Website DPDP Assessment: What Public Scanners Can & Cannot Tell You
Visible Surface (Automated Scanner):
- HTML structure and link accessibility
- Network calls made prior to consent
- Presence of grievance keywords in text
- Form fields collecting personal identifiers
Subsurface (Human Assessment Required):
- Database encryption and retention execution
- Cloud sub-processor contracts & DPAs
- Employee background checks & RBAC
- CERT-In incident response playbooks
The Two Halves of Data Privacy
When founders and legal teams evaluate readiness under India’s Digital Personal Data Protection Act, 2023 (DPDP Act), they frequently encounter two extremes: automated scanner tools that overpromise by claiming to “certify” compliance, or theoretical legal opinions that provide zero technical audits of what the website actually runs.
At WebCompliance, we maintain a clear technical boundary: the public website is your visible front door. It reveals what tracking tools execute, whether notices accompany data capture, and whether visitors are provided with unambiguous consent controls. However, the automated scanner cannot determine what happens behind that front door.
Why “Not Detected” Is Never a Synonym for “Compliant”
A core non-hallucination rule of our architecture is that the absence of an observable violation on a public web page does not imply statutory compliance. For instance, if an automated scan finds no date-of-birth fields or child-directed cues, this means only that no public child-directed signals were observed. It does not certify that your platform complies with Section 9 parental consent mandates.
Transitioning From Public Scanning to Human Audit
The recommended path for Indian enterprises is a phased assessment:
- Phase 1: Automated Public Surface Scan. Eliminate immediate visible gaps like missing notices near contact forms or unmonitored remarketing pixels.
- Phase 2: Internal Data Mapping & Vendor Review. Engage human privacy specialists to audit your cloud data pipelines, sub-processor contracts, and data retention schedules.
- Phase 3: Operational Evidence Filing. Establish verifiable records of consent, deletion logs, and grievance resolution turnaround times.
Start With A Preliminary Website Scan
Run our safe public scanner to uncover visible privacy indicators and generate your website readiness dossier.
Scan My Website →WebCompliance provides a preliminary website-level readiness assessment. Automated results are based only on publicly observable website indicators and are not legal advice, statutory certification, or a guarantee of compliance.