DPDP Readiness Index, edition 1. September 2026
The firms selling DPDP advice score 71 out of 100 on their own websites.
Gevox scanned the public websites of the Indian law firms and consultancies that advertise DPDP Act services. The average score was 71. Nineteen of the twenty load tracking or set cookies before consent, and four in five name no processor for the personal data their forms collect.
Sites
20
Checks per site
16
Scanned
1 to 13 September 2026
Named
None
01 · The score
71
Average of20, Out of 100
10 of 20 sit at 75 or above. The lowest scored 40, the highest 96.
Where each of the 20 sites landed.
Each dot is one site. Green dots are at 75 or above, ochre below. The score is the same deterministic 0 to 100 the Gevox scanner gives inside a client workspace, so any firm can run its own and put a dot on this line.
02 · The checks
Each bar runs from 0 to 20 sites. The filled part is how many failed that check; the number beside it is how many passed.
Provisions cited
Five checks, ordered by how many failed.
03 · The split
The visible duties get done. The invisible ones do not.
Duties a visitor can see
A Section 5 notice on the page and a Section 8(9) privacy contact published.
Duties a visitor cannot see
Section 6 consent before anything loads, and Section 8(2) processors disclosed.
A notice and a privacy contact are the first two lines on every advisor’s own client checklist, and most of the sample has both. Consent timing and processor disclosure are technical, live in the first second of a page load, and never appear on a checklist. That is where the sector fails.
04 · The first second
A typical order on the failing sites. Every amber point is a request that carries the visitor’s IP address, device and page to a third party.
What happens before anyone is asked.
Section 6 requires consent to be a clear affirmative action given before processing. A banner that appears after the head of the page has run is asking permission for something that has already happened.
05 · Why the scores read high
The same site, judged two ways.
What a checklist sees
4/4
- YIs there a privacy policy?
- YIs a privacy contact published?
- YIs the site on HTTPS?
- YAre the security headers set?
What the Act asks
1/4
- YDoes the notice itemise the data and the purpose?Section 5, Rule 3
- NWas consent given before anything loaded?Section 6
- NIs every processor under a contract, and disclosed?Sections 8(2) and 11(1)(b)
- NAre the safeguards reasonable for this data?Section 8(5)
A checklist asks whether things exist. The Act asks whether they do what the section requires. The typical site in this sample passes the first and fails the second, and its score sits in the seventies because the scanner weighs both.
06 · Method
Next edition: October 2026, the clients of these advisors (startups and fintechs).
How it was measured.
- 01
Twenty public websites were selected from firms that advertise DPDP Act 2023 services on their own site. No firm was told in advance and no firm is named.
- 02
Each site was scanned once with the Gevox scanner between 1 and 13 September 2026, using the sixteen-check revision in force at the time. The scan has since been deepened to twenty-two checks, so a site re-scanned today is examined for more than this edition measured. Public pages only; nothing behind a login.
- 03
Each check returns pass, fail or not assessable. A number above is the count of sites that failed that check, over the twenty. Not assessable results are counted as neither.
- 04
The average is the arithmetic mean of the twenty scores, rounded to the nearest whole number.
- 05
The same scan is free to anyone at gevox.in/scan, so any firm can check its own position against these numbers.
Your turn
Put your own site on the line above.
Free, no signup for the score. The scan now runs twenty-two checks, six more than this edition used.
The DPDP brief
One email a month. What moved in the Act, and what our scans found.
Every claim cited to its section, the same way these pages are. No product news, no roundups of other people’s blogs.