The report
We loaded https://statechecksecurity.com/ in a browser on 4 November 2026 and looked at up to five of its public pages, before and after a visitor makes a choice. Below is what we saw, with the provisions of the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025 it engages.
Before you read
- These findings matter only if you are the Data Fiduciary for this processing: the business that decides why and how the personal data is used (S.2(i)).
- The provisions cited here commence on 13 May 2027.
- We looked at up to five public pages. "We did not find" means we did not find it on the pages we scanned, not that it does not exist.
- We report what a browser saw on one visit. Your site may behave differently for other visitors, devices or regions.
- This report is not legal advice.
What we saw
On the pages we scanned, we did not see any of the things this check looks for. That is what one visit showed; it does not cover the points under "What we could not check".
What the labels mean
- Settled
- The Act or the Rules expressly impose this duty, and what we saw bears directly on it.
- Likely
- A reasonable reading of the text, but it depends on a point the text does not settle: most often whether an online identifier is personal data, or whether a legitimate use covers the processing.
- Open
- Arguable. Reasonable lawyers could disagree, so we show it for you to raise with your lawyer, not as a gap.
Also from the scan
Consent banner
Whether we found a consent banner, and the consent tool it appears to use. No provision requires a banner; we record it because the checks on rejecting and withdrawing depend on it.
- We did not find a consent banner on the requested page.
Login and security cookies
Cookies and storage entries set before any choice that look like login sessions, security tokens, load balancing or a record of the consent choice, by name only. We leave them out of the finding on identifiers set before a choice. The Act has no exemption for cookies a site needs to work, so write down why each one is needed and the basis you rely on.
- None seen before any choice.
Third-party services
Third-party services the site contacted that are not trackers, such as payment gateways, for information only. Where we know it, we name the country the company running each service is based in, from its own legal pages. That is where the company is based, not necessarily where your visitors' data is stored. Under S.16(1) the Central Government may restrict transfers to countries it notifies; none has been notified as of October 2026, so we flag no country.
- None seen before any choice.
Page languages
The languages the scanned pages declare. People must have the option to read the notice in English or any language in the Eighth Schedule to the Constitution (S.5(3)). We checked English text only, and we do not flag an English-only notice.
- Languages the pages declare: en
What we scanned
The pages we loaded, the pages we skipped because robots.txt asked us to or because the check ran out of time, and anything that stopped us, such as a timeout or a bot check.
- Pages we tried to load:
- https://statechecksecurity.com/: the address you asked us to check, loaded
- https://statechecksecurity.com/privacy-policy: linked as the privacy notice, loaded
- https://statechecksecurity.com/terms-of-service: linked as the terms, loaded
- https://statechecksecurity.com/dpdpa/gap-identifier: a linked page that looks like it has a form, loaded
- https://statechecksecurity.com/services/dpdpa-compliance: another page linked from the site, loaded
- Published items we found:
- A contact for privacy questions: on https://statechecksecurity.com/
- How to make a rights request: on https://statechecksecurity.com/privacy-policy
- A grievance response period of 90 days or less: on https://statechecksecurity.com/privacy-policy
- A mention of complaining to the Board: on https://statechecksecurity.com/
- How to withdraw consent: on https://statechecksecurity.com/privacy-policy
- Pages whose text we read: https://statechecksecurity.com/, https://statechecksecurity.com/privacy-policy, https://statechecksecurity.com/terms-of-service, https://statechecksecurity.com/dpdpa/gap-identifier, https://statechecksecurity.com/services/dpdpa-compliance
What we could not check
- Whether you process children's data. A scan cannot tell who your users are, so the duties on children's data, such as the ban on tracking children (S.9(3)), are not checked.
- Your mobile app, logged-in areas and anything behind a form. We never log in or submit a form.
- Text in languages other than English. We note which languages the pages declare, and do not flag an English-only notice.
- Your contracts, records and internal processes, such as consent records, retention and personal data breach response.