Find your DPDP gaps
before May 2027.
A free skill for Claude Code and Cursor. It scans your codebase against India's DPDP Act and lists every gap with file, line and section.
npx skills add brandlabs/dpdp-scan/plugin marketplace add brandlabs/skillsnpx skills add brandlabs/dpdp-scan --agent cursorFree · Runs in your editor · BrandLabs never receives your code
> /dpdp-scan DPDP scan · sample-wellness-app · 412 files · 38s Checked against DPDP Act 2023 and DPDP Rules 2025 HIGH Health data stored before consent is recorded src/onboarding/profile.ts:88 Sec. 6 HIGH Phone numbers and names written to LLM logs src/chat/logger.ts:41 Sec. 8(5) HIGH No age check before processing a child's data src/auth/signup.ts:120 Sec. 9 · Rule 10 MED Chat transcripts kept with no retention limit db/schema.prisma:214 Sec. 8(7) · Rule 8 MED No breach-intimation workflow (missing) Sec. 8(6) · Rule 7 MED Consent cannot be withdrawn in the app src/settings/privacy.tsx Sec. 6(4) MED Analytics SDK receives email before consent src/lib/analytics.ts:17 Sec. 6 LOW Grievance contact not shown in app src/settings/help.tsx Sec. 8(10) LOW Privacy notice only in English public/privacy.md Rule 3 9 findings · 3 high · 4 medium · 2 low 7 can be fixed by BrandLabs in a Private-by-design sprint Get a fixed quote → brandlabs.app/dpdp-scanner#fix
Ten checks, mapped to the Act.
Each finding cites the section or rule it relates to, so your engineers and your lawyer read the same report.
Notice before collection
Sec. 5 · Rule 3A clear notice of what you collect and why, in English or a scheduled Indian language.
Consent is recorded
Sec. 6Consent is captured, stored with a timestamp and checked before any processing.
Consent can be withdrawn
Sec. 6(4)Withdrawing is as easy as agreeing, and processing actually stops.
Security safeguards
Sec. 8(5) · Rule 6Encryption, access control and access logs kept for at least a year.
Personal data in logs and prompts
Sec. 8(5)Names, numbers or health details sent to logs, analytics or LLM providers.
Breach intimation
Sec. 8(6) · Rule 7A path to alert users and the Data Protection Board, with a full report within 72 hours.
Retention and erasure
Sec. 8(7) · Rule 8Data is deleted when its purpose ends, and users are told before erasure.
Children's data
Sec. 9 · Rule 10Verifiable parental consent, and no tracking or targeted ads for anyone under 18.
User rights
Sec. 11–14Working routes for access, correction, erasure, grievance and nomination.
Processor contracts
Sec. 8(2)Every SDK and vendor that touches personal data, listed for contract review.
Install, scan, fix.
Most teams have a full report in under ten minutes.
Install the skill
One command in your terminal, or add the BrandLabs marketplace in Claude Code.
Run /dpdp-scan
Your agent reads the repo and writes a report with file, line, severity and section.
Fix the gaps
Fix them yourself, or send us the report and get a fixed-scope plan.
Most findings are engineering work.
Law firms write the policy. We build the consent flows, redaction and logs that make the policy true in your product.
Have your report?
We'll fix what it found.
Send us the scan output. We reply with a fixed-scope Private-by-design sprint, usually 4–8 weeks.
contact@brandlabs.app · WhatsApp +91 95947 02015About the scanner.
Is the DPDP scanner free?
Yes. The skill is free to install and run. You only pay BrandLabs if you ask us to fix what it finds.
Does my code leave my machine?
The scan runs through your own Claude Code or Cursor setup, under your existing agreement with that provider. BrandLabs receives nothing unless you choose to send us the report.
Does a clean scan mean we comply with the DPDP Act?
No. The scanner finds likely gaps in code. Compliance also depends on contracts, policies and how you operate. Treat the report as an engineering checklist and review it with your legal counsel.
When do the DPDP Rules apply?
The DPDP Rules were notified on 13 November 2025. Consent Manager registration opens in November 2026, and most operational duties, including notice, security safeguards, breach intimation and erasure, apply from 13 May 2027.
Who has to comply with the DPDP Act?
Any business that processes digital personal data in India, and businesses outside India that process personal data to offer goods or services to people in India.
What are the penalties under the DPDP Act?
Failing to take reasonable security safeguards can draw a penalty of up to 250 crore rupees. Failing to notify a breach, or breaking the rules on children's data, can each draw up to 200 crore rupees.
The DPDP scanner flags likely gaps in source code. It is not legal advice and does not certify compliance with the Digital Personal Data Protection Act, 2023 or the DPDP Rules, 2025. Last reviewed 3 November 2026.