Scan any site against the DPDP Act in about a minute

Enter a URL, get a scored report

The scanner crawls the site, runs its checks, and returns a score out of a hundred with a band: compliant at eighty-five and above, largely compliant from seventy, partially compliant from fifty, non-compliant from twenty-five, and critical risk below that. Every finding names the check that produced it, its severity, the provision it maps to, and what specifically was or was not found.

The free run on this site is email-verified — a six-digit code before the scan starts — and is deliberately ephemeral: it produces a summary inline and stores nothing against an organisation. We would rather tell you that than describe it as anonymous. Inside an account the scan is persisted, re-runnable, and carries the full finding list and a downloadable report.

The crawler respects robots.txt and will say so rather than failing silently, and it refuses to resolve private or internal addresses. Scanning a site you do not control is a request you make with an authorisation confirmation attached.

The ten domains, and why the weights are not equal

Fifty-six checks are distributed across ten domains, each carrying a fixed share of the score. The weighting is a judgement about what the Act actually turns on, and it is published rather than implied: privacy notice twenty per cent, cookie consent and banner fifteen, consent mechanism fifteen, forms and data collection twelve, data principal rights twelve, third-party trackers ten, transport security five, children's data signals five, DPO and grievance contact four, and cross-border transfer two.

All fifty-six run on every scan. A check that has nothing to evaluate — a cross-border check on a site that contacts no foreign host — returns not applicable and scores zero rather than being skipped, so two reports are always comparable.

Notice carries the most because it is the obligation everything else is built on: if there is no reachable notice that identifies the fiduciary, itemises what is collected and why, describes rights and gives a contact, the site has failed at §5 before any of the consent mechanics matter. The two consent domains together carry thirty per cent, which is where most Indian sites lose their points. Cross-border carries two because it is the weakest signal to detect from outside — a request to a foreign host is evidence of a transfer, not proof of an unlawful one.

• Privacy Notice — eight checks, from whether a notice link exists and resolves through to whether it is served in a regional language.
• Cookie Consent & Banner — eight checks: banner presence, a reject option, no pre-ticked boxes, granular preferences, a cookie policy, a withdrawal route, and whether tags and cookies actually wait for consent.
• Consent Mechanism — five checks on whether the site is a consent wall, identifies the fiduciary, is purpose-specific, avoids dark patterns and separates marketing from service.
• Forms & Data Collection — six checks on notice next to the form, a consent control, minimisation, opt-in newsletters, stated purpose and payment handling.
• Data Principal Rights — six checks on whether access, correction, erasure, nomination, grievance and a response timeframe are described at all.
• Third-Party Trackers — eight checks on advertising and analytics firing before consent, session recording, social pixels, fingerprinting, tag-manager consent mode, neutral handling of content delivery, and the overall count.
• SSL / TLS — five checks on HTTPS, the HTTP redirect, certificate validity, HSTS and security headers.
• Children's Data — four checks on age gating, parental consent, tracking and targeting.
• DPO / Grievance Contact — three checks on whether a contact email is published, whether a grievance officer is named, and whether escalation to the Board is explained.
• Cross-Border Transfer — three checks on whether foreign transfers are disclosed, whether a transfer mechanism is named, and whether the site is served from India.

What each severity actually means

Findings are tagged critical, high, medium or info, and the tag is not decorative — it reflects how directly the finding implicates a provision. Critical is reserved for things that mean processing is happening without a basis right now: advertising tags firing before any consent decision, a site with no notice at all. High covers a missing obligation that a regulator would expect to be there — no reject option, no grievance contact, no reference to any principal right. Medium is a weakness rather than an absence, and info is context the score does not move on.

A finding that could not be evaluated is recorded as an error and scores zero rather than being counted as a failure, so a slow page does not produce a worse number than a non-compliant one.

Reading your score against the methodology

Each domain starts from a neutral baseline and every check adds or subtracts from it, which is then clamped and weighted into the overall figure. That baseline is the reason a site with half its checks passing lands in the partially compliant band rather than at zero, and it is worth understanding before you compare two scores.

More usefully, the report does not stop at the number. It produces a ranked list of what to fix, ordered by how many overall points each fix recovers, and shows a running projection of your score if you fix that item and everything above it. That projection is computed by re-scoring with those checks flipped to pass, not estimated — so "fix these three things and you reach seventy-two" is arithmetic rather than a promise.

Scanning a supplier's site before you sign

A supplier who cannot get their own banner right is telling you something about how they will handle your data principals' records. The scan needs nothing from them — no questionnaire, no NDA, no scheduling — which makes it the only due-diligence step you can complete before the first call.

The tracker inventory is the part worth reading on someone else's site. Every third-party host is classified by vendor and category: analytics, advertising, tag manager, social embed, session recording, device fingerprinting, CDN, functional, consent tooling, or simply other. Content delivery and payment iframes are scored neutrally because they are operationally necessary; session recorders and fingerprinting libraries are not, and finding one firing before consent on a supplier's checkout page is a conversation you want to have before signing rather than after.

Where a scan misleads you

A scan is evidence about a page, not about an organisation. These are the ways people over-read it.

• The scan runs against the marketing site and the actual product lives on an application subdomain that was never scanned. The score describes the brochure.
• A consent banner is detected and scored, and it is a third-party banner configured to block nothing. Presence and behaviour are different checks for a reason.
• The site geo-targets its banner, so a crawl from one location sees compliant behaviour that a user in another never gets.
• Tags are injected by a tag manager after a delay, so a crawl that finishes first records a clean result. Re-run and compare before trusting a perfect tracker score.
• The score improves because a page was removed rather than fixed. The delta between runs is only meaningful if the surface stayed the same.
• A high score is read as compliance. It measures what is observable from outside; consent records, retention, rights handling and processor contracts are invisible to any crawler.

What a scanner cannot see

It cannot see your consent records. A site can present a perfect banner and store nothing usable behind it, and no external scan will ever tell you that.

It cannot see anything behind authentication, inside a native mobile app, or in a backend integration. Most personal data processing happens in exactly those places.

It cannot judge whether a notice is truthful. It checks that a notice exists, is reachable, identifies the fiduciary, itemises categories and purposes, describes rights and gives a contact. Whether the itemised purposes match what you actually do is a question only a data map answers.

It cannot confirm a cross-border transfer is unlawful. A request to a non-Indian host is a signal worth two per cent of the score, which is deliberately small.

It is not a certification, and passing it does not make an organisation compliant. It is a fast, repeatable, externally verifiable measurement of one surface.