Skip to content

Scanner
Delete my data
Free Banner
CMPs
News
DPDP Act

Scan my website

Home
Checklist

Checklist

The DPDP compliance checklist.

The do's. The don'ts. Mapped to the same categories our scanner uses. Tick as you go — your progress saves on this device automatically.

Sections

Notice & consent
Cookies & trackers
Data Principal rights
Security & breach response
Processors & cross-border
Children & sensitive contexts

0 / 31 complete

0%

Progress is saved on this device only. We don't send your answers anywhere.

Notice & consent

0 / 8

The bedrock of DPDP. Without a good notice and a real consent, everything downstream is shaky.

Privacy notice lists every purpose of processing in plain language
Notice lists categories of personal data collected for each purpose
Notice explains how Data Principals can exercise their rights
Notice names a Grievance Officer / contact with an email and response SLA
Consent is captured before any non-essential processing begins
Consent is per-purpose / per-category, not bundled into a single tick
"Reject" is as easy and visible as "Accept"
There is a one-click way to withdraw consent (visible from every page)

Cookies & trackers

0 / 4

A scan-detectable, regulator-detectable category. Get this right and your scan score jumps.

No analytics, ads or marketing pixels load before consent
No checkbox is pre-ticked in the consent UI
A persistent "Cookie preferences" link sits in the footer
You can prove what each user consented to and when

Data Principal rights

0 / 5

You must enable rights, not just list them.

A self-serve mechanism to request a copy / summary of personal data
A mechanism for correction, completion and update
A mechanism for erasure (with the exception list documented)
A mechanism to record a nominee for incapacity / death
A grievance flow with a time-bound response (aim for 30 days, max 90)

Security & breach response

0 / 7

The highest-penalty band. Don't skip the basics.

HTTPS is enforced site-wide with HSTS
A Content-Security-Policy header is in place
Internal access to personal data is role-based and audited
Backups are encrypted and restore is tested
A breach playbook exists: who detects, who decides, who notifies
A template for the 72-hour detailed Board report is ready
A template to notify affected Data Principals is ready

Processors & cross-border

0 / 4

Your vendors are your blind spot. Map them before regulators do.

You have a current inventory of every processor and subprocessor
A Data Processing Agreement is in place with each processor
Cross-border transfers are disclosed in your privacy notice
Any sector-specific localisation rules (RBI/IRDAI) are met

Children & sensitive contexts

0 / 3

Top-band penalties. If there is any chance of an under-18 user, address it.

An age-gate or verification step exists if minors could plausibly use the service
No behavioural tracking of children
No targeted advertising to children

Stay updated

DPDP changes, in your inbox — only when there's real news.

MeitY notifications, Data Protection Board orders, deadline reminders and new consent-manager guides. One-click unsubscribe, no marketing spam.

Get notified when DPDP changes

Government notifications, deadline reminders and new consent-manager guides — delivered when there's actually news. No marketing spam.

Email *Name

Organisation

What should we notify you about?

Government & MeitY notifications
DPDP deadline reminders (13 May 2027)
New consent-manager suggestions & comparisons
checkDPDP product updates

Data-collection notice

Required under Section 5 of the DPDP Act 2023

DPDP-compliant

What we collect: Your name, email and (if provided) organisation.
Purpose: to send you the DPDP update emails you've selected and (occasionally) DPDP-related product news.
Retention: until you unsubscribe (or 24 months of inactivity)
Your rights: Access, correct, erase, nominate, withdraw — anytime.

I consent to receiving the DPDP update emails I selected. I can unsubscribe at any time.

India's free DPDP compliance scanner and toolkit. Built so every website owner can understand the DPDP Act 2023 + Rules 2025 and meet the 13 May 2027 deadline.

This is guidance, not legal advice. For specific compliance decisions, please consult a qualified lawyer.

Product

Free Scanner
Risk Calculator
Penalty Calculator
Prerequisites Checklist
Gap Analysis Tool
Free Banner Builder
DPDP AI Assistant
Apply for DPDP Certification
All Tools
CMP Comparison
DPDP-Compliant CMPs (Live)
checkDPDP vs Competitors

Learn

DPDP News
DPB Fines Tracker
DPDP Act Guide
Your Rights (Data Principal)
Delete data from any website
Find a Grievance Officer
DPDP by Industry
Cross-Border Transfers
Compliance Checklist
FAQ
Blog

Company

About
Trust & Security
Contact

Legal

Privacy Policy
Terms
Cookie Policy
Manage your consent
Refund Policy
Disclaimer

checkDPDP BadgesDPDP Gold85–100DPDP Verified70–84DPDP Aligned55–69

See badge-holders →·Get your CMP verified

© 2026 checkDPDP. Built in India.

hello@checkdpdp.in·Grievance Officer·Manage consent··