CompliSeal User Guide

Product Overview

CompliSeal is a compliance management platform built for the Digital Personal Data Protection Act 2023 (DPDP Act) and DPDP Rules 2025. It helps Indian businesses and foreign companies serving Indian users to assess, document, and maintain data protection compliance without requiring a dedicated legal team.

Platform Workflow

CompliSeal is designed to be used in four stages. Each stage has dedicated tools.

Feature Summary

First Steps

Creating Your Account

1. Go to compliseal.cogenz.in/signup Enter your business email address. CompliSeal requires a business email because your compliance scan is scoped to the domain your email belongs to. Personal email providers (Gmail, Yahoo, Outlook, and similar) are not accepted.
2. Confirm your email Click the verification link sent to your inbox. The link is valid for 24 hours. Check your spam folder if you do not see it.
3. Complete your organisation profile Go to Org Settings and enter your organisation name, sector, Grievance Officer name, and Grievance Officer email. This information populates all generated documents. Do this before generating any policies or notices.

Recommended Setup Sequence

For most businesses, the fastest path to baseline DPDP compliance is:

Free vs Pro

CompliSeal has two plans. The Free plan lets you assess your compliance position and begin addressing the most basic gaps. The Pro plan unlocks the full compliance toolkit including policy generation, consent management, data rights handling, breach response, and governance tools.

To upgrade, go to the Dashboard and click Upgrade to Pro, or click the lock icon next to any Pro feature in the sidebar. Payment is processed via Razorpay.

Compliance Scanner

The Compliance Scanner is the starting point for all compliance work on CompliSeal. It fetches and analyses your publicly accessible website and checks it against 13 DPDP Act requirements.

How the Scanner Works

The 13 Checkpoints

Verified Automatically

• Privacy Policy present: Is a privacy policy page accessible on your site?
• Purpose of processing stated: Does the policy explain why data is collected?
• Data Principal rights mentioned: Are user rights (access, correction, erasure) described?
• Grievance Officer published: Is a named Grievance Officer listed with contact details?
• Retention period stated: Does the policy say how long data is kept?
• Multilingual consent: Are consent notices available in Indian scheduled languages?
• Consent withdrawal mechanism: Is there a clear way for users to withdraw consent?
• Preference centre: Can users manage individual consent categories?
• Plain language policy: Is the privacy policy written for a general audience, not a legal audience?

Requires Live Browser Verification

• Cookie consent banner: Does a banner appear before cookies are set?
• Cookie categorisation: Are cookies separated into necessary, analytics, and marketing?
• Tracking blocked before consent: Are third-party scripts held until the user accepts?
• Consent logging: Is each consent event recorded with a timestamp?

Running a Scan

1. Navigate to Compliance Scanner Your registered domain is pre-filled. You can change it to any URL on your domain.
2. Select your business sector This tailors recommendations to your industry (for example, health data handling requirements or FinTech consent rules).
3. Click Scan Now A progress indicator shows which checks are running. The scan typically completes in 30 to 90 seconds depending on your website's response time.
4. View your results Results appear immediately and are also saved to your Scan History so you can track changes over time.

Scan Limits

Scan Report

The Report page shows your compliance score, a plain-language verdict, and a full breakdown of each of the 13 checkpoints. Click any checkpoint to expand it and see the specific finding and evidence the scanner used.

Score Bands

Score Delta

If you have previously scanned the same domain, the report shows how your score changed compared to the last scan. Improvements appear in green; regressions in red. Use this to verify that the changes you made to your website had the expected effect.

PDF Export

Pro users can download a formatted PDF of the report by clicking Download PDF. The PDF is suitable for sharing with your leadership team, auditors, or investors who need to see evidence of compliance activity.

Scan History

All previous scans are saved under Scan History in the sidebar. You can open any past report to see the score and findings at that point in time.

Fix-It Checklist

The Fix-It Checklist translates your scan results into a prioritised list of specific changes you need to make. Each item explains what the scanner found, what needs to change, and why it matters under the DPDP Act.

How to Use It

1. Open from the Report page Click View Fix-It Checklist after a scan completes.
2. Work through items in priority order Items are sorted by impact. Critical items (tied to high regulatory penalty exposure) appear first.
3. Mark items complete Tick each item as you address it. Your progress is saved. If a new scan detects the issue is still present, the item resets.
4. Re-scan to verify After making changes, run a new scan to confirm the issues have been resolved and your score has improved.

Privacy Policy Generator Pro

The Policy Generator produces a DPDP Act 2023-compliant privacy policy for your business. It uses your organisation details from Org Settings and your scan findings to pre-fill the policy. The result covers all mandatory disclosures required under the Act.

What the Generated Policy Covers

• Categories of personal data collected
• Purposes of data processing
• Data retention periods
• Third-party processors and data sharing arrangements
• Data Principal rights: access, correction, erasure, and nomination
• Grievance Officer name and contact details
• Consent withdrawal mechanism
• Breach notification commitment
• Children's data handling (if applicable)

Generating a Policy

1. Go to Policy Generator From the sidebar. If Org Settings are incomplete, you will be prompted to fill them in first.
2. Review the pre-filled details The form uses your business name, sector, and Grievance Officer details from Org Settings. Update anything that is incorrect before generating.
3. Click Generate Policy The policy is generated in 15 to 30 seconds and appears in an editable text area below.
4. Review and edit Read through the policy. Adjust any section that does not accurately reflect your specific data practices, and add any details the generator could not infer.
5. Publish to your website Paste the policy as a new page, typically at yoursite.com/privacy. Link to it from your footer and all data collection forms.

Consent Banner SDK Pro

The Consent Banner SDK is a lightweight JavaScript file that adds a DPDP-compliant consent banner to your website. Once installed, it handles consent collection, per-purpose granularity, and audit logging automatically. It also blocks third-party scripts until the user gives consent, which is a direct DPDP requirement.

What the SDK Does

• Shows a consent banner on first visit, before any non-essential scripts run
• Provides per-purpose toggles: Necessary, Analytics, Marketing, and Preferences
• Stores each consent record with a SHA-256 hash for tamper-evident audit purposes
• Provides a preference link so users can update or revoke consent at any time
• Logs all consent and withdrawal events with timestamps for the audit trail
• Works on any website regardless of framework or platform

Installation

1. Go to Consent SDK in the sidebar Your unique site key and ready-to-use snippet are shown on this page.
2. Copy your snippet Click Copy Snippet. Each account has a unique data-key that ties consent records to your CompliSeal account.
3. Paste into your website's <head> The snippet must be the first script tag inside <head>, before any analytics or tracking scripts. If it loads after other scripts, those scripts may fire before consent is checked.
4. Verify in an incognito window Open your website in a private browser session. The banner should appear immediately. Accept or decline, then reload the page. Your choice should be remembered and the banner should not reappear.

Consent Analytics

Consent Analytics shows aggregated statistics about how visitors are interacting with your consent banner. This data comes from events logged by the Consent Banner SDK.

What You Can See

• Total consent events (accepts, declines, and partial consents) over a selected time window
• Acceptance rate broken down by purpose (Analytics, Marketing, Preferences)
• Consent withdrawal count and trend over time
• Event breakdown by browser and device type

Exporting Data

Click Export to download a CSV of all consent events. This is useful for providing evidence to auditors, and for responding to requests where you need to produce the consent record for a specific user.

Consent Withdrawals Pro

Under the DPDP Act, users must be able to withdraw consent as easily as they gave it. This page shows all withdrawal requests submitted through the preference centre on your consent banner. Each entry shows the user's identifier, the purposes they withdrew consent for, and the timestamp.

Processing a Withdrawal

1. Review the withdrawal Check which consent purposes were withdrawn. A full withdrawal means all non-essential processing must stop. A partial withdrawal (for example, marketing only) requires you to remove the user from those specific processing activities.
2. Stop processing for withdrawn purposes Remove the user from relevant marketing lists, analytics audiences, or personalisation pipelines. This must happen promptly.
3. Notify downstream processors if required If you have shared this user's data with third-party processors and your Data Processing Agreements require it, inform those processors of the withdrawal.

DSAR Requests Pro

The DPDP Act gives Indian residents the right to access, correct, erase, or nominate a successor for their personal data. CompliSeal provides a public intake form for these requests and a dashboard to manage and track them through to resolution.

Request Types

• Access: The user wants a summary of what personal data you hold about them
• Correction: The user wants inaccurate data updated
• Erasure: The user wants their data deleted
• Nomination: The user wants to designate a successor to exercise their rights after death

Setting Up Your Public Form

1. Go to DSAR Requests Your unique public form URL is shown at the top of the page. It looks like: compliseal.cogenz.in/dsar?for=YOUR_USER_ID
2. Add the link to your website Place this link in your Privacy Policy, your Contact or Support page, and your cookie banner's preference centre. Users click this link to submit requests to you.
3. Test the form Open the link in an incognito browser window and submit a test request to confirm it is working and appears correctly in your dashboard.

Request Handling Workflow

Breach Response Pro

Under the DPDP Act and DPDP Rules 2025, you must notify the Data Protection Board and affected Data Principals promptly following a significant personal data breach. CompliSeal helps you document the incident, draft required notifications, and track the notification deadlines.

What Counts as a Breach

Any incident resulting in unauthorised access to, accidental disclosure of, alteration of, or loss of personal data that is likely to cause harm to the affected individuals. This includes ransomware attacks, accidental data exposures, insider threats, and system compromises involving personal data.

Breach Response Timeline

Incident Audit Timeline

Every action on an incident record (creation, Board notification, principal notification, status changes) is stored in the Audit Timeline on the incident detail page. This provides a complete, timestamped record of your response that you can present as evidence to the Data Protection Board if required.

Data Protection Impact Assessment (DPIA) Pro

A DPIA is a structured assessment of the privacy risks associated with a specific data processing activity. Significant Data Fiduciaries are required to conduct DPIAs periodically under the DPDP Act. For other businesses, a DPIA is good practice before launching any high-risk processing activity, such as large-scale profiling, processing sensitive personal data, or new data sharing arrangements with third parties.

DPIA Workflow

Assessment Sections

The DPIA covers seven sections:

• Data scope and sensitivity
• Consent and lawful basis for processing
• Data minimisation and proportionality
• Security controls in place
• Data sharing and international transfers
• Data Principal rights mechanisms
• Organisational governance and oversight

Each section contains questions answered on a Yes/No or 1 to 5 scale. You can save a partial draft at any time and return to it later from the DPIA list page.

Risk Levels

Compliance Calendar

The Compliance Calendar is a task management tool for DPDP compliance deadlines and recurring obligations. It comes pre-loaded with common annual and quarterly compliance tasks and allows you to add your own.

Pre-loaded Tasks

• Quarterly privacy policy review
• Annual DPIA review for existing high-risk processing activities
• Vendor Data Processing Agreement renewal reminders
• Consent banner copy review (required when your stated processing purposes change)
• Grievance Officer disclosure update check

Adding a Task

1. Click Add Task Enter the task title, description, due date, and priority level: Low, Medium, High, or Critical.
2. Assign a compliance category Categories map to DPDP compliance areas: Consent, Data Rights, Security, Documentation, Vendor, or Training.
3. Mark complete Click the checkbox next to a task when it is done. The calendar tracks your completion rate across each category, giving you a quick view of which areas are falling behind.

Record of Processing Activities (RoPA) Pro

A Record of Processing Activities documents every type of personal data your organisation collects: what it is, why you collect it, how long you keep it, who you share it with, and what safeguards are in place. Maintaining a RoPA is required for Significant Data Fiduciaries and is considered good practice for all businesses.

Adding a Processing Activity

1. Go to RoPA and click Add Activity
2. Fill in the record Required fields: activity name, data categories, data subjects, purpose of processing, legal basis, data processors and third parties, retention period, and whether data is transferred internationally (and to which countries).
3. Save All records are listed on the RoPA page. You can edit or delete any entry. Use the search and filter to find specific activities.

A complete RoPA serves as the foundation for your privacy policy, DPIA assessments, and Data Processing Agreements with vendors.

Vendor Assessments Pro

Under the DPDP Act, you are responsible for how your Data Processors handle the personal data you share with them. Vendor Assessments let you send a structured DPDP compliance questionnaire to a vendor and review their responses in one place.

Assessment Workflow

What the Questionnaire Covers

• Data handling and processing practices
• Security controls and certifications
• Sub-processor arrangements
• Breach detection and notification procedures
• Data deletion and return policies on contract end

Children's Data Pro

Processing personal data of individuals under 18 requires verifiable parental or guardian consent under the DPDP Act. Behavioural tracking and targeted advertising directed at minors are explicitly prohibited. The Children's Data module generates the documentation required to support compliant processing.

Documents Generated

• Children's Privacy Policy: A supplemental policy section covering your obligations when processing data of minors, including age verification method and parental consent mechanism
• Parental Consent Notice: A consent notice template for parents or guardians to review and accept before a child's data is processed
• Age Verification Statement: A disclosure explaining the age verification mechanism your platform uses

Using the Module

1. Go to Children's Data The module will first ask whether you process data of individuals under 18 and what age verification method you use.
2. Select the document type Choose which document to generate based on what you need.
3. Generate and publish The document is generated using your organisation details from Org Settings. Add the generated content to your privacy policy and any age-gated section of your website.

Compliance Questionnaire

The Compliance Questionnaire is a self-assessment of your organisation's data protection practices. Unlike the website scanner, which checks your public-facing website, the questionnaire assesses your internal processes: how you handle data rights requests, whether staff have been trained, how you manage vendor contracts, and whether your policies are documented and current.

Structure

The questionnaire is divided into five sections:

• Data Collection: What data you collect and whether you have a legal basis for it
• Consent Management: How consent is obtained, recorded, and withdrawn
• Data Rights: Whether you have a process for handling access, correction, and erasure requests
• Security and Breach: Controls in place and whether you have a breach response plan
• Governance: Whether you have a Grievance Officer, staff training, and documented policies

How to Use It

1. Answer each question honestly Questions are Yes/No or multiple choice. The results are only useful if the answers reflect your actual current situation, not what you intend to have in place.
2. Submit Your organisational compliance maturity score and a list of gaps appear immediately.
3. Use the gap list alongside your Fix-It Checklist The website scan identifies external gaps; the questionnaire identifies internal ones. Together they give a complete picture of what needs to change.

Audit Log

The Audit Log records all significant compliance actions taken within your CompliSeal account. It provides a timestamped history of activity that you can produce as evidence during a Data Protection Board investigation or audit.

What Is Logged

• Compliance scans completed (URL, score, date)
• PDF reports downloaded
• Privacy policies generated
• Plan changes
• DSARs received and each status change
• Breach incidents logged and notifications sent
• Org Settings updated
• Consent events (via SDK)

Filtering and Exporting

Filter log entries by event type using the category chips at the top of the page. Click Export CSV to download up to 1,000 recent entries. The CSV is formatted for sharing with auditors or legal counsel.

Organisation Settings

Org Settings stores your business profile. This information is used across all generated documents: privacy policies, consent notices, DPIA reports, and breach notifications. Fill this in before generating any documents.

Fields

Account Settings

Account Settings allows you to update the email address associated with your CompliSeal account.

Changing Your Email

1. Go to Account Settings From the sidebar, or directly at compliseal.cogenz.in/app/settings.
2. Enter your new business email The new address must be a business email on the domain you want to scan. Personal email providers are not accepted.
3. Confirm via the email link A verification link is sent to the new address. Click it to complete the change. Your login email updates immediately after confirmation.

DPDP Glossary

Data Fiduciary

Any person or entity that determines the purpose and means of processing personal data of Indian residents. As a business collecting and using customer or employee data, you are a Data Fiduciary.

Data Principal

The individual whose personal data is being processed. Your customers, users, and employees are Data Principals.

Data Processor

An entity that processes personal data on behalf of a Data Fiduciary under a contract. Your CRM, analytics tool, cloud storage provider, and payment gateway are typical Data Processors. You are responsible for their compliance through Data Processing Agreements.

Consent Notice

A clear, itemised notice presented to a user before their personal data is collected. Must specify what data is collected, why it is collected, how long it will be kept, who it will be shared with, and how consent can be withdrawn.

Data Protection Board (DPB)

The adjudicatory body established under the DPDP Act to investigate complaints from Data Principals, impose penalties on Data Fiduciaries, and issue guidance. The Board was being constituted in 2025.

Significant Data Fiduciary (SDF)

A Data Fiduciary designated by the Central Government based on the volume or sensitivity of data processed, or the risk to rights of Data Principals. SDFs face additional obligations including a resident Data Protection Officer, periodic DPIAs, and data audits. Most SMBs and early-stage businesses are not SDFs.

DSAR (Data Rights Request)

A formal request from a Data Principal to exercise their rights. Under the DPDP Act, this covers the right to access data held about them, correct inaccurate data, have data erased, and nominate a successor. CompliSeal uses the term DSAR (Data Subject Access Request) as the industry-standard abbreviation.

Grievance Officer

A named individual whose contact details are published on the business's website. Responsible for receiving and resolving complaints from Data Principals about data handling. Required for all Data Fiduciaries. No specific professional qualification is required by the Act.

Data Protection Officer (DPO)

A specialist compliance role required only for Significant Data Fiduciaries. Must be based in India and have knowledge of data protection law. This is a different and additional role to the Grievance Officer.

DPIA (Data Protection Impact Assessment)

A formal assessment of the privacy risks of a specific data processing activity, covering the necessity of the processing, risks to individuals, and controls in place to mitigate those risks. Mandatory for Significant Data Fiduciaries; recommended for any organisation before launching high-risk processing.

RoPA (Record of Processing Activities)

A documented inventory of all personal data processing activities within an organisation. Records what data is collected, the legal basis, how long it is kept, who it is shared with, and any international transfers.

Personal Data Breach

Any incident resulting in unauthorised access to, disclosure of, alteration of, or loss of personal data. Must be reported to the Data Protection Board promptly if it is likely to cause harm to affected Data Principals. DPDP Rules 2025 prescribe notification within 72 hours of the breach being discovered.

Support

Contact

Common Issues

My scan score is lower than expected

The scanner only checks publicly accessible pages. If your privacy policy, consent banner, or Grievance Officer details are on pages behind a login, or only visible after accepting cookies, the scanner may not find them. Make sure all required disclosures are visible to an anonymous visitor before running a scan.

I cannot scan my domain

The scanner is scoped to the domain of your registered email address. If you need to scan a different domain (a subsidiary or a client), contact support. Domains behind Cloudflare's bot protection or with aggressive rate limiting may not scan correctly.

My DSAR form is not receiving submissions

Verify the form URL includes your correct user ID: compliseal.cogenz.in/dsar?for=YOUR_USER_ID. Copy the correct URL from the DSAR Requests page in the app. Also check your spam folder for submission notification emails.

I upgraded to Pro but features are still locked

Sign out and sign back in. If features remain locked after signing back in, contact support with your account email address and your Razorpay payment confirmation reference number.

The consent banner is not appearing on my website

Check that the SDK snippet is placed inside <head> and is the first script tag in the document. Open your browser's developer console (F12) and look for any errors on the network tab showing the SDK file not loading. Confirm that your data-key matches the value shown on the Consent SDK page in the app.