Compliance is a claim until evidence proves it.
The two findings
Present means we observed the control in place, now, from the outside. A consent banner rendered, a notice was reachable, a contact page existed, or transport was encrypted. That is one observation, at one moment, from one vantage point.
Operating means the control does what it claims, reliably, over time, for real people. Consent was taken before collection, every time. Withdrawal was honoured, retention ended on schedule, and deletion happened and can be shown to have happened. The first is a photograph; the second is a film.
Why the distinction matters legally
A regulator looking at a DPDP obligation asks whether the organisation can demonstrate the behaviour. A screenshot of a banner does not demonstrate that consent preceded collection for a given person on a given visit. It demonstrates that a banner existed.
If a tool reports "consent control: pass" from a screenshot, it has claimed more than it measured. The organisation then carries that overclaim into an audit, and the first person to ask for the underlying record collapses it.
What we do instead
A scan can raise an observation. It can never raise a control to operating effectiveness. In our engine, scan evidence is capped at completeness_verified (a real, useful state, and a lower one). Reaching operating effectiveness requires evidence of behaviour: logs, records, or a quoted passage a reader has assessed.
The scanner's output is deliberately the weakest input we accept. We say so on the report in a Technical Coverage section that names what was scanned, from which vantage, with which rule pack, and states the ceiling.
The general lesson
This is not only about scanners. It applies to any control you cannot prove:
- A policy is present. Compliance is operating.
- A training deck is present. A trained team is operating.
- A DPIA template is present. A DPIA that changed a decision is operating.
The honest move is to label which one you have. The tempting move is to blur them.
We chose the ceiling because a compliance tool that inflates its findings is worse than no tool at all. It converts uncertainty into false confidence, and false confidence is what gets organisations penalised.
DPDP Done is an AI-powered DPDP Act 2023 audit engine built by Cyber Vigilance Group. Our scanner is capped at completeness_verified by design. Not legal advice. www.dpdpdone.com