DPDP Act 2023
DPDP Consent Readiness Checker
Is your consent flow DPDP-ready? Check notice, withdrawal, language and dark-pattern requirements.
How this is calculated
- Each of the eight questions is one consent requirement drawn from the DPDP Act (ss.5, 6 and 9), the DPDP Rules 2025 and, for dark patterns, the Central Consumer Protection Authority’s 2023 guidelines; each Yes counts as one in place.
- Readiness = requirements in place divided by eight, rounded to a whole percentage. 80% or more is green, 50% to 79% amber, below 50% red.
- Every No becomes a gap note explaining the risk, including the relevant Schedule ceiling where one applies.
Constants the tool uses
Unless a value names a study, it is VITI Security's working estimate for budgeting - not taken from a statute or a dated study - so treat it as an adjustable assumption.
- Weight per requirement
- Equal (12.5 percentage points each)
- Colour thresholds
- Green from 80%, amber from 50%
Worked example
The calculator run on its default inputs:
- Consent is free, specific, informed, unconditional & unambiguous
- No
- Clear notice with itemised description of data & purposes
- No
- Withdrawing consent is as easy as giving it
- No
- Consent Manager support planned or implemented
- No
- Verifiable parental/guardian consent for children
- No
- Notice available in English + 22 scheduled languages (on request)
- No
- Consent records maintained (who, when, for what)
- No
- No dark patterns in the consent UX
- No
0/8 controls in place
0% ready
- Controls in place
- 0 of 8
- Gaps to close
- 8
- Readiness
- 0%
All eight answers default to No, so the result is 0/8 controls in place (0% ready) with eight gaps listed. Seven Yes answers (88%) are the first result in the green band.
Sources
- Digital Personal Data Protection Act, 2023 (MeitY) - notice (s.5, including the English or Eighth Schedule language option), consent standard and withdrawal (s.6), Consent Managers (s.6(7)-(9)), burden of proof (s.6(10)), children (s.9), Schedule ceilings
- DPDP Rules, 2025 (MeitY) - notice contents, Consent Manager registration (Rule 4, from 13 November 2026) and commencement of the other rules on 13 May 2027
- Guidelines for Prevention and Regulation of Dark Patterns, 2023 (Central Consumer Protection Authority) - the 13 specified dark patterns prohibited under the Consumer Protection Act, 2019
Sources last checked September 2026.
Limitations
Consent is only one lawful basis: s.7 lists legitimate uses that need no consent, which this checker does not assess. A Yes cannot show whether your notice and flow actually meet the standard, and the Rules add detail on notice content and children’s consent that a checklist compresses. This is an indicative estimate for education and planning, not legal advice. Laws and published figures change, and regulators and courts apply discretion no calculator can model - confirm with a qualified legal or compliance professional before acting on a result.