R14 rules
The notice
Whether a notice sits at the form itself, itemises the data collected, states each purpose, and names the route to the Board.
TrustMark reads your live pages the way a regulator would — the form itself, the notice behind it, and the trackers that fire before anyone clicks anything — then scores your consent capture against the DPDP Act.
Twenty published rules. You get the score without signing up for anything.
The rules are pure functions over what was observed — same page in, same finding out. That is what makes a result defensible rather than an opinion.
Whether a notice sits at the form itself, itemises the data collected, states each purpose, and names the route to the Board.
Pre-ticked boxes, permissions bundled into one checkbox, consent made a precondition of service, and consent inferred rather than asked for.
Whether withdrawal is offered, whether the link resolves, whether it is as easy as giving consent was, and whether erasure and nomination are reachable.
What is written to the browser before anyone clicks anything — and whether rejecting actually stops it.
Whether the privacy policy is reachable, whether it has been touched since DPDP, and whether it states a retention period.
The four tracker rules need a real browser. Without that pass they report unknown and leave the denominator — so the score goes up. The report says so out loud rather than quietly banking the flattery.
16 of 20 rules
The form, the consent control, the notice, the withdrawal route and the privacy policy — everything readable from the page source.
The remaining 4
What is stored before consent, and whether rejecting works. Run from two cold profiles, never one, so accept and reject are genuinely compared.
Every rule carries a published weight, so the score after each fix is arithmetic rather than a guess.
Penalties become available and Consent Manager registration opens. The Board can act from this date.
Full force — notice, consent, rights, retention, cross-border transfers and breach obligations all apply.
TrustMark tells you what is broken. Consent Hub records what you fixed, and proves it later — across web, WhatsApp, branch and voice.