DPDP Website Risk Scanner

What the scanner checks

The scanner loads a small, fixed number of public pages in an isolated browser, the way a first-time visitor would, and records what it can observe: page text, links, forms, cookies, network requests and response headers. It then runs a set of rules against that evidence. Each rule produces a finding with a status, a confidence level and the evidence behind it. The scan covers six areas.

1. Privacy notice and transparency

The scanner looks for a privacy policy and related pages such as a cookie policy, terms, contact and grievance pages, starting from the home page and footer links. It reads the text and checks whether the topics a notice normally covers are present: the categories of personal data, the purposes, how a person can exercise their rights, who to contact with a complaint and how consent can be withdrawn. It also notes whether the page shows a date of last update and whether forms link to the notice. These checks relate to Section 5 (Notice) and Rule 3. A privacy policy and a notice are related but not identical, and a page can contain the topics without meeting the legal requirements, so the scanner reports what it found and leaves the judgement to you.

2. Cookies, trackers and consent behaviour

The home page is loaded three ways: with no interaction, after accepting the consent banner and, where a reject control exists, after rejecting. The scanner compares the cookies set and the requests made in each state. It reports analytics or advertising tools that start before any choice, tools that continue after rejection, whether a reject option is available on the first layer of the banner, and whether a link to change the choice stays on the page. See cookies, consent banner, dark patterns and Section 6 (Consent) for the background.

3. Forms and data collection

The scanner finds forms on the pages it visits and lists their fields. It classifies fields by the kind of personal data they are likely to collect, such as email, phone number, name, address, date of birth, government ID, payment details or free text. For each form it notes whether a notice link sits nearby, whether there is a consent checkbox and whether the form is sent over HTTPS. It never fills in or submits a form.

4. Third-party technology inventory

Every external domain the pages contact is listed and, where the scanner recognises it, labelled by service and purpose: analytics, advertising, fonts, content delivery, chat, video, payments and similar. The inventory helps you compare what actually runs on your pages with what your notice and vendor records say. A listed service is not automatically a problem. The question is whether it is expected, disclosed and covered by the right consent choices and contracts.

5. Basic security indicators

The scanner checks whether the site uses HTTPS, whether plain HTTP redirects to HTTPS, whether HSTS is set, the TLS protocol and certificate expiry, common security headers, cookie flags such as Secure and HttpOnly, and mixed content. These are signals visible from outside. They relate to the duty described in reasonable security safeguards and Rule 6, but they are not a security audit.

6. Optional business questionnaire

Some obligations cannot be seen from outside, such as retention schedules, handling of rights requests, vendor arrangements, breach response, children's data and governance. After a scan you can answer an optional questionnaire on these topics. The answers are self-reported and not verified. The result is shown separately, labelled as self-reported, and is never mixed into the observed Website Privacy Risk Indicator.

How the Website Privacy Risk Indicator is calculated

The Website Privacy Risk Indicator is a number from 0 to 100. A higher number means more observed potential risk in the checks that could be verified. It is not a compliance score. The method is the same for every site, and the report lists the points counted for each finding.

Categories and weights

From findings to a number

1. Each rule has a severity (critical, high, medium, low or info). Severity sets the maximum points the rule can add.
2. Each finding gets a status and a confidence level. The points counted depend on the severity, the status and the confidence, so an observed issue with strong evidence counts for more than an uncertain one, and a pass counts for nothing.
3. Findings that share a group are counted once, so a single underlying cause does not inflate the number.
4. Checks that could not be verified are left out of the calculation and reported as coverage. A missing check is never treated as a pass or as a failure.
5. Each category's risk is its counted points as a share of the maximum for the checks that could be verified. The indicator combines the category risks using the weights above. If too little could be verified, the report shows “Insufficient data” instead of a number.

Bands

The report also shows a coverage percentage: the share of the scoring weight that could be checked. A score built on low coverage deserves less weight than one built on high coverage.

What this tool cannot do

• It is not legal advice and it is not a certification. Whether a practice meets the DPDP Act depends on facts that a website scan cannot see, such as your purposes, your lawful grounds for processing and your contracts. A clean result is not a guarantee of compliance.
• It is not a security audit or a penetration test. It reads public responses and does not try to exploit anything.
• It does not submit forms, create accounts or log in. Logged-in pages, checkout flows, mobile apps and internal systems are outside its view.
• It cannot confirm data sharing, retention or contracts. A tracker request shows that a browser contacted a service. It does not prove which personal data was sent or what the agreement with that vendor says. In the same way, not seeing a tracker does not prove that no data is shared.
• It sees a sample. Only a limited number of pages are loaded, and banners can behave differently by country, device or visit. The coverage section of each report lists the pages and checks that were actually done.
• Missing evidence is not non-compliance. When the scanner cannot verify something, it says so. Those items are for you to check, not conclusions against your site.

How we protect your scan

Safe to point at the open web

Before loading any address, the scanner looks up where it leads and refuses private, internal, loopback and link-local addresses, including cloud metadata addresses. It repeats that check on every redirect and on every request a page makes. This stops the scanner being used to reach systems that are not on the public internet, which is a known abuse of tools that fetch URLs for other people.

Rate limits and fair use

Scans are rate limited per connection and queued when the service is busy. Each scan loads a small number of pages with a time budget, so it does not put load on your site.

It identifies itself and respects robots.txt

The scanner reads robots.txt first and follows it. Its requests carry the User-Agent token DPDPComplianceScanner/1.0, so you can recognise it in your logs. To stop it visiting your site, add this to your robots.txt:

User-agent: DPDPComplianceScanner
Disallow: /

Your report is private

Each scan gets a secret access key. It is kept only in your current browser tab and is sent only to this site's scanner service. It is not placed in the page address and it is not shared with anyone. If you close the tab, download the PDF first. Reports are deleted automatically after 7 days, and you can delete a report at any time from the results page. The page records anonymous counts of actions such as PDF downloads. These counts are not linked to a scan, a website or a person. See the Privacy Policy, Terms of Use and Grievance Redressal for requests and concerns.

Frequently asked questions