DPDP compliance checker: is your website ready for India’s data law?
Enter your site. We read the cookies and trackers a first-time visitor gets, look for a consent banner that really blocks them, read your privacy notice for the DPDP wording, and check your forms. You get a 0 to 100 readiness score and a fix for each gap.
Reads public pages only. Nothing is stored. A readiness check, not legal advice. What we read
- About 10 seconds
- Score out of 100
- Plugin named for every fix
DPDP readiness checklist for WordPress sites (PDF coming before 13 November): banner settings, notice wording, form consent, consent records and the Consent Manager rules, in order. Free, one email a week after that, unsubscribe any time.
Free. Unsubscribe any time. Privacy policy
Why it matters now
The Digital Personal Data Protection Act 2023 is India’s first standalone personal data law.
Registered Consent Managers (the platforms that record and pass on consent) must be operating. Every site that collects personal data through a Consent Manager, or plans to, needs the plumbing ready by then.
The remaining duties of a Data Fiduciary apply: a plain-language notice before or with each consent request, consent by a clear affirmative act, withdrawal as easy as giving it, erasure once the purpose is over, a grievance route, and breach notice to users and the Board.
The Schedule to the Act lists penalties of up to Rs 250 crore per instance for failing to keep reasonable security safeguards, up to Rs 200 crore for not reporting a breach, and up to Rs 50 crore for other breaches of a Data Fiduciary’s duties. The Data Protection Board decides the amount after an inquiry. (Source: DPDP Act 2023, Schedule.)
A Google Analytics or Meta Pixel snippet pasted in the header fires before any banner. The privacy page is a GDPR template with no grievance contact and no mention of India. Contact forms collect a phone number with no consent box. All three are a free-plugin fix; the point is to do them before a complaint, not after.
How to fix it
Free plugins do all four: CookieYes (free plan) or Complianz for the banner and script blocking, the WordPress privacy page draft plus your own wording for the notice, the acceptance field in WPForms, Contact Form 7 or Elementor for forms, and the form plugin’s entries as the consent record.
Install CookieYes or Complianz. Turn on prior consent (script blocking), choose the India or DPDP template, add a Reject button next to Accept, no pre-ticked boxes. Test in a private window: no _ga cookie before Accept.
One section per purpose (contact form, newsletter, analytics, payments), what is collected, how long it is kept, how to withdraw consent and ask for erasure, and a named grievance contact with an email. Say the notice is given under the DPDP Act 2023.
Add a required, unticked checkbox to every form that collects an email or phone: WPForms GDPR Agreement field, Contact Form 7 [acceptance], Elementor Acceptance field, Fluent Forms Terms field. Link the privacy policy in its label.
Keep the form entries (or export to a sheet) with date, time and the wording the person agreed to. The consent plugin keeps the cookie-consent log. That record is what you show if someone complains.
This page and the checker describe what a visitor’s browser receives and what the Act and Rules say in general terms. They are a readiness check, not legal advice. For a Significant Data Fiduciary, children’s data or cross-border transfers, talk to a lawyer.
The DPDP Rules timeline, and what a Consent Manager is (background)
The Digital Personal Data Protection Act 2023 receives assent. It applies to digital personal data processed in India, and to processing outside India that offers goods or services to people in India.
The DPDP Rules 2025 are notified. The Data Protection Board and the Consent Manager registration rules start first; the obligations on sites and apps are phased over 18 months.
Consent Manager rules apply. A Consent Manager is a company registered with the Data Protection Board that gives people one place to give, manage, review and withdraw consent across the sites that use it, and keeps the record. Using one is optional for a site; the rules say how they must operate.
Notice, consent, erasure, grievance and breach-notification duties apply to every Data Fiduciary, including a small WordPress site that collects an email address. Significant Data Fiduciaries get extra duties (a Data Protection Officer in India, audits, impact assessments).
What we read
One load of your home page, your privacy page, and the http:// address, the way a first-time visitor’s browser loads them.
Show the headers, scripts and wording we look for (technical)
Set-Cookie: _ga=...; SecureCookies on the first visitName, lifetime, Secure, HttpOnly and SameSite of every cookie the server sets for a guest. Cookies set by JavaScript are not visible from the server.
gtag.js, fbevents.js, clarity.msTrackers in the HTMLGA4, Tag Manager, Meta Pixel, Hotjar, Clarity, LinkedIn, TikTok, AdSense; plus YouTube, Google Fonts, Maps, Razorpay, Cashfree, PayU and reCAPTCHA as third parties.
type="text/plain" data-cmplz-srcHeld until consent?A tracker script that carries a consent attribute or type=text/plain waits for the banner. A plain script tag runs on the first visit.
cookie-law-info, complianz-gdprConsent toolCookieYes, Complianz, Cookie Notice, Moove, Cookiebot, Termly, iubenda, Borlabs, Osano, OneTrust, WP Consent API, and any plugin slug containing dpdp.
grievance, withdraw, retention, erasePrivacy notice wordingThe privacy page is fetched (same host) and read for a grievance contact, the DPDP Act, withdrawal, retention, erasure, a contact email and India.
+ checkboxFormsEvery form on the home and privacy page that asks for an email or phone: does it have a consent checkbox and a link to the policy?
Score weights: consent banner 25, trackers held until consent 20, privacy notice with a grievance contact 20, form consent 15, HTTPS and cookie flags 10, withdrawal and retention wording 10. Ready is 80 or more, partly ready 50 to 79.
Related guides
WordPress privacy leak checkerWho can read your commenters’ identities?
WordPress username checkerSee which logins your site leaks
WordPress cache checkerIs your page cache really working?
Abandoned plugin checkerWhich plugins has nobody maintained in years?
WordPress hosting checkerWho is hosting this website? Host, CDN and stack in 5 seconds.
How we test dealsOur price checks, labels and correctionsAffiliate disclosure: some links on this page are affiliate links. If you buy through them, Digital Pritam may earn a commission at no extra cost to you. We only list deals we have checked on the brand’s own website, and commissions never change our picks. Prices can change at any time; always confirm the final price at checkout. Read our full affiliate disclosure.