Here is why it fails first, and what passing requires.
It is the only obligation the world can see
Most obligations are internal: how you retain data, how you secure it, and how you handle a rights request. The consent notice is external and public. Anyone can open the site and test it. That makes it the cheapest finding to raise and the hardest to hide.
It is also the obligation whose test type is most often E2E rather than DOC. You do not pass it by having a notice. You pass it by showing that the notice was given, in the required form, before collection, for real people.
Compliance is a claim until evidence proves it.
The three places it breaks
- Ordering. The tracking fires before the banner is answered. The notice exists; the sequence is wrong. This is invisible to a policy review and obvious to a scan. Remember the ceiling: a scan shows a control is present, never that it operates across every session.
- Language. The Rules provide for the notice in English or a language the data principal can understand, drawn from the scheduled languages. Many organisations publish English only and call it done. The obligation is about comprehension, not publication.
- Drift. The notice describes a flow that changed six months ago. A new field, a new vendor, a new purpose: none of it reflected. The document and the system quietly disagree, and that disagreement is the finding.
Why it is easy to fake and hard to prove
A consent notice is trivial to have and hard to evidence. You can deploy one in an afternoon. You cannot produce, months later, a record that a specific person saw a specific version in a specific language before their data was collected, unless you instrumented it.
That gap between easy-to-have and hard-to-prove is where compliance programmes quietly fail. An assertion is not evidence.
What passing requires
- Order it. Nothing that collects or tracks fires before a lawful basis exists.
- Version it. Every notice has a version and a date, and you keep the history.
- Translate it. Provide notices in the languages the Rules require, not just the one your team reads.
- Instrument it. Record that the notice was shown, in which language, at which version. That record is the evidence.
- Keep it aligned. When a flow changes, the notice changes in the same release.
Start here
If you are beginning DPDP work, start at the notice. It is the highest-signal obligation, it is checkable today, and fixing it forces you to build the record-keeping that the rest of the Act depends on.
DPDP Done is an AI-powered DPDP Act 2023 audit engine built by Cyber Vigilance Group. Not legal advice. www.dpdpdone.com