Our external scanner performs 16 checks across the obligations that are observable from outside a website: whether a notice is published, whether consent is taken before tracking, whether a contact or grievance route is published, whether transport security is in place, and whether third-party scripts load before consent. It runs on the auditor's own machine, against a real browser, so it can reach staging and pages behind a login. Here is what we found on our own pages, and, more importantly, what the tool refused to conclude.
Present and operating are different findings, and reporting them as one is how compliance tools lie.
What a scanner can show
A scanner can show presence. It can tell you that a notice exists, that it is reachable, that it names a contact, that traffic is encrypted, and that a tracking script fires at a particular moment. Those are real, useful, checkable facts, and most organisations cannot currently produce them on demand.
What a scanner cannot show
A scanner cannot show operation. It cannot prove that consent was genuinely taken before collection for a real person on a real visit, that a withdrawal was honoured, or that retention ended. Those take evidence of behaviour over time, not a single observation.
That is why anything the scanner touches is capped at completeness_verified in our engine. The cap is not modesty; it is accuracy. Present and operating are different findings, and reporting them as one is how compliance tools lie.
Why we did this publicly
We did this publicly for two reasons.
First, credibility. A vendor that will not run its own tool on itself is asking for a trust it has not earned. The scanner is the easiest of our tools to apply honestly, so we start there.
Second, it demonstrates the whole method. The interesting output is not the pass list. It is the line where the tool stops and says, "I can confirm this is present, and I cannot tell you it works." That line is the difference between a checklist and an audit, and it is the reason a signed, evidence-gated report is worth more than a green tick.
What to take from it
- Run the observable checks on yourself today. Notice, consent-before-tracking, a published contact, transport security. They are cheap and they find real gaps.
- Do not let a scanner's pass become your compliance story. It is the floor.
- Cap what you claim. If a control is present and not proven, say "present."
We will publish our own scan results next to the ceiling, not instead of it.
DPDP Done is an AI-powered DPDP Act 2023 audit engine built by Cyber Vigilance Group. The scanner is one of its inputs, and it is deliberately the weakest. Not legal advice. www.dpdpdone.com