DPDP Act compliance checklist for websites: what an external scan can verify.

A practical checklist for India's Digital Personal Data Protection Act 2023 covering notice, consent, grievance redressal, security safeguards, children's data, and breach readiness, with the parts you can verify from outside.

The Digital Personal Data Protection Act, 2023 (DPDP Act) is India's law governing the processing of digital personal data. It was enacted in August 2023 and establishes obligations for Data Fiduciaries, the organisations that decide why and how personal data is processed, towards Data Principals, the individuals the data is about. The implementing rules were notified in late 2025 with a phased timeline, so the practical compliance deadline for most obligations falls in 2027. This checklist focuses on what the Act means for a public website or web application, and marks which items can be verified from outside with a scan.

This is a practical engineering guide, not legal advice. The Act and its rules contain definitions, exemptions, and timelines that depend on your situation; confirm the specifics with counsel and the official text.

Who does the DPDP Act apply to?

The Act applies to the processing of digital personal data within India, whether collected online or collected offline and then digitised, and to processing outside India if it is connected with offering goods or services to Data Principals in India. That last clause means a SaaS company in another country with Indian users is in scope. There is no revenue or size threshold for the basic obligations; a threshold applies only to the additional duties of Significant Data Fiduciaries, which the government designates.

What are the key terms?

What does the Act require for notice and consent?

Consent must be free, specific, informed, unconditional, and unambiguous, given by a clear affirmative action, and limited to the specified purpose. Before or at the time of requesting consent, the Data Fiduciary must give a notice describing the personal data to be collected, the purpose, how the Data Principal can exercise their rights, and how to complain to the Board. Consent must be as easy to withdraw as to give.

For a website, that translates to: no pre-ticked boxes, no cookie walls that treat continued browsing as consent, a notice that is linked from the point of collection (sign-up forms, cookie banners, lead forms), and a working withdrawal route. Externally verifiable: whether non-essential cookies and third-party tags fire before any consent action, whether forms carry a linked notice, and whether the notice page exists and names the purposes.

What does the Act require for grievance redressal?

Every Data Fiduciary must publish the business contact information of a person who can answer questions about processing, and must provide a grievance redressal mechanism. A Data Principal must exhaust that mechanism before approaching the Board. Significant Data Fiduciaries must additionally appoint a Data Protection Officer based in India.

Externally verifiable: whether the privacy notice names a contact for data questions and a grievance route, and whether the contact is reachable from the site footer or notice page.

What are reasonable security safeguards?

The Act requires every Data Fiduciary, and its Data Processors, to protect personal data in their possession by taking reasonable security safeguards to prevent a personal data breach. The rules elaborate with measures such as encryption, access control, logging and monitoring, and backup. Failure to do so carries the highest penalty band in the Act.

From the outside, the practical reading is the same set of checks that any security review runs, and this is where a scan gives the most evidence:

• Transport security on every host: valid TLS, HSTS, no mixed content. See HTTP security headers explained.
• No personal data exposed without authentication: no public exports, open buckets, directory listings, or verbose errors with user data.
• No leaked credentials that would give an attacker access to personal data. See Exposed .env files, source maps, and API keys.
• No unauthenticated administrative access to systems holding personal data.
• No forgotten hosts running older, vulnerable versions of the application with the same data behind them.

What does the Act require for children's data?

Processing personal data of a child (under 18) requires verifiable consent from a parent or lawful guardian, and prohibits tracking, behavioural monitoring, and targeted advertising directed at children. The rules describe mechanisms for verifying parental identity and age. A website that knowingly serves minors in India needs an age and consent flow, not a checkbox. Externally verifiable: whether such a flow exists at sign-up and whether advertising or tracking tags are present on pages intended for children.

What does the Act require after a breach?

A personal data breach must be reported to the Data Protection Board and to each affected Data Principal. The rules set the timing and content: an initial intimation to the Board without delay, a detailed report within a fixed period after becoming aware, and notice to affected individuals describing the breach, its likely consequences, and the mitigation taken. This applies regardless of whether harm has yet occurred.

Breach readiness is largely internal: a contact list, a template, a decision owner. The external part is reducing the chance of a breach you would have to report, and keeping dated evidence that you were testing. See the minimum scan before an audit for how scan history serves as evidence.

What are the penalties?

The Board considers the nature, gravity, duration, and repetitiveness of the breach, the type of data affected, and the mitigation taken. Evidence of a functioning security programme, including regular external testing, is the kind of mitigation the framework rewards.

The DPDP website compliance checklist

1. Inventory the personal data your site collects: forms, accounts, support, analytics, embedded third parties. Map each to a purpose.
2. Publish a notice that states the data, the purposes, how to exercise rights, and how to complain, linked from every point of collection.
3. Fix consent mechanics: affirmative action only, no pre-ticked boxes, non-essential cookies and tags held until consent, withdrawal as easy as consent.
4. Publish a grievance contact and a response process. Make the contact reachable from the footer and the notice.
5. Secure every host: TLS and HSTS everywhere, security headers, no exposed files, no leaked keys, no unauthenticated admin.
6. Find and close exposed data: buckets, exports, listings, error pages, stale hosts.
7. Review processors: every third party that receives personal data needs a contract that passes the safeguard obligation down.
8. Handle children's data with verifiable parental consent and no tracking, if minors are in scope.
9. Prepare for breach notification: owner, template, Board contact details, affected-user communication path.
10. Schedule external testing and keep the dated reports. They are your evidence of reasonable safeguards.