Interactive Checklist

C-22 Procurement & Sourcing Procurement & Sourcing Lead

The Vendor PoV Checklist

Proof of Value (PoV) vendor evaluation checklist ensuring rigorous, fair, and defensible privacy technology procurement under Chapter 30.

Statutory Source: Ch. 30: identical test data, pass criteria published, exportability, lock-in, hosting, processor terms, TCO, failure recovery

Total Verification Points: 6 Audit Checks

C-22Ch. 30: identical test data, pass criteria published, exportability, lock-in, hosting, processor terms, TCO, failure recovery

The Vendor PoV Checklist

RFP engagements; also our own sales methodology

Readiness Score

0 / 6 checks

Standardized Test Dataset: All vendor bidders tested against identical synthetic enterprise data schemas.

Chapter 30

Published Evaluation Criteria: Weighted scoring criteria shared transparently with all participating vendors.

Chapter 30

Data Portability & Exportability: Vendor software supports standardized, non-proprietary JSON/CSV data export.

Chapter 30

Hosting & Data Residency: Vendor platform deployed in India or compliant cloud region per Section 16.

Section 16

3-Year Total Cost of Ownership (TCO): All licensing, implementation, cloud compute, and connector fees modeled.

Chapter 24 & 30

Security Baseline Certification: Vendor provides SOC 2 Type II / ISO 27701 certificates and VAPT reports.

Section 8(5)

State automatically persisted in browser localStorage

Statutory Grounding & Legal Perimeter

Mandatory statutory clauses, rules, and gazette requirements enforceable under this checklist.

Enforceable Provisions:

Section 8(2)

Section 8(5)

Section 16

Statutory Context:

This checklist is directly anchored in Ch. 30: identical test data, pass criteria published, exportability, lock-in, hosting, processor terms, TCO, failure recovery. Failure to maintain verifiable affirmative proof of compliance exposes the enterprise to severe adjudication penalties under Section 33 (Schedule) of the DPDP Act.

Target Architecture & Impacted Systems

Enterprise applications, stores, and integration surfaces evaluated by this checklist.

View Full Systems Topology (SYS-001..014) →

In-Scope System Nodes:

SYS-004 Architecture Spec →

Enterprise Cloud Data Warehouse

Purpose-partitioned analytical warehouse staging operational reporting

SYS-010 Architecture Spec →

Consent Ledger & Policy Decision Point

Immutable consent event store and Policy Decision Point issuing authority tokens

Associated Operational Controls (54 OBLs)

Control Master Matrix obligations directly tested by this checklist.

Open Control Matrix →

OBL-08 Workpaper →

Control Dossier OBL-08

OBL-11 Workpaper →

Control Dossier OBL-11

Audit & Implementation Guidance

Best practices for establishing evidence, avoiding traps, and conducting periodic assurance.

Evidence Retention Standard

Do not rely solely on policy documents or statements of intent. Ensure verifiable evidence artifacts (cryptographic logs, test manifests, signed DPA agreements, or automated crawler receipts) are archived for at least 1 year.

Common Implementation Trap

Avoid declaring compliance based on frontend UI alone. The Data Protection Board evaluates the full data pipeline, including database persistence, read replicas, cache invalidation, and third-party processor synchronization.

Previous Checklist

C-21 — The Control-Test Acceptance Checklist

Next Checklist

C-23 — The Consent Manager Integration Checklist