What the DPDPA Scanner checks, how findings are categorised, and what a compliance score does — and does not — mean. Findings cover both DPDPA legal obligations and global privacy best practices.
The scanner examines only what is externally observable about your website or Android APK — the same information a regulator, researcher, or user could observe without access to your internal systems. It does not audit:
Those areas require a human compliance consultant or internal audit. The scanner is the starting point: it surfaces what can be found from the outside and maps every finding to the exact DPDPA provision and statutory penalty exposure.
Your site's HTTP response headers are checked against Rule 6 (technical security safeguards). Four headers are evaluated:
| Header | What we look for | DPDPA rule |
|---|---|---|
Content-Security-Policy | Present; quality of policy assessed separately | Rule 6(c) |
Strict-Transport-Security | Present with sufficient max-age | Rule 6(a) |
X-Frame-Options | Present, or equivalent CSP directive | Rule 6(g) |
X-Content-Type-Options | nosniff | Rule 6(g) |
Your site is visited in a clean, isolated browser session with no prior cookies or state. All network activity — cookies set, third-party requests made, data transmitted — is captured before any user interaction. The same capture is repeated after a consent interaction. The difference between the two sessions is the basis for consent compliance findings.
Every third-party network request is classified against a database of known tracking services, mapping each to its category (advertising, analytics, social media, fingerprinting) and country of headquarters. This determines cross-border transfer exposure and whether data sharing occurred before consent was obtained.
The page is analysed for consent UI before any interaction. We check for:
Page scripts are monitored for use of browser APIs in patterns consistent with device fingerprinting — techniques that identify a user without cookies. Detection covers canvas-based, audio-based, and hardware enumeration approaches.
We locate your privacy policy and check it against the elements required by the DPDPA. Each check determines whether the required language is present — not whether the legal wording is correct. The provisions checked include:
| Element | DPDPA provision |
|---|---|
| Purposes of data collection stated | Section 5(1) |
| Data retention periods disclosed | Rule 8 |
| How to withdraw consent explained | Section 6(4) |
| Data Principal rights described (access, correction, erasure) | Section 11 |
| Policy available in an Indian language | Section 5(3) |
| Grievance officer or contact disclosed | Section 13 |
| Grievance response timeline committed | Rule 14 |
| Data Fiduciary identity and address | Section 5(1) |
| Cross-border data transfer disclosed | Rule 15 |
| Children's data handling addressed | Section 9 |
| Breach notification procedure stated | Rule 7 |
| DPBI complaint mechanism referenced | Rule 3(c) |
| Policy is a standalone document, not embedded in Terms | Rule 3(1) |
Your site and key linked pages are checked for forms collecting sensitive personal data (what US frameworks call PII) — identity details, contact information, financial data, and government-issued identifiers. A finding is raised when sensitive fields are present without an adjacent consent mechanism or link to the privacy notice.
The site is checked for age verification UI, parental consent flows, and content signals associated with child-directed services. Because child-directed status cannot be confirmed from external observation alone, findings here are advisory and do not reduce your score.
APK scans perform static analysis of the app package — declared permissions, embedded third-party SDKs, and data transfer indicators. This is manifest and bytecode analysis only; runtime behaviour and actual data transmitted by the app are not assessed.
The scanner's primary framework is the Digital Personal Data Protection Act, 2023 and the DPDP Rules 2025. Every finding that affects your score maps to a specific section of the Act or a numbered Rule, with the exact statutory text shown in the report.
However, several findings go beyond the letter of the DPDP Act and reflect global privacy best practices followed by responsible organisations worldwide — standards drawn from GDPR, ISO/IEC 27001, NIST Privacy Framework, and common industry norms for online services. These include:
In the report, findings that go beyond the strict text of DPDPA are labelled accordingly, so you can distinguish between a statutory obligation and a recommended best practice.
Every finding is assigned a severity (critical, high, medium, or low) and maps to one of five compliance categories. Your overall score is a weighted average of category scores — each category starts at 100 and is reduced based on the severity of findings within it. Consent and tracking carry more weight than security because they represent the core obligations of the DPDPA.
Findings tagged as informational (advisories) do not affect your score. These cover obligations that are conditional — applying only to Significant Data Fiduciaries, child-directed services, or organisations above regulatory thresholds that cannot be confirmed from external observation.
| Score | Grade | Interpretation |
|---|---|---|
| 80–100 | A | Few observable gaps; address remaining findings before the deadline |
| 60–79 | B | Moderate gaps; prioritise high-severity findings |
| 40–59 | C | Significant gaps; remediation plan needed |
| 20–39 | D | Serious gaps across multiple categories |
| 0–19 | F | Critical gaps; immediate action required |
All penalty figures shown are statutory maxima under the DPDP Act's penalty schedule. The Data Protection Board of India has full discretion to determine actual penalties based on the severity of the violation, number of individuals affected, evidence of remediation, and other factors.
The maximum figures (up to ₹250 crore for consent violations; up to ₹200 crore for notice failures) are the legislative ceiling — not a baseline or a likely outcome for a first-time compliance gap by an SMB taking corrective action.