20 Oct 2026
What a website scan can (and cannot) tell you about DPDP readiness
A scan sees your public surface. Here is what it can confirm, what it can only flag, and what it can never see.
Can confirm
- Forms and the fields they collect.
- Whether a notice is linked near each form.
- Whether consent boxes exist and are pre-ticked.
- Which third-party scripts load.
- HTTPS and basic header signals.
Can only flag for follow-up
- Whether consent withdrawal exists behind login.
- Whether trackers receive personal data.
Cannot see
- Databases, encryption at rest, access control, retention and deletion, vendor contracts, breach handling.
That is why OmniCompliq labels each finding as confirmed, potential, customer-attested or not assessed - and never treats unknown as compliant.
Pending legal review. Not legal advice.