Readiness Program
A badge buyers can verify, not just look at
The badge links to a live page with a signed credential, so a customer’s procurement team can confirm your status, scope and expiry in seconds, and see it change if you slip.
What a verification page shows
An illustration. This is a sample layout with made-up values, not a real holder.
- Holder
- Example Pvt Ltd (CIN verified against MCA)
- Level
- DPDP + Global Ready Verified
- Scope
- example.com, app.example.com
- Issued
- 30 Oct 2026
- Expires
- 29 Oct 2027
- Last monitoring pass
- 2 days ago
- Frameworks
- DPDP Act 2023 and Rules 2025 · GDPR · CCPA · SOC 2 readiness
- Evidence integrity
- Merkle root and signature fingerprint of the evidence pack
This is an independent readiness verification, not a certification by the Government of India, the Data Protection Board, or an auditor under AICPA. Page also states what was and was not assessed.
The page has a machine-readable twin: a JSON credential signed with Ed25519, checkable against our published public keys. No vulnerabilities or technical detail that would help an attacker are ever shown.
The twelve criteria
All must be met at issuance. Controls referenced here are in the audit checklist.
- E1 Zero open Critical controls in scope.
- E2 At most two open High controls, each with an owner and a fix date within 30 days.
- E3 DPDP score at least 85%; Growth and Enterprise also need a GDPR and CCPA overlay score of at least 80%.
- E4 Consent flow live in production on every in-scope form, verified by an external crawl.
- E5 No consent-requiring tracker fires before consent on in-scope pages.
- E6 Notice published in English plus at least one more language, matching the purpose register.
- E7 Grievance contact published and monitored; a test email answered within 48 hours.
- E8 Working rights channel: synthetic access and erasure requests completed within SLA.
- E9 Incident response plan adopted; tabletop held in the last 90 days.
- E10 Signed management representation letter.
- E11 Public "compliant" and "secure" claims reviewed.
- E12 Enterprise only: architecture facts verified and signed by engineering; independent pen test within 12 months.
Outcomes: Pass issues the badge; Conditional issues it with a 30-day cure window; Fail gives no badge, with one free retest.
Status states
- Active
- All criteria met and monitoring passing.
- Conditional
- Issued with a pending-conditions banner; 30 days to cure or it is revoked.
- Expiring
- Within 30 days of expiry; recertification is open.
- Expired / Revoked
- Shown live with the reason category.
Continuous monitoring
- Badge embed present and pointing at our imageDaily
- Consent flow healthy; no new tracker firing before consentWeekly
- Notice live and version matches; grievance contact answers a test emailWeekly / monthly
- TLS, HSTS and security headers baselineWeekly
- New forms or domains outside scopeMonthly
Revocation is for material misrepresentation, an undisclosed breach with a regulator finding, or failures not cured within 30 days. Holders get the reasons and a 14-day written appeal decided outside the original assessor chain.
Annual recertification
- Validity: 12 months. Enterprise adds a 6-month interim review.
- Window: opens 60 days before expiry, with a 30-day grace period.
- What is re-checked: full rescan, changes to data inventory, vendors, notices and incidents, a rights-request drill and training evidence.
- Earlier review is triggered by: new data category (KYC, children), new country, new major vendor, architecture change, a security incident, or a change in law.
- Independence: whoever helped you fix issues does not make the badge decision, and criteria changes are published with 90 days’ notice.
Frequently asked questions
Is the badge a government or regulator certification? ▾
No. It is an independent readiness verification by VerifID. It is not issued by the Government of India, the Data Protection Board or an AICPA auditor, and every verification page says so.
Why not just say "DPDP Compliant"? ▾
No regulator issues a compliance seal, and an unsupported absolute claim can be misleading under consumer-protection rules. A dated, scoped "Ready, verified" statement is accurate and still useful to buyers.
What happens if we fall out of compliance after getting the badge? ▾
Weekly and monthly checks watch the badge embed, consent flow, notice and security basics. Failures first warn you, then move the badge to Conditional after 7 days, and it can be revoked if not fixed within 30 days. Revocation shows instantly because the badge image is served from our domain.
How long does a badge last? ▾
Twelve months. Recertification opens 60 days before expiry, with a 30-day grace period. A material change, such as starting to collect KYC data or entering a new country, triggers an earlier review.