SammatiGet your free DPDP scan

What the free scan looks at, and what you get back

The scan reads your public website the way a visitor's browser does and reports where it falls short of the DPDP Act. Here is a sample report first, then every check.

Jump to the scan form

A sample report

Sample reportSample for a fictional company. Not a real scan of any business.
44

DPDP exposure report

sample-company.example

Sample

Needs work

Scanned 1 Oct 2026 · 14 pages checked

Automated and indicative only, not legal advice. A high score never means compliant: most DPDP duties sit inside the business, out of a website scan's view.

Top gaps to fix

  1. FailWeight 15

    Trackers load before anyone agrees

    Why it matters
    Analytics and advertising scripts send visitor data to third parties the moment the page opens. Under DPDP that processing needs consent first, and the visitor has not been asked yet.
    The fix
    Hold every analytics and advertising tag until the visitor accepts in the banner. Load the tag manager only after consent, or configure it to fire nothing by default.
    Where the Act says so
    Section 6: consent must be free, specific, informed and given before processing
    Penalty category
    Breach of any other provision of the Act or Rules

    What we saw

    Analytics and advertising scripts from 3 third-party hosts loaded on the home page before any choice was made.

  2. FailWeight 12

    Consent banner missing or one-sided

    Why it matters
    A banner that offers only Accept, or pre-ticks choices, does not collect free consent. Rejecting must be as easy as accepting. Trackers that fire before consent are scored under their own check, so a banner can pass while trackers fail.
    The fix
    Show Accept and Reject with equal weight, no pre-ticked boxes, and a way to change the choice later.
    Where the Act says so
    Section 6(1) and 6(4): free consent; withdrawal as easy as giving it
    Penalty category
    Breach of any other provision of the Act or Rules

    What we saw

    No cookie or consent banner found on any of the pages checked.

  3. FailWeight 10

    Forms collect personal data without notice or consent

    Why it matters
    Contact, enquiry and sign-up forms collect names, emails and phone numbers. Each needs a short notice and a separate, unticked consent box, not one bundled with the terms.
    The fix
    Add a one-line notice beside each form (what, why, how long, rights) and an unticked consent checkbox.
    Where the Act says so
    Section 5 and 6
    Penalty category
    Breach of any other provision of the Act or Rules

    What we saw

    The contact form and the newsletter form collect an email address with no notice and a pre-ticked consent box.

  4. FailWeight 8

    No way for people to exercise their rights

    Why it matters
    People can ask to see, correct or erase their data and withdraw consent. Your site must show them how.
    The fix
    Add a page, form or email address for rights requests and say how long you take to respond.
    Where the Act says so
    Sections 11 to 14
    Penalty category
    Breach of any other provision of the Act or Rules

    What we saw

    No way to ask for access, correction or erasure of personal data was found.

  5. PartlyWeight 12

    Privacy notice misses required items

    Why it matters
    The notice must say what personal data you collect, why, the rights people have, how to withdraw consent, how to reach your grievance contact and how to complain to the Data Protection Board.
    The fix
    Add the missing items listed below and keep the language plain.
    Where the Act says so
    Section 5(1), 6(4) and 13
    Penalty category
    Breach of any other provision of the Act or Rules

    What we saw

    The notice names the data collected but does not say how long it is kept or how to withdraw consent.

All checks

  • FailTrackers load before anyone agreesWeight 15
  • FailConsent banner missing or one-sidedWeight 12
  • PassNo privacy notice linked from the home pageWeight 12
  • PartlyPrivacy notice misses required itemsWeight 12
  • FailForms collect personal data without notice or consentWeight 10
  • PassTracking cookies set before consentWeight 8
  • PartlyNo grievance officer contact publishedWeight 8
  • FailNo way for people to exercise their rightsWeight 8
  • PassSigns of children's data without parental consent wordingWeight 4
  • PassPrivacy notice has no date or versionWeight 3
  • PassThird parties receive data but the notice is silentWeight 3
  • PassSite not fully served over HTTPSWeight 3
  • PartlySecurity headers missingWeight 2

What this scan cannot see

  • Internal systems and databases
  • Vendor and processor contracts
  • Staff training and access controls
  • Breach detection and response readiness

A full assessment covers these. The scan covers only what any visitor's browser can see.

The 13 checks

Impact shows how much a check moves the score.

  • Trackers wait for consentAnalytics and advertising scripts send visitor data to third parties the moment the page opens. Under DPDP that processing needs consent first, and the visitor has not been asked yet.High impact
  • Consent banner with equal choicesA banner that offers only Accept, or pre-ticks choices, does not collect free consent. Rejecting must be as easy as accepting. Trackers that fire before consent are scored under their own check, so a banner can pass while trackers fail.High impact
  • Privacy notice linked from the home pageVisitors must be told what you collect and why before you collect it. A notice nobody can find does not count.High impact
  • Privacy notice covers the required itemsThe notice must say what personal data you collect, why, the rights people have, how to withdraw consent, how to reach your grievance contact and how to complain to the Data Protection Board.High impact
  • Forms give notice and ask for consentContact, enquiry and sign-up forms collect names, emails and phone numbers. Each needs a short notice and a separate, unticked consent box, not one bundled with the terms.Medium impact
  • Cookies wait for consentCookies from analytics or advertising tools identify visitors across visits. Setting them before consent is processing without a lawful basis.Medium impact
  • Grievance officer contact publishedEvery Data Fiduciary must publish how a person can reach its grievance officer. Without it, people cannot raise a complaint with you first.Medium impact
  • A way for people to exercise their rightsPeople can ask to see, correct or erase their data and withdraw consent. Your site must show them how.Medium impact
  • Parental consent wording where children's data appearsServices aimed at people under 18 need verifiable parental consent and must not track or target children.Low impact
  • Privacy notice dated or versionedPeople and regulators need to know which version applied when. A dated notice shows it is maintained.Low impact
  • Third-party sharing disclosed in the noticeEmbedded services such as fonts, chat, analytics and video receive visitor data. The notice must name the kinds of recipients.Low impact
  • Every page served over HTTPSUnencrypted pages expose form data and let attackers alter content. Reasonable security safeguards include encryption in transit.Low impact
  • Security headers in placeHeaders such as HSTS, Content-Security-Policy and X-Content-Type-Options block common attacks at no cost.Low impact

How the scan works

  • It is passive and read-only. It opens public pages and changes nothing on your site.
  • It reads at most 25 pages of your site.
  • It makes 1 request per second to your domain.
  • It follows your robots.txt and skips anything you have asked crawlers to avoid.

What happens to your result

Anyone can start a scan of a public site, but the full report is shown only to someone who has verified an email address on that company's domain, or to whom our team has sent it. Everyone else sees the headline score only.

Scan your website

Free and read-only.

The scan needs only your website address and a work email. The email is used to send your report. If you never verify it, it is deleted after 90 days. Your rights and the full privacy notice.