A consent banner records a choice. A consent architecture enforces it. The gap between the two is where almost every privacy programme fails an audit, because the withdrawal captured in the app never reaches the warehouse, the CRM or the ad platform.
This blueprint is written for engineers. It specifies the consent record data model, the event schema for capture and withdrawal, versioning rules for when a notice changes, and the propagation patterns for pushing consent state into downstream systems.
It includes a verification test plan — the set of tests that prove propagation works — which is the artefact auditors and enterprise buyers increasingly ask to see.
Why it is structured the way it is, and the failure patterns it was designed around.
A consent banner records a choice. A consent architecture enforces it. Here is the two-hour test that shows which one you have — and how to fix the gap.
A threshold test, a full DPIA template and an AI-specific impact assessment aligned to ISO 42001 — sized so teams finish them.
Most organisations discover their first real gap during an audit or an incident. The assessment surfaces it in fifteen minutes instead — scored, benchmarked and prioritised, with nothing to buy.
Built for
Kept current
Version 1.8, revised 30 April 2026. We update when a framework changes, when new rules are notified, or when an engagement teaches us something that improves it.
PDF + JSON schema · 41 pages
What this will not do
A template cannot know your systems, test your controls or make the judgement calls that determine whether a programme holds up in an audit. Use it to move faster, not to skip the thinking — and treat any resource claiming to make you compliant on its own as a warning about its author.
Independence is not a job title. It is a reporting line, a documented advice trail, and protection from consequence. Here is what regulators look for and what fails.
A working risk register with a pre-populated scenario library, quantified exposure model and treatment tracking — not an empty template.
Tiering model plus four proportionate question sets, so a low-risk vendor answers eight questions and a critical one gets genuine scrutiny.
Your position across privacy, security, governance, risk and AI accountability, scored against sector benchmarks rather than a generic scale.
The specific gaps that matter most for your sector and size, ordered by risk reduction rather than by framework clause number.
Where you stand against DPDPA, ISO 27001, ISO 42001 and SOC 2 — and which of them your buyers are most likely to ask for next.
No sales call required to see your results. Take it, read the output, and decide independently whether you want to talk to anyone.
