Skip to content
Regulane

Free DPDP Act compliance checker · DPDP Rules 2025

Is your company DPDPA ready? Check it free.

Enter your website. Regulane reads your privacy notice against the DPDP Rules 2025 and shows what it found, quoting your own words. Then answer 9 questions about what a website cannot show. No sign-up, nothing stored.

Run the check

Readiness, not a legal opinion. Every result shows the words it was decided on.

Website checks
12
Questions, plus 2 if they apply
9
Duties come into force
13 May 2027
No account, no card
₹0

The check

—days to 13 May 2027

The DPDP Act’s duties for Data Fiduciaries, and its penalties, come into force on 13 May 2027. Until then this measures readiness: nobody can be in breach of a duty that is not yet in force.

G.S.R. 843(E) · G.S.R. 846(E) · Gazette of 13 November 2025

Part 1 · Automatic

What your website shows

  • Free, no sign-up
  • Nothing is stored
  • At most six public pages
  • Honours robots.txt

What it checks

  • Pages served over an encrypted connections.8(5) · Rule 6(1)(a)
  • A privacy notice is publisheds.5 · Rule 3
  • The notice itemises the personal data collecteds.5(1)(i) · Rule 3(b)(i)
  • The notice states what the data is used fors.5(1)(i) · Rule 3(b)(ii)
  • The notice explains how to withdraw consents.6(4) · Rule 3(c)(i)
  • The notice explains how to exercise your rightsss.11–14 · Rules 3(c)(ii), 14(1)
  • The notice says how to complain to the Data Protection Boards.5(1)(iii) · Rule 3(c)(iii)
  • A contact for privacy questions is publisheds.8(9) · Rule 9
  • A grievance route and response period are publisheds.8(10), s.13 · Rule 14(3)
  • The right to nominate is explaineds.14 · Rule 14(4)
  • The notice says how long data is kepts.8(7) · Rule 8
  • Third-party tracking before a choice is mades.6(1) · s.4

Part 2 · Your answers

What a website cannot show

9 questions about how personal data is handled inside the company, two of them only if they apply. Your answers stay in this browser; they are not sent to Regulane.

  • Do you process personal data of anyone under 18?

    Under the Act a child is anyone who has not completed eighteen years, not thirteen.

    Do you process personal data of anyone under 18?

  • Has the Government notified you as a Significant Data Fiduciary?

    Only the Central Government designates one. If you have not been notified, answer no.

    Has the Government notified you as a Significant Data Fiduciary?

  • Do you keep a list of every purpose you process personal data for, with the lawful ground for each?

    · The ground is either consent or one of the legitimate uses section 7 lists. "Necessary for our business" is not one of them.

    Do you keep a list of every purpose you process personal data for, with the lawful ground for each?

  • Is consent given by a clear action for each purpose, recorded, and as easy to withdraw as to give?

    · No pre-ticked boxes, no consent bundled into terms of service, and processing stops when consent is withdrawn.

    Is consent given by a clear action for each purpose, recorded, and as easy to withdraw as to give?

  • Does every vendor that handles personal data for you have a contract that requires security safeguards?

    · You stay responsible for what your processors do. Rule 6(1)(f) asks for the safeguards to be in the contract.

    Does every vendor that handles personal data for you have a contract that requires security safeguards?

  • Is personal data protected by encryption or masking, access control, monitored logs and backups?

    · The minimum Rule 6(1) sets: encryption, obfuscation or masking; access control; logs that are monitored and reviewed; and a way to keep processing after an incident.

    Is personal data protected by encryption or masking, access control, monitored logs and backups?

  • Do you keep access logs and processing records for at least one year?

    · Rule 6(1)(e) and Rule 8(3) require one year, so an unauthorised access can be investigated, unless another law asks for longer.

    Do you keep access logs and processing records for at least one year?

  • Is there a written breach procedure that tells affected people without delay and sends the Board a full report within 72 hours?

    · Rule 7 needs two things: an intimation to each affected person and to the Board without delay, then a detailed report to the Board within 72 hours.

    Is there a written breach procedure that tells affected people without delay and sends the Board a full report within 72 hours?

  • Do you erase personal data when consent is withdrawn or the purpose is served, including the copies at your processors?

    · Unless a law requires you to keep it. Where the Third Schedule applies, the person must be told 48 hours before erasure.

    Do you erase personal data when consent is withdrawn or the purpose is served, including the copies at your processors?

  • Can you find one person’s data across every system and answer a request for access, correction, erasure or nomination?

    · A request has to reach every copy, including what was shared with others. The means of making one must be published.

    Can you find one person’s data across every system and answer a request for access, correction, erasure or nomination?

  • Is someone responsible for grievances, answering each within a published period of 90 days or less?

    · A Data Principal must exhaust this route before going to the Board, so the clock and the record of each answer matter.

    Is someone responsible for grievances, answering each within a published period of 90 days or less?

What it checks

Each check, and the Rule behind it.

The website half reads what the Rules require a Data Fiduciary to publish. Descriptions are plain-language summaries, not the text of the Act or the Rules.

  • s.8(5) · Rule 6(1)(a)Pages served over an encrypted connectionReasonable security safeguards include encrypting personal data. A site that collects any personal data over plain HTTP sends it unencrypted.
  • s.5 · Rule 3A privacy notice is publishedA notice must accompany or precede every request for consent, and be understandable on its own.
  • s.5(1)(i) · Rule 3(b)(i)The notice itemises the personal data collectedThe notice must give an itemised description of the personal data, not a general reference to "information".
  • s.5(1)(i) · Rule 3(b)(ii)The notice states what the data is used forThe notice must state the specified purpose and describe the goods, services or uses the processing enables.
  • s.6(4) · Rule 3(c)(i)The notice explains how to withdraw consentWithdrawing consent must be as easy as giving it, and the notice must say how to do it.
  • ss.11–14 · Rules 3(c)(ii), 14(1)The notice explains how to exercise your rightsThe means of requesting access, correction and erasure must be published, with what is needed to identify the person.
  • s.5(1)(iii) · Rule 3(c)(iii)The notice says how to complain to the Data Protection BoardThe notice must describe how a Data Principal can make a complaint to the Data Protection Board of India.
  • s.8(9) · Rule 9A contact for privacy questions is publishedThe business contact of a Data Protection Officer, or of a person who can answer questions about processing, must be prominently published.
  • s.8(10), s.13 · Rule 14(3)A grievance route and response period are publishedA grievance redressal system must be published, with a response period of no more than 90 days.
  • s.14 · Rule 14(4)The right to nominate is explainedA Data Principal may nominate someone to exercise their rights on death or incapacity; the means must be published.
  • s.8(7) · Rule 8The notice says how long data is keptPersonal data must be erased once consent is withdrawn or the purpose is served, unless the law requires it to be kept.
  • s.6(1) · s.4Third-party tracking before a choice is madePersonal data may be processed only with consent or for a listed legitimate use. Analytics and advertising tags that identify a visitor need a ground before they run.

Also reported, as a signal only: whether the notice mentions the DPDP Act at all. It is not a legal requirement, but a notice that never does was usually written for an earlier law.

DPDP Act compliance checklist

The DPDP compliance checklist, item by item.

Everything the check looks at, in one list you can work through: what your website must publish, then what has to be true inside the company. Each line cites the section of the Act or the DPDP Rule it comes from.

On your website

  1. 1.Pages served over an encrypted connection s.8(5) · Rule 6(1)(a)
  2. 2.A privacy notice is published s.5 · Rule 3
  3. 3.The notice itemises the personal data collected s.5(1)(i) · Rule 3(b)(i)
  4. 4.The notice states what the data is used for s.5(1)(i) · Rule 3(b)(ii)
  5. 5.The notice explains how to withdraw consent s.6(4) · Rule 3(c)(i)
  6. 6.The notice explains how to exercise your rights ss.11–14 · Rules 3(c)(ii), 14(1)
  7. 7.The notice says how to complain to the Data Protection Board s.5(1)(iii) · Rule 3(c)(iii)
  8. 8.A contact for privacy questions is published s.8(9) · Rule 9
  9. 9.A grievance route and response period are published s.8(10), s.13 · Rule 14(3)
  10. 10.The right to nominate is explained s.14 · Rule 14(4)
  11. 11.The notice says how long data is kept s.8(7) · Rule 8
  12. 12.Third-party tracking before a choice is made s.6(1) · s.4

Inside the company

  1. 1.Do you keep a list of every purpose you process personal data for, with the lawful ground for each? ss.4, 7
  2. 2.Is consent given by a clear action for each purpose, recorded, and as easy to withdraw as to give? s.6 · Rule 3
  3. 3.Does every vendor that handles personal data for you have a contract that requires security safeguards? s.8(1)–(2) · Rule 6(1)(f)
  4. 4.Is personal data protected by encryption or masking, access control, monitored logs and backups? s.8(5) · Rule 6(1)(a)–(d)
  5. 5.Do you keep access logs and processing records for at least one year? Rules 6(1)(e), 8(3)
  6. 6.Is there a written breach procedure that tells affected people without delay and sends the Board a full report within 72 hours? s.8(6) · Rule 7
  7. 7.Do you erase personal data when consent is withdrawn or the purpose is served, including the copies at your processors? s.8(7) · Rule 8
  8. 8.Can you find one person’s data across every system and answer a request for access, correction, erasure or nomination? ss.11–14 · Rule 14
  9. 9.Is someone responsible for grievances, answering each within a published period of 90 days or less? s.8(10), s.13 · Rule 14(3)
  10. 10.Do you get verifiable consent from a parent before processing a child’s data, and avoid tracking and targeted advertising aimed at children? (only if you process children’s data) s.9 · Rule 10
  11. 11.Have you appointed a Data Protection Officer based in India and an independent data auditor, and run a DPIA and audit in the last 12 months? (only if notified as a Significant Data Fiduciary) s.10 · Rule 13

DPDP Act deadline

Key dates, from the Gazette.

  1. 13 November 2025The Act’s commencement and the DPDP Rules notified. The Data Protection Board provisions apply at once.G.S.R. 843(E) · G.S.R. 846(E)
  2. 13 November 2026Consent managers must be registered with the Board.s.6(9) · Rule 4
  3. 13 May 2027Every Data Fiduciary duty, every Data Principal right and the penalties apply.ss.3–17, 28–34 · Rules 3, 5–16

DPDP Act penalties

The penalties, as maximums.

  • Failing to take reasonable security safeguards to prevent a breachs.8(5)₹250 crore
  • Failing to inform the Board and affected people of a breachs.8(6)₹200 crore
  • Failing the additional duties for children’s datas.9₹200 crore
  • Failing a Significant Data Fiduciary’s additional dutiess.10₹150 crore
  • Breaching any other provision of the Act or the RulesSchedule₹50 crore

Schedule to the Act. The Data Protection Board decides a penalty after an inquiry; these are ceilings, not fixed fines.

Its limits

What an automatic check cannot see.

Most of the Act is about what happens inside a company: the processing register, consent records, processor contracts, security, breach response and erasure. That is why the second half asks you. In Regulane, those become the 17 obligations a workspace tracks, each with an owner and evidence.

The check does not

  • Run your site’s JavaScript, so tags and text added by scripts are not seen.
  • Read past a login, a bot challenge or a page robots.txt asks it to leave alone. Those items say “Not checked”, never “Not found”.
  • Judge quality. It finds that your notice mentions a right, not that the route works.
  • Store your website address, the result or your answers, or certify anything.

Questions

The free check, answered plainly.

When does the DPDP Act come into force?

The Act and the DPDP Rules 2025 were notified on 13 November 2025 (G.S.R. 843(E) and G.S.R. 846(E)). The provisions on the Data Protection Board applied at once. Consent manager registration under Rule 4 applies from 13 November 2026. The duties of a Data Fiduciary, the rights of a Data Principal and the penalties apply from 13 May 2027, eighteen months after notification.

Who does the DPDP Act apply to?

Section 3: to the processing of digital personal data within India, whether it was collected digitally or digitised later, and to processing outside India where it is connected with offering goods or services to people in India. It does not apply to personal data processed by an individual for a personal or domestic purpose, or to personal data the person themselves made public or that is published under a legal obligation.

What must a privacy notice contain under the DPDP Rules?

Rule 3: it must be understandable on its own, and in clear and plain language give an itemised description of the personal data and the specified purpose, with a description of the goods, services or uses the processing enables. It must give a link to the website or app, and describe how the person can withdraw consent (as easily as they gave it), exercise their rights, and complain to the Data Protection Board.

How quickly must a personal data breach be reported?

Rule 7: on becoming aware of a breach, a Data Fiduciary must inform each affected person and the Data Protection Board without delay, and send the Board a detailed report within 72 hours, unless the Board allows longer on a written request.

What is a Significant Data Fiduciary?

A Data Fiduciary, or class of them, that the Central Government notifies under section 10, weighing factors such as the volume and sensitivity of the personal data processed and the risk to people’s rights. It must appoint a Data Protection Officer based in India and an independent data auditor, and under Rule 13 carry out a Data Protection Impact Assessment and an audit every twelve months. A company that has not been notified is not one.

Does this tell me whether my company is DPDP Act compliant?

It tells you how ready you are, which is the honest answer before 13 May 2027. The Act’s duties for Data Fiduciaries, and its penalties, come into force on that date (G.S.R. 843(E) and G.S.R. 846(E), notified 13 November 2025), so until then nobody can be in breach of them. The check shows what your public pages say against the Rules, with the words it found, and scores your own answers about the rest. Whether you comply is a legal judgment about your whole operation; confirm it with your adviser.

What does the check do to my website?

It reads at most six public pages: your robots.txt, your home page, up to three addresses for your privacy notice, and a grievance page if your notice links to one. It honours robots.txt, identifies itself as Regulane in every request, runs no scripts, submits nothing and logs in to nothing. A repeat check of the same site within ten minutes is answered from memory instead of being sent again.

Why does it say "Not checked" for my site?

Because it could not read the page, and it will not guess. Many large sites refuse automated readers, and many privacy notices load their text with JavaScript, which the check does not run. Give your notice’s address in the box that appears and it will try that page directly; otherwise check those items by hand against the list on this page.

How accurate is it?

It matches the words of your notice against what each Rule asks for, and shows the passage it matched so you can judge it yourself. Matching can find that your notice mentions withdrawing consent; it cannot judge whether the route is as easy as giving consent. "Not found" means not found on the pages read, so a summary notice whose details open behind buttons can hide items. The result says so when the notice it read is short.

What happens to what I enter?

The website address is sent to Regulane to run the check and is not stored, nor is the result. Your answers to the questions never leave your browser. Your IP address is held in the server’s memory only, to limit repeated checks. The privacy notice, section 4d, says the same.

What are the penalties?

The Schedule to the Act sets maximums: up to ₹250 crore for failing to take reasonable security safeguards, ₹200 crore for failing to intimate a breach or meet the children’s data duties, ₹150 crore for a Significant Data Fiduciary’s additional duties, and ₹50 crore for any other provision. The Data Protection Board imposes them after an inquiry; they are ceilings, not automatic fines.

Regulators publish every week. Know which changes are yours the day they appear.

Start free trialExplore the demo

14-day trial · No card required · Per workspace, never per seat