ComplyKaro// by Ferrowright Engineering

// Free website check · DPDP Act 2023 · E-Commerce Rules 2020

Is your website ready for India's DPDP Act?

ComplyKaro opens your site like a first-time visitor and checks what India's data protection and e-commerce rules ask for: consent before tracking, a proper privacy notice, refund and shipping policies, a grievance officer and basic security. Results in about a minute, with proof for every finding.

Free, no sign-up. We store the address and the report for 12 months so your report link works. Privacy.

// Why now

The deadlines

13 May 2027 (approx.)

The DPDP Act's core duties apply: notice, consent, security safeguards, breach reporting and grievance handling. Maximum penalties run up to ₹250 crore, scaled by the Data Protection Board to the size of the business and the breach.

Already in force

The Consumer Protection (E-Commerce) Rules, 2020 and the 2023 dark-pattern guidelines apply to everyone selling online in India today.

At gateway onboarding

Razorpay, PayU and other gateways check for terms, privacy, refund, shipping and contact pages before approving a merchant account.

// How it works

Three steps

  1. Scan. Enter your address. We load your homepage in a clean browser, test your consent banner, then find and read your policy pages.
  2. Read the report. A grade, three scores, and every check with its evidence and the fix. Download it as a PDF or have it emailed.
  3. Fix the gaps. Do it yourself from the report, or call us: we'll go through it with you and fix what matters for your business.

// FAQ

Questions

What is the DPDP Act and when does it apply?

The Digital Personal Data Protection Act, 2023 is India's data protection law. The DPDP Rules, 2025 were notified on 13 November 2025 and phase in over 18 months: the main duties for businesses (notice, consent, security, breach reporting, grievance handling) apply from around 13 May 2027.

Are refund and shipping policies part of the DPDP Act?

No. They come from the Consumer Protection (E-Commerce) Rules, 2020, which already apply to anyone selling online in India. Payment gateways such as Razorpay also ask for them. ComplyKaro checks both, because most sites need both.

Does a good score mean my website is compliant?

No. ComplyKaro reads what any visitor can see: what loads in the browser, your banner, your forms and your policy pages. It can't see how you store, secure or delete data behind the scenes, and it doesn't judge whether your policy wording is legally sufficient. Treat the score as a list of visible gaps to close, not a certificate.

How does it check consent?

We open your homepage in a fresh browser, as a first-time visitor who hasn't clicked anything, and record every analytics, ad and session-recording request and cookie. If your banner has a reject button, we click it, load the page again and check that tracking stays off.

What do you store about my scan?

The address you scanned and the report, for 12 months, so the report link keeps working. If you ask for the PDF by email, we keep that email address. Details are on the privacy page.

Can I scan someone else's website?

ComplyKaro only looks at public pages, the way a visitor's browser does, and loads at most about ten pages. Please scan sites you own, manage or are evaluating.

ComplyKaro is an automated check of public web pages. It is not legal advice.