How we check

What GazeVeil looks at, how it rates what it sees, and where it stops.

What a check does

GazeVeil loads a site's public pages the way an ordinary browser does, and reads the public DNS and TLS records for the domain. It then compares what it saw with the obligations in the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025.

It does not log in, submit a form, or type into a field. It does not guess or list addresses, and it never uses a password or key it comes across. If a key is exposed on a public page, the report says that it is exposed. The key is never used.

The one thing it does besides reading is click a button that only reveals something on the page, such as a cookie or contact dialog. A visitor does the same, and nothing is sent.

When it recognises personal data on a page, it records only the type of data and how many were seen. The data itself is thrown away the moment it is recognised and is never saved.

What the checks look at

• Cookies, trackers and consent. What the site sets or loads as a page opens, and what the cookie banner says and does.
• The privacy notice. Whether there is one, whether a visitor can find it, and which of the things the Act asks a notice to say it covers.
• Forms. Which forms ask for personal data, and what consent wording sits beside them. We read the form. We never fill it in.
• Exposed keys. Whether a secret key has been left in the code that every visitor's browser downloads. Keys that are meant to be public are not reported.
• Connection and domain. The site's DNS records, its TLS certificate and its security headers.

How findings are decided and rated

Each check is a written rule, kept as a plain text file. A rule says what must be seen for it to apply, so the same page always gives the same findings. A language model does not decide which section of the Act applies. It is used only to put a finding into readable words, or to settle the wording of a notice that a plain keyword check could not.

Every finding carries two separate ratings:

• Severity is the legal weight of the obligation. It comes from the Act.
• Confidence is how sure we are that the obligation was missed. It comes from what we saw on the page.

A false alarm is worse than a missed finding, so we aim to report something only when the site's owner could not fairly say "that is supposed to be there". Where we cannot tell, we list it as Worth checking, say what we saw and what to look at, and do not count it as a finding.

A finding is one rule that applies, however many pages it appears on. Several findings can share a root cause, the single underlying failure behind them.

The penalty range

Reports show a range for the penalties the Act allows. It is a calibration, not a forecast. It is built from penalty orders that Indian regulators have made in comparable cases, because the Data Protection Board had issued no orders under this Act when the figures were set, and penalties under the Act were not yet in force.

Only the most serious category sets the range, and categories are never added together. The range grows with the number of separate root causes, and is capped at the maximum the Act allows. The size of the company changes the figure, but a public website does not show it, so a report works from the size band it is given. If the size is unknown the range is made wider and the report says our confidence is low.

The Act asks the Board to weigh things such as how serious the breach was and what the company did about it. A website check cannot see any of them, so each is left neutral. The range shows what regulators have done in comparable cases. It does not say what the Board will do.

What a finding means, and what it does not

• A finding means that, at the moment we looked, a public page showed something that does not meet an obligation, or that we could not confirm it meets it.
• It does not mean the law has been broken, that a penalty will follow, or that the site is or is not compliant. Only the Board or a court can decide that.
• No finding on a point does not mean the point is fine. It means we did not see a problem on the public side.

What we cannot see

We can only see the public side of a site. A check made without permission does not run these, and a report lists them as not checked, with the reason:

• Screens that exist only behind a login.
• Things that depend on how a company works inside, such as how long data is kept, how fast requests to see or delete data are answered, or how passwords are stored.
• Whether a server holds files or settings that the site does not link to. Looking for those means asking a server for addresses a visitor would not normally ask for, so we do it only for a site owner who has given us written permission.
• A few checks that are not built yet.

With the owner's written permission a deeper check is possible. It is limited to what the permission says, and the report records what was done and what was skipped.