India DPDP Readiness Index, October 2026
How 500+ Indian business websites measure up to the DPDP Act 2023 and the DPDP Rules 2025, seven months before the core duties apply on 13 May 2027.
1. How websites scored
Each website gets a readiness score out of 100 and a grade from A to F. The average score is 56.7. More than half of the websites land at D or F.
Figure 1. Websites by grade, share and count. n = 523.
2. Consent and tracking
From 13 May 2027, Rule 3 requires consent to come with a clear notice, and withdrawing it to be as easy as giving it. Today most websites ask for nothing, and the ones that ask rarely offer a way to say no.
| What a first-time visitor meets | Websites |
|---|---|
| A consent banner of any kind | 16.1% |
| A consent banner with a reject option | 4.4% |
| Trackers loading before any choice | 76.4% |
| A published privacy policy | 90.8% |
| A published contact for privacy questions | 67.4% |
Table 1. Share of websites. n = 436 websites with a full technical scan.
The trackers that load first are mostly Google's, followed by Meta and Microsoft.
Figure 2. Share of websites where each company's tracker loaded before the visitor made any choice. n = 436.
3. What privacy policies cover
We read 307 privacy policies against eleven DPDP requirements. Most policies describe what they collect. Few say what happens after a breach, when data leaves India, or how children's data is handled.
Figure 3. Coverage of each requirement, least covered first. n = 307 privacy policies.
4. By sector
Readiness varies by sector. Technology websites do best; the sectors that handle the most consumer data do worst.
| Sector | Websites | Average score | Scored D or F |
|---|---|---|---|
| Education | 140 | 51.7 | 64% |
| Healthcare | 45 | 51.9 | 62% |
| E-commerce | 97 | 52.2 | 70% |
| Finance | 52 | 56.2 | 52% |
| Technology | 102 | 64.2 | 39% |
Table 2. Sectors with at least 25 websites, least ready first. 87 websites in smaller or unclassified sectors are in the totals but not shown.
5. Method
The Index uses 523 websites scanned with the free Privacy Labs DPDP scanner between 17 December 2025 and 8 October 2026, counting the latest full scan of each domain once. 71% show Indian signals such as a .in domain, rupee prices, or an Indian address or phone number. Repeat views of a stored report are not counted, and our own and test domains are excluded.
A scan loads the website in a fresh browser with no consent given. It records the consent banner, the cookies and trackers that load, the privacy policy and the privacy contact, and reads the policy text against eleven DPDP requirements. The technical checks cover 436 websites and the policy reading 307, because older scans predate some checks. Sectors are the scanner's own classification.
The full method, including the scoring rubric and grade bands, is on the methodology page.
Frequently asked questions
What is the India DPDP Readiness Index?
A benchmark of how Indian business websites measure up to the DPDP Act 2023 and the DPDP Rules 2025, built by Privacy Labs from 500+ public website scans. This is the October 2026 edition.
How ready are Indian websites for the DPDP Act?
Not very, seven months before the core duties apply on 13 May 2027. 89% of the websites we scanned fail at least one basic check a visitor can see, 56% scored D or F, only 4.4% show a consent banner with a reject option, and 76% load trackers before the visitor makes any choice.
Does a low score mean a website breaks the law?
No. The DPDP duties these checks test apply from 13 May 2027, and a public scan sees only what a visitor sees. The score measures readiness, not legal compliance.
Can I cite these numbers?
Yes, with attribution: "Privacy Labs, India DPDP Readiness Index, October 2026", linking to this page.
Cite as: Privacy Labs, India DPDP Readiness Index, October 2026. theprivacylabs.com/dpdp-readiness-index. Press and data questions: founder@theprivacylabs.com