30-Point Buyer Due-Diligence & Procurement Guide
Every technical question, audit test case, and red flag from institutional privacy procurement checklists is systematically addressed below with concrete operational proofs, live routes, and contractual guarantees.
Does the platform map directly to the Digital Personal Data Protection Act, 2023 and Rules 2025 provisions?
Vague marketing claims referencing GDPR without Indian statutory section citations.
Yes. CompTrust features a live Statutory Controls Register explicitly cross-referencing Sections 5(1), 6(1), 8(5), 8(6), 8(7), 10, 11/12, and 13 with penalty liabilities under Section 33.
How does CompTrust ensure consent is free, specific, informed, and unbundled under Section 6?
Can the platform generate and host legally binding policies with mandatory disclosures?
How are Data Principal rights (access, correction, erasure) verified and fulfilled within 30 days?
Does the system maintain an automated personal data flow catalog and RoPA export?
Does the platform support periodic Data Protection Impact Assessments for Significant Data Fiduciaries?
Does the system assist Significant Data Fiduciaries with statutory obligations under Section 10?
Can CompTrust cryptographically prove irreversible data erasure under Section 8(7)?
Visual status changes in dashboard with no mathematical proof of data destruction.
Every completed retention policy computes a canonical SHA-256 Certificate of Erasure hash, publicly verifiable on our unauthenticated verifier portal at /verify-certificate.
Does the platform enable compliant 72-hour personal data breach notification to DPBI and CERT-In?
How does CompTrust manage third-party processors and provide subprocessor notification?
Are outgoing webhooks cryptographically secured against tampering, spoofing, and replay attacks?
Unsigned webhook payloads that cannot be validated by customer security firewalls.
All webhooks carry X-CompTrust-Signature generated via HMAC-SHA256 with timestamp replay prevention (<=300s) and an interactive Replay Inspector.
Are audit logs immutable and synchronized for forensic investigation?
What encryption algorithms and key management practices protect customer data?
Is all customer personal data stored exclusively within the territory of India?
Offshore cloud hosting in US/EU regions in violation of Indian sovereignty requirements.
100% of production databases, file storage, and audit logs are hosted in AWS Mumbai (ap-south-1) on sovereign Indian soil.
What are CompTrust’s contractual Recovery Point Objective (RPO) and Recovery Time Objective (RTO)?
Does CompTrust support native iOS and Android consent management?
Can consent notices be served in the languages specified in the Eighth Schedule of the Constitution?
What is the performance overhead of the consent banner on website load times?
How does CompTrust prevent cross-tenant data leaks in a shared cloud environment?
How complex is onboarding and migration from existing privacy tools?
Are subscription prices fixed and GST-compliant for Indian corporate entities?
Can our technical team execute automated acceptance tests before purchasing?
Does CompTrust sign a binding statutory Data Processing Agreement (DPA)?
How can our enterprise export its compliance history if we terminate our subscription?
Proprietary formats, export fees, or data hostage scenarios.
1-Click Master Compliance Export generates an unencumbered, machine-readable JSON archive with a SHA-256 cryptographic bundle checksum.