To systematically improve consent management using evidence from performance, incidents, reviews, audit findings, stakeholder feedback, and changes in requirements.
Use review results, incidents, metrics, audit findings, regulatory changes, stakeholder feedback, and benchmarking to identify, prioritize, implement, and measure improvements.
| FRAMEWORK CODE | FRAMEWORK NAME & DETAILS | FAMILY / CATEGORY | VERSION | ACTION |
|---|---|---|---|---|
| ISO27001 | ISO/IEC 27001 ISO/IEC 27001 specifies auditable requirements for... Clause: 10.1 – Continual improvement |
ISO
Standard
|
v2022 | View → |
| SEBI-CSCRF | SEBI Cyber Security & Cyber Resilience Framework SEBI’s Cybersecurity and Cyber Resilience Framewor... Clause: 3.3 PR.DS: Data Security |
India
Regulation
|
vLatest | View → |
| ISO27002 | ISO/IEC 27002 ISO/IEC 27002 is a guidance standard containing a... Clause: 5.34 – Privacy and protection of PII |
ISO
Standard
|
v2022 | View → |
| NIST-CSF | NIST Cybersecurity Framework (CSF) The NIST Cybersecurity Framework provides high-lev... Clause: ID.AM – Asset Management | ID.AM-07 – Inventories of data and corresponding metadata for designated data types are maintained PR.DS – Data Security | PR.DS-01 – The confidentiality, integrity, and availability of data-at-rest are protected |
NIST
Framework
|
v2 | View → |
| NIST80053 | NIST SP 800-53 NIST SP 800-53 Rev. 5 presents control families, i... Clause: 3.15 – PERSONALLY IDENTIFIABLE INFORMATION PROCESSING AND TRANSPARENCY; PT-4 – CONSENT |
NIST
Control Catalog
|
vRev. 5 | View → |
| DPDP | Digital Personal Data Protection Act The Digital Personal Data Protection Act, 2023 est... Clause: 6(1) – Valid consent; 6(4)-(6) – Withdrawal and cessation |
India
Law
|
v2023 | View → |
| NPCI-ISR | NPCI Information Security Requirements NPCI information-security requirements define cont... Clause: Security Measures / Controls; Data Privacy |
India
Standard
|
vLatest | View → |
| SOC2 | SOC 2 Trust Services Criteria SOC 2 is an independent examination and reporting... Clause: P2.1 – Privacy: Choice and Consent – The entity communicates choices available regarding the collection, use, retention, disclosure, and disposal of personal information to the data subjects and the consequences, if any, of each choice. Explicit consent for the collection, use, retention, disclosure, and disposal of personal information is obtained from data subjects or other authorized persons, if required. Such consent is obtained P3.2 – Privacy: Collection – For information requiring explicit consent, the entity communicates the need for such consent as well as the consequences of a failure to provide consent for the request for personal information and obtains the consent prior to the collection of the information to meet the entity’s objectives related to privacy. CC4.1 – Monitoring of Controls – COSO Principle 16: The entity selects, develops, and performs ongoing and/or separate evaluations to ascertain whether the components of internal control are present and functioning. CC4.2 – Monitoring of Controls – COSO Principle 17: The entity evaluates and communicates internal control deficiencies in a timely manner to those parties responsible for taking corrective action, including senior management and the board of directors, as appropriate. |
AICPA
Audit Framework
|
vLatest | View → |
| ISO27701 | ISO/IEC 27701 ISO/IEC 27701 provides requirements and guidance f... Clause: A.7.2.3; A.7.2.4; A.7.2.3 – Determine when and how consent is to be obtained; A.7.2.4 – Obtain and record consent |
ISO
Privacy Standard
|
v2019 | View → |