DPDP website readiness checker
Fourteen yes/no questions for Indian SME websites. You get a short score and a next step for every No. This is not legal advice and not a compliance certificate.
A website self-check, not a legal opinion
The Digital Personal Data Protection Act, 2023 is the Indian law that governs personal data. This page does not tell you whether you comply with it. It asks whether the website controls that Indian SMEs are usually missing are actually in place: a consent notice that can block non-essential scripts, a privacy notice, a grievance contact, a list of vendors, a retention rule, a rule for children's data, and a breach process.
Answer from the live site, not from memory of the original proposal. A developer can answer the script and form questions. The owner usually has to answer who reads the grievance inbox, how long enquiry data is kept, and whether WhatsApp or email broadcasts have an opt-in record.
Each Yes is one point. 0–5 is early, 6–10 is partial, and 11–14 is stronger readiness. The result lists every No with one next step. Answers are calculated in the browser and are not sent to DigitalXBrand.
When you want the longer implementation notes, use the DPDP compliant website checklist. When you want the technical work scoped, start from services. Pair the check with the website maintenance cost calculator if the gaps will be handled under a retainer rather than a one-off project.
Cookie banners, privacy templates, and "GDPR plugins" sold for other countries do not answer these questions for you. If a question does not match how your site works, mark No and write down why. A guessed Yes produces a score that will not survive a real request from a customer.
Checker
Fourteen questions. Mark Yes only when the control exists today.
1 of 14
Do you show a consent notice before non-essential cookies or trackers run?
Analytics, ads, and chat widgets often process personal data. A notice that appears after those scripts have already fired does not give a visitor a real choice.
2 of 14
Can a visitor reject non-essential cookies, not only accept them?
A banner with a single Accept button does not record a choice. Reject should be as easy to find as Accept.
3 of 14
Is there a privacy notice written for people in India that says what personal data the site collects?
Visitors and business customers need a page they can open from the footer that names the data, not a generic template from another country.
4 of 14
Does that notice state the purpose of each kind of processing (enquiries, analytics, payments, email)?
Collecting a phone number 'for marketing' when the form said 'for a quote' is a purpose problem. The notice should match the form.
5 of 14
Do you keep an internal record of processing: what data, why, where it is stored, and who can access it?
A privacy page is public. The record is the internal list you use when a customer, vendor, or regulator asks a specific question.
6 of 14
Is a grievance contact published, with a name or role and an email that a person actually reads?
People need somewhere to send an access, correction, or complaint request. A dead inbox fails the check.
7 of 14
Do you list the vendors that process personal data for you (hosting, email, analytics, payments, CRM)?
Most SME sites send data to several processors. If you cannot name them, you cannot explain a breach or a deletion request.
8 of 14
Do you have written terms with those vendors covering confidentiality, security, and deletion?
A checkout on a vendor's dashboard is not the same as terms that say what happens to customer data when you leave.
9 of 14
Have you defined how long each category of personal data is kept, and do you delete it after that?
Enquiry inboxes and CRM rows grow forever unless someone owns the deletion. A retention line in the notice only counts if you follow it.
10 of 14
If children might use the site or submit a form, have you defined whether you process their data and how you avoid it when you should not?
A coaching, clinic, or education site can collect a child's data without meaning to. You need a rule, even if the rule is 'we do not knowingly collect it, and here is what we do if we discover we have'.
11 of 14
Do you have a written breach process: who is told internally, who decides on outside notice, and how fast?
A hacked form or a leaked spreadsheet is easier to handle if the first hour is already scripted.
12 of 14
Can someone ask to access, correct, or erase their data, and does a named person handle that request?
The contact form is not the process. You need to know which systems to search (email, CRM, hosting backups) and who replies.
13 of 14
When someone accepts non-essential cookies or marketing, do you store what they accepted and when?
A banner that forgets the choice cannot show that consent was given. The log can be simple: timestamp, choice, version of the notice.
14 of 14
Do marketing emails or WhatsApp messages go out only after a recorded opt-in for that channel?
An enquiry about a quote is not permission to add the person to a weekly broadcast.
Result
Answer all 14 questions to see a score. 0 answered so far. Answers stay in this browser.
Questions about the checker
Is this checker legal advice?
No. It is a technical self-check for people who run an Indian business website. It does not interpret the Digital Personal Data Protection Act, 2023 for your facts, and a high score is not a compliance certificate.
What does the score mean?
You get one point for each Yes. 0–5 is early, 6–10 is partial, and 11–14 is stronger readiness. The useful output is the list of No answers and the next step under each one.
Does a high score mean we comply with the DPDP Act?
No. The questions track practical website controls: consent, a privacy notice, a grievance contact, vendor processors, retention, children's data, and a breach process. Only a qualified adviser can tell you whether your actual processing complies.
Who should answer the questions?
The person who can see the live site, the tag manager, the form tool, and the inboxes. A developer can answer the script questions. The business owner usually has to answer retention, marketing opt-in, and who reads the grievance email.
What should we do after the result?
Fix the No items you can fix in the site (banner, footer link, form checkboxes). Write down the items that need a policy decision. Then use the DPDP checklist article for implementation detail, or ask DigitalXBrand to scope the technical work. Legal wording still needs your adviser.
Do you store my answers?
No. The score is calculated in your browser. Nothing is sent to DigitalXBrand unless you later write to us.
Share or embed this checker
Paste this on your site. The iframe loads the tool. The sentence under it credits DigitalXBrand and links back to this page. Please keep that credit link.