DPDP & Cyber Resilience Act Compliance Verifier

Clear, plain-language notice published identifying the Data Fiduciary, contact points, exact processing purpose, and right to withdraw consent.

Identified Grievance Redressal Officer published with direct email and statutory 30-day escalation SLA before Data Protection Board of India (DPBI).

Strict prohibition of behavioral monitoring, tracking, or targeted advertising directed at children under the age of 18 years.

Operational mechanisms for Data Principals to exercise Right to Access (Sec 11), Correction & Erasure (Sec 12), and Right to Nominate (Sec 14).

Notice of processing available in English and at least one Eighth Schedule language (e.g. Hindi via ?lang=hi).

Zero sensitive data server retention or reasonable security safeguards, with documented protocol for intimation of personal data breach to DPBI.

Product delivered without exploitable vulnerabilities; sensitive computations executed in secure local sandboxes (e.g. Client-Side Web APIs).

Publicly discoverable /.well-known/security.txt with contact email, expiration date, policy link, and safe harbor commitment.

Documented vulnerability handling policy with 24-48h triage and mandatory patch deployment SLAs (critical fixes within 7 days).

Inventory of software components, dependencies, and cryptographic algorithms; zero unverified third-party runtime bundles.

TLS 1.3 enforced with HSTS, X-Content-Type-Options: nosniff, strict CSP, X-Frame-Options: SAMEORIGIN, and secure cookie directives.

Operating procedures established for notification of actively exploited vulnerabilities to ENISA, competent CSIRTs, and CERT-In.