How the India DPDP Readiness Index is built
Which websites are included, what each check tests, how the score and grade are calculated, and what the Index cannot tell you.
1. Which websites are included
The Index covers websites run through the free Privacy Labs DPDP scanner between 17 December 2025 and 8 October 2026. They were entered by visitors to our website and by our own team while researching Indian businesses. They are not a random sample of Indian businesses.
- Each website counts once: we use the latest full scan of each domain.
- A repeat view of a stored report is not a new scan and is not counted.
- Our own domains and test domains are excluded (3 in this edition).
- That leaves 523 websites. 71% show Indian signals such as a .in domain, rupee prices, or an Indian address or phone number.
2. What a scan does
The scanner opens the website in a fresh browser with no cookies and no consent given, the way a first-time visitor arrives. It makes no choice on any banner. It records what the page shows and what loads, then finds the privacy policy and reads its text.
3. The website checks (60% of the score)
| Check | What it tests | Points |
|---|---|---|
| Consent banner | Whether the page shows a consent banner before any choice, and whether it offers reject and preferences options as well as accept. | 25, plus 5 for a reject option and 5 for a preferences option |
| Cookies before consent | Whether tracking or high-risk cookies are set before the visitor makes a choice. | 25 |
| Third-party trackers | How many third-party tracking services load before any choice. | 15, minus 2 for each tracker, to a floor of 0 |
| Privacy policy | Whether a privacy policy is linked and loads. | 15 |
| HTTPS | Whether the website is served over HTTPS. | 10 |
| Privacy contact | Whether the website publishes a contact for privacy questions (Rule 9). | 10 |
Table 1. Website checks. The total is capped at 100.
A website that loads no trackers and sets no tracking cookies needs no consent banner, so it gets full points for the banner, cookie and tracker checks.
4. The privacy policy check (40% of the score)
The policy text is read against eleven DPDP requirements. Each one is marked covered (1 point), partly covered (half a point) or missing (0). The policy score is the share of points earned.
| Requirement | Basis |
|---|---|
| Breach Notification | Rule 7 |
| Cross-Border Transfers | Rule 15 |
| Children's Data | Rules 10-12 |
| Data Retention & Erasure | Rule 8 |
| Legitimate Uses | Act §7 |
| Data Principal Rights | Rule 14 |
| Consent | Rule 3(c)(i) |
| Grievance Redressal | Rule 14(3) |
| DPO Contact | Rule 9 |
| Data Fiduciary Obligations | Rule 6 |
| Notice Before Collection | Rule 3 |
Table 2. Requirements the policy text is read against.
5. Score and grade
Score = 60% website checks + 40% policy check, rounded to a whole number. If the policy could not be read, the score is the website checks alone, so our own failure to read a policy never lowers a score.
| Grade | Score |
|---|---|
| A | 90 to 100 |
| B | 75 to 89 |
| C | 60 to 74 |
| D | 40 to 59 |
| F | Below 40 |
Table 3. Grade bands.
Fails a basic check
Separately from the grade, a website fails a basic check if any one of these is true: trackers load before the visitor makes a choice; it tracks and shows no consent banner with a reject option; it links no privacy policy; or it publishes no privacy contact. A high grade can hide one failure behind strong results elsewhere; this measure does not. It is measured on the 436 websites with a full technical scan, and 89% of them fail at least one.
6. Sectors
Each website's sector is the scanner's own classification from the page content. Sectors with fewer than 25 websites, and websites the scanner could not classify, are counted in the totals but not shown separately (87 websites in this edition).
7. Known limits
Back to the India DPDP Readiness Index, October 2026. Questions about the method: founder@theprivacylabs.com