The Comprehensive DPDP Website Readiness Checklist (2026)
What the website scanner can observe:
- Public policy link accessibility
- Presence of purpose wording near forms
- Scripts firing before cookie consent
- HTTPS enforcement and security headers
What requires business & legal review:
- Legal sufficiency of policy language
- Backend database retention schedules
- Vendor Data Processing Addendums (DPAs)
- Internal employee access controls
1. Conspicuous Footer Privacy Notice Link
Under Section 5 of the Digital Personal Data Protection Act, 2023, data principals must be provided with an accessible notice. Ensure every public page template includes an unambiguous, working hyperlink to your privacy policy. The link must not be hidden in nested hover menus or disabled on mobile layouts.
2. Notice Accompanying Form Submission
When a visitor provides personal data through a public contact, demo booking, or newsletter form, notice must precede or accompany the collection. Embed a brief purpose statement and a direct privacy notice link adjacent to the primary submit action.
3. Distinct and Unchecked Marketing Opt-Ins
Essential service terms and optional promotional communications must remain separated. If you collect email addresses or mobile numbers, any checkbox for promotional newsletters or WhatsApp updates must remain unticked by default.
4. Consent-Gated Advertising and Analytics Scripts
Tag managers (such as Google Tag Manager) must be configured so third-party tracking pixels (Meta Pixel, Google Ads, Hotjar) execute only after explicit opt-in preference is captured. Loading tracking tags prior to banner interaction creates visible regulatory exposure.
5. Observable Decline / Reject Controls
A cookie banner presenting only an “Accept All” button does not provide an unambiguous voluntary choice. Offer an equally prominent “Decline” or “Reject” option alongside granular preferences.
6. Published Grievance Redressal Officer Contact
Under Section 8(8), data fiduciaries must establish an accessible grievance redressal mechanism. Verify that your published privacy notice includes the designated title, operational email address, and postal address of your Grievance Officer.
7. Distinguish Required From Optional Input Fields
In alignment with data minimisation principles, clearly distinguish mandatory inputs from optional fields using explicit labels and accessible ARIA attributes.
8. Evaluation of Child-Directed Features (Section 9)
If your website provides educational content, student coaching, or products directed towards minors, manual review is essential to determine whether Section 9 parental consent mechanisms apply.
9. Full Third-Party Script Inventory Reconciliation
Maintain an exact record of every external script loading on your website. Every analytics tool, chat widget, and payment script must be accounted for and reflected in your vendor disclosures.
10. Technical Transport Hygiene (HTTPS & HSTS)
Under Section 8(5), data fiduciaries must implement reasonable security safeguards. Enforce HTTPS across all endpoints with automated 301 redirects from HTTP and deploy Strict-Transport-Security (HSTS) headers.
Audit Your Website Against This Checklist In 60 Seconds
Run the WebCompliance preliminary check to inspect notices, forms, trackers, and hygiene automatically.
Launch Website Check →This checklist provides technical guidance for public website readiness. It does not constitute legal advice or statutory certification under the Digital Personal Data Protection Act, 2023. Comprehensive compliance requires internal data audits, vendor reviews, and legal validation.