DPDP compliance methodology
How ComplyDP scores public-surface DPDP preparedness. This page is our transparency and dispute baseline for published research scores.
Methodology version: 1.0 (April 2026). This methodology may be updated as the DPDP Rules are amended or as the Data Protection Board issues guidance. Scores published before a methodology update will be clearly marked with the methodology version used.
Dataset reference: April 2026
Rescans: Companies may request review via the dispute process below.
About this methodology
ComplyDP's check library was developed by Vipul Abhishek, who has practiced as an advocate in the past in the Supreme Court of India, and author of Comply DP: DPDP Enforcement 2027: Prepare Now or Pay Latter. The legal mappings in this methodology have been verified against the official Gazette publication of the DPDP Act 2023 and the DPDP Rules 2025.
1. What this audit is and is not
This audit is an external surface scan based entirely on publicly observable signals. It does not involve access to internal systems, backend infrastructure, data processing logs, or any non-public information.
Findings are generated using a combination of automated technical scanning (HTTP requests, browser-based cookie detection) and AI-assisted analysis of publicly available policy text. All findings are based on publicly accessible content and are reviewable against the source evidence cited in each report.
This report is not legal advice. It does not constitute a legal compliance assessment, audit, or certification under any law.
The findings reflect the state of publicly accessible content at the time of scanning. Companies update their policies regularly — scores may change.
2. The check library
97 scored checks across 10 categories, each mapped directly to a specific provision of:
- Digital Personal Data Protection Act 2023 (No. 22 of 2023, Gazette of India, 11 Aug 2023)
- Digital Personal Data Protection Rules 2025 (G.S.R. 846(E), 13 November 2025)
Each check has:
- A unique identifier (CHECK_001 to CHECK_109)
- A direct section or rule reference
- Pass / fail / partial / manual evaluation criteria
- Penalty exposure derived from the Schedule to Section 33(1) of the Act
The full structured index with identifiers, titles, legal references, and primary signal paths is published at /methodology/checks. Evaluation criteria for each check (pass, fail, partial, manual, and not-applicable thresholds) are documented in our check definitions. Companies disputing a specific finding receive the full check definition for that check as part of the dispute review.
Ten compliance categories (overview)
High-level grouping for the check library in Section 2.
| Category | DPDP Sections | What we check |
|---|---|---|
| Notice & Disclosures | Section 5, 6 | Privacy notices, readability, fiduciary identity, purpose disclosures |
| Consent & Cookies | Section 6, 7 | Cookie banners, consent granularity, withdrawal ease, pre-consent loading |
| Rights & Grievance | Section 11, 12, 13 | Data subject rights, grievance officer details, DSR processes, timelines |
| Forms & Data Collection | Section 4, 6 | Form-level notices, data minimization, purpose limitation |
| Security & Safeguards | Section 8 | HTTPS, security headers, authentication, security policy statements |
| Breach Readiness | Section 8(6) | Breach notification process, reporting channels, timeline commitments |
| Processors & Sharing | Section 8, 9 | Third-party sharing disclosures, processor contracts, role clarity |
| Retention & Erasure | Section 8(7), 12 | Retention period specificity, erasure triggers, lifecycle policies |
| Children & Accessibility | Section 9 | Parental consent, age verification, multi-language support |
| SDF & DPO | Section 10 | Significant Data Fiduciary obligations, DPO appointment |
3. The scoring system
score = sum(weight × credit) / sum(weight) × 100
Weights derived directly from the DPDP Act Schedule (penalty tiers):
- Rs. 250 Crore provisions → weight 5
- Rs. 200 Crore provisions → weight 4
- Rs. 150 Crore provisions → weight 3
- Rs. 50 Crore provisions → weight 1
Credit per finding:
- Pass = 1.0 · Partial = 0.5 · Fail = 0.0
- Manual = excluded from denominator
- N/A = excluded from denominator
A company that passes all notice checks but fails all security checks will score lower than one that does the opposite — because the Act assigns higher maximum penalties to security failures than to many notice-related provisions.
4. Penalty exposure calculation
Penalty amounts shown are maximum possible exposure per the Schedule to Section 33(1).
The Act says penalties "may extend to" the stated maximum. The Data Protection Board has full discretion under Section 33(2) based on nature, gravity, duration, data affected, repetition, gain or loss, mitigation, proportionality, deterrence, and likely impact.
Theoretical maximum exposure figures are illustrative only. Actual penalties may be significantly lower.
The Data Protection Board of India had not imposed any penalties under the DPDP Act as of the date of this dataset (April 2026). Penalty exposure figures should be read as the statutory maximum established by the Act, not as a prediction of enforcement outcomes.
Figures assume each failed check could represent a separate breach; the Board may treat related failures as a single breach.
5. Check statuses
- PASS
- Publicly observable evidence satisfies the requirement.
- FAIL
- The requirement is not met based on publicly observable evidence.
- PARTIAL
- Some elements present, some missing.
- MANUAL REVIEW
- Cannot be determined from public signals alone; requires internal verification.
- NOT APPLICABLE
- Provision not yet triggered by the Central Government (e.g. CHECK_059 — SDF designation under Section 10(1)).
6. Limitations
This scan cannot assess:
- Internal data processing practices
- Technical security infrastructure
- Employee training and procedures
- Contractual arrangements with processors
- Board-level data governance
- Actual incident response capabilities
- Historical compliance record
Cross-border data transfer restrictions under Section 16 depend on Central Government notifications that had not been issued as of April 2026. Transfer-related checks reflect policy disclosures only, not actual compliance with any notified restrictions.
Manual review checks require on-site or internal verification to complete. Cookie and tracker findings are based on automated scanning of the public website; mobile app behaviour, logged-in states, and server-side tracking are outside scope.
7. Dispute and correction process
If you believe a finding is incorrect:
- Submit a dispute from your company profile ("Dispute this finding") or open
/dispute/<your-domain>on this site. - Provide the specific check ID and your evidence.
- We aim to review within 7–10 working days.
- Corrections are applied to the published report where warranted.
- A correction notice may be appended to the report record.
We correct errors promptly. Our goal is accuracy, not adverse coverage. Browse companies · privacy@complydp.com
8. SDF check status
CHECK_059 (SDF Status Disclosure) is currently marked NOT APPLICABLE for all companies.
Section 10(1) requires the Central Government to notify specific Data Fiduciaries as Significant Data Fiduciaries before Section 10(2) obligations are triggered. As of April 2026, no such notification has been issued for the audited set.
This check will activate for notified companies once official gazette notifications are published under Section 10(1).
Sample findings
Below are examples of how our checks produce findings, with actual evidence snippets.
Where findings include names of designated officers (grievance officers, nodal officers, DPOs), these are published by the company in their own privacy or grievance policies and are therefore already public information. ComplyDP does not publish personal contact details beyond what companies have self-disclosed.
Grievance Officer Details (Section 13(1))
"Grievance Officer: Mr. Rahul Sharma, Email: grievance@example.com, Response time: 30 days"
Source: example.com/privacy-policy
The privacy policy names a grievance officer with contact details and response timeline as required by the Act.
Breach Notification Policy (Section 8(6))
Source: example.com/privacy-policy
No mention of breach notification procedures, timelines, or obligations to notify the Data Protection Board found on any scanned page.
What this page does not include
- Full text of Act sections (use official sources)
- Technical implementation details of our scanner
- Details about LLM or AI pipeline internals
- Competitor comparisons
- Unsubstantiated claims of being the only or first provider