpose of data collection is disclosed.
  • Contact channel present. Whether there is a way to reach the business about personal data.
  • Forms collect consent. Whether forms that collect personal data include a consent checkbox or privacy reference.

What a website scan can, and cannot, tell you.

Be clear-eyed about what an automated crawl can do. This scanner reads the publicly visible parts of your website, your page content, links, and cookies, and checks them against DPDP signals. That is a genuinely useful, real read of your website’s visible data-protection posture, because it looks at your actual site, not a description of it.

What it cannot do is see inside your business: how your team stores data, who has internal access, your retention systems, or your vendor contracts. It also cannot fully see banners or trackers that load only through JavaScript after the page renders, some modern consent tools work this way, so a small number of sites may show a gap that is actually handled client-side.

A high score means your website’s visible technical signals look reasonable. A lower score tells you exactly where to start fixing things. Either way, a website scan is not a substitute for an actual DPDP compliance review by a lawyer who can look at how your business really handles data end to end.

Want a full DPDP compliance review, beyond the website?

Our lawyers review your actual data practices, privacy policy, consent flows, vendor agreements, and internal processes, then help you fix the gaps. Fixed fee, clear scope, confirmed upfront.

Call +91 8004800100

DPDP Website Scanner: FAQs

What does this scanner actually do?
It crawls the live URL you enter and reads the page’s HTML, cookies, and scripts directly, then checks 12 signals against requirements in the DPDP Act, 2023: privacy policy presence, cookies and trackers before consent, a consent banner, third-party trackers, a grievance officer, a consent withdrawal option, explanation of data-principal rights, children’s data handling, retention information, stated purpose of collection, a contact channel, and consent on data-collection forms.
Is this free?
Yes. You can scan any website URL for free and get an instant score and checklist. No signup is required to see your result.
How is this different from a DPDP self-assessment questionnaire?
A questionnaire asks you to describe your practices in your own words. This tool instead crawls your actual, live website and checks what it is really doing right now, whether cookies fire before consent, whether a consent banner exists, whether a grievance officer is listed. It is a technical scan of your website, not a self-reported assessment.
Does a high score mean my website is DPDP compliant?
No. A high score means the publicly visible technical signals on your website look reasonable. Full DPDP compliance depends on your actual internal data practices, which cannot be assessed from a website scan. Treat the score as a starting point, not a compliance certificate.
Can the scanner check my mobile app?
The scanner checks website URLs. For an app, you can scan the privacy-policy page linked from your app’s store listing, but the tool cannot analyse the app itself.
What should I do if my score is low?
Start with the failed and flagged items in your checklist, they are the clearest gaps. For anything beyond a quick fix, especially your consent mechanism, data retention practices, or grievance process, a lawyer-led DPDP compliance review will look at your actual data handling and help you close the gaps properly.
Prakhar Rai

Prakhar Rai | Advocate and Founder

Reviewed by a data protection advocate.

This tool is reviewed by Prakhar Rai, an advocate enrolled with the Bar Council of India and the founder of My Legal Pal. An alumnus of the National Law School of India University (NLSIU), Bangalore, with a Master of Business Laws, Prakhar and the My Legal Pal team advise businesses on DPDP compliance, privacy policies, and data protection practices.

This tool is informational only and does not constitute legal advice or a certification of compliance. Reviewed by Prakhar Rai, Advocate (Bar Council of India). Last updated: August 2026.