Check definitions index
Structured list of all evaluation identifiers used in ComplyDP preparedness scoring, with legal mapping. Pass, fail, partial, manual, and not-applicable thresholds for each check are provided in the full definition; companies disputing a specific finding receive that definition as part of the dispute review.
Signal indicates the primary detection path (e.g. policy text, cookies, site structure). Some checks combine multiple signals.
Breach
| ID | Check | Provision | Signal |
|---|---|---|---|
| CHECK_049 | Breach Notification Process | Section 8(6) | — |
| CHECK_050 | Breach Reporting Channel | Rule 7 | — |
| CHECK_051 | 72-hour Notification Commitment | Section 8(6) | — |
| CHECK_087 | Breach Notice Consequences Disclosure | Rule 7(1)(b) | — |
| CHECK_088 | Breach User Safety Steps Disclosed | Rule 7(1)(d) | — |
| CHECK_089 | Breach Contact Person Named | Rule 7(1)(e) | — |
Children
| ID | Check | Provision | Signal |
|---|---|---|---|
| CHECK_034 | Parental Consent Mechanism | Section 9(1) | — |
| CHECK_035 | Age Verification Present | Section 9(1) | — |
| CHECK_036 | No Harmful Processing | Section 9(2) | — |
| CHECK_074 | No Behavioural Tracking of Children | Section 9(3) | — |
| CHECK_075 | No Targeted Ads at Children | Section 9(3) | — |
| CHECK_109 | Disability Guardian Consent Addressed | Section 9(1), Rule 11 | children |
Consent
| ID | Check | Provision | Signal |
|---|---|---|---|
| CHECK_016 | Consent Banner Presence | Section 6 | — |
| CHECK_017 | Granular Consent Controls | Section 6(1) | — |
| CHECK_018 | Consent Withdrawal Ease | Section 6(4) | — |
| CHECK_019 | No Pre-checked Boxes | Section 6(1) | — |
| CHECK_020 | Clear Consent Language | Section 6(1) | — |
| CHECK_021 | Legitimate Use Without Consent | Section 7 | — |
| CHECK_022 | Cookie Consent Banner | Section 6 | — |
| CHECK_023 | Cookie Categories Disclosed | Rule 3 | — |
| CHECK_024 | No Trackers Before Consent | Section 6 | — |
| CHECK_065 | Consent Not Bundled | Section 6(1) | — |
| CHECK_066 | DPO Contact in Consent Request | Section 6(3) | — |
| CHECK_067 | Consent Withdrawal Comparable Ease | Section 6(4) | — |
| CHECK_068 | Legitimate Use Basis Disclosed | Section 7 | — |
| CHECK_079 | Pre-consent Analytics Trackers | Section 6 read with Rule 3 | cookie_scan |
| CHECK_080 | Pre-consent Marketing Trackers | Section 6 read with Rule 3 | cookie_scan |
| CHECK_081 | Tracker Inventory Disclosed | Section 5(1) read with Rule 3(a) | cookie_scan |
| CHECK_093 | Misleading Consent Clauses | Section 6(1), Section 6(2) | — |
| CHECK_101 | Consent Management Platform Detected | Section 6(7), Section 6(9) | consent_manager |
| CHECK_102 | Consent Manager Identified | Section 6(7) | consent_manager |
| CHECK_103 | Consent Manager Accessible | Section 6(4), Section 6(7) | consent_manager |
| CHECK_108 | Cookie Policy Not Browser-Only Instructions | Section 6(4) | cookies |
Data Collection
| ID | Check | Provision | Signal |
|---|---|---|---|
| CHECK_037 | Data Minimization | Section 5(1) | — |
| CHECK_038 | Purpose Limitation | Section 5(1) | — |
| CHECK_039 | Form Fields Inventory | Section 5 | — |
| CHECK_040 | Form-level Notice | Rule 3 | — |
| CHECK_041 | Inferred Data Disclosure | Section 5 | — |
| CHECK_042 | Sensitive Data Handling | Section 2(t) | — |
| CHECK_070 | Data Accuracy Commitment | Section 8(3) | — |
| CHECK_097 | Signup Flow Detected | Section 5(1), Section 6(1) | site_discovery |
| CHECK_098 | Checkout/Payment Flow Detected | Section 5(1), Section 6(1) | site_discovery |
| CHECK_106 | Context-specific Notices at Collection Points | Section 5(1), Rule 3 | specialized |
Notice
| ID | Check | Provision | Signal |
|---|---|---|---|
| CHECK_001 | Privacy Notice Exists | Rule 3(1) | — |
| CHECK_002 | Notice is Standalone | Rule 3(1) | — |
| CHECK_003 | Notice Readability | Rule 3(2) | — |
| CHECK_004 | Scheduled Languages Support | Rule 3, Second Schedule (DPDP Rules 2025) | — |
| CHECK_005 | Indian Language Options | Rule 3, Second Schedule (DPDP Rules 2025) | — |
| CHECK_006 | Data Purpose Specificity | Section 5 | — |
| CHECK_007 | Consent Grounds Clarity | Section 6 | — |
| CHECK_008 | Data Retention Period | Section 8(7) | — |
| CHECK_009 | Rights of Data Principal | Section 11-14 | — |
| CHECK_010 | Third-party Sharing Disclosure | Section 8(8) | — |
| CHECK_011 | Data Fiduciary Identity | Rule 3 | — |
| CHECK_012 | Security Safeguards Disclosure | Section 8(5) | — |
| CHECK_013 | Cross-border Transfer Disclosure | Section 16 | — |
| CHECK_014 | Breach Notification Policy | Section 8(6) | — |
| CHECK_015 | Notice Update History | Rule 3 | — |
| CHECK_061 | Notice Independence | Rule 3(a) | — |
| CHECK_062 | Itemised Personal Data Description | Rule 3(b)(i) | — |
| CHECK_063 | Specific Goods/Services Description | Rule 3(b)(ii) | — |
| CHECK_064 | Withdrawal Link in Notice | Rule 3(c)(i) | — |
| CHECK_082 | Privacy Policy Accessibility | Rule 14(1)(a) | — |
| CHECK_091 | Board Complaint Link in Notice | Rule 3(c)(iii) | — |
| CHECK_092 | GDPR Language in DPDP Context | Section 4, Section 6, Section 7 | — |
| CHECK_095 | Terms and Conditions Page Exists | Section 5(1) | site_discovery |
| CHECK_096 | Compliance Links Not Broken | Section 5(1), Rule 3 | site_discovery |
| CHECK_099 | Sitemap Present | Section 5(1) | site_discovery |
| CHECK_100 | Robots.txt Present | Section 5(1) | site_discovery |
| CHECK_104 | Section 17 Exemption Claims | Section 17 | specialized |
| CHECK_105 | Section 15 Duties Not Imposed on Users | Section 15, Section 6(2) | specialized |
Processor
| ID | Check | Provision | Signal |
|---|---|---|---|
| CHECK_052 | Processor Contracts Disclosed | Section 8(8) | — |
| CHECK_053 | Third-party List Available | Section 8(8) | — |
| CHECK_054 | Processor Compliance Assurance | Section 8(8) | — |
| CHECK_055 | Sub-processor Disclosure | Section 8(8) | — |
| CHECK_069 | Data Processor Contract Disclosure | Section 8(2) | — |
Retention
| ID | Check | Provision | Signal |
|---|---|---|---|
| CHECK_056 | Retention Period Specified | Section 8(7) | — |
| CHECK_057 | Erasure on Withdrawal | Section 8(7) | — |
| CHECK_058 | Erasure Trigger Conditions | Section 12(3) | — |
| CHECK_072 | Erasure on Purpose Completion | Section 8(7)(a) | — |
| CHECK_073 | 48-Hour Pre-Erasure Notification | Rule 8(2) | — |
| CHECK_090 | Minimum 1-Year Processing Log Retention | Rule 8(3) | — |
Rights
| ID | Check | Provision | Signal |
|---|---|---|---|
| CHECK_025 | Grievance Officer Appointed | Rule 6(1) | — |
| CHECK_026 | Grievance Contact Details | Rule 6(1) | — |
| CHECK_027 | Grievance Response Timeline | Rule 14(3) | — |
| CHECK_028 | Access Request Process | Section 11 | — |
| CHECK_029 | Correction Request Process | Section 12 | — |
| CHECK_030 | Erasure Request Process | Section 12(3) | — |
| CHECK_031 | Nomination Rights Disclosed | Section 14 | — |
| CHECK_032 | Rights Portal Accessible | Section 11-14 | — |
| CHECK_033 | DSR Form Available | Section 11-14 | — |
| CHECK_071 | Contact Person Prominently Published | Section 8(9), Rule 9 | — |
| CHECK_076 | Data Sharing Identity Disclosure | Section 11(1)(b) | — |
| CHECK_077 | Rights Exercise Means Published | Rule 14(1)(a) | — |
| CHECK_078 | Identifier for Rights Requests | Rule 14(5) | — |
| CHECK_083 | Contact Person Prominent on Homepage | Section 8(9), Rule 9 | — |
| CHECK_094 | Dark Patterns in Rights Flow | Section 13(1), Section 6(4) | — |
SDF
| ID | Check | Provision | Signal |
|---|---|---|---|
| CHECK_059 | SDF Status Disclosure | Section 10 | — |
| CHECK_060 | Data Protection Officer | Section 10(2) | — |
Security
| ID | Check | Provision | Signal |
|---|---|---|---|
| CHECK_043 | HTTPS Enabled | Section 8(5) | — |
| CHECK_044 | Security Safeguards | Section 8(5) | — |
| CHECK_045 | Encryption Disclosure | Section 8(5), Rule 6(1)(a) | — |
| CHECK_046 | Access Controls | Section 8(5), Rule 6(1)(b) | — |
| CHECK_047 | Security Policy Published | Section 8(5) | — |
| CHECK_048 | Data Protection Measures | Section 8(5), Rule 6(1)(g) | — |
| CHECK_084 | Log Retention Period (1 Year) | Rule 6(1)(e) | — |
| CHECK_085 | Backup and Recovery Measures | Rule 6(1)(d) | — |
| CHECK_086 | Security Monitoring Disclosure | Rule 6(1)(c) | — |
| CHECK_107 | Vulnerability Disclosure Program | Section 8(5), Rule 6(1)(c) | security |