These are the criteria ODIPA assesses organizations against. We publish them in full because a certification is only as meaningful as the standard behind it, and because organizations deserve to know exactly what they are being evaluated on before they apply.
ODIPA certification is a conformity assessment. It attests that, on the assessment date, an organization met the criteria on this page as evidenced to ODIPA-qualified assessors. The criteria draw on established privacy and security frameworks, and each criterion cites the provisions that informed it.
Certification is not a determination of legal compliance. Only regulators and courts can make that determination. The framework references below show where a criterion comes from. They do not certify that an organization complies with the cited law.
Met
Evidence demonstrates the requirement is implemented and operating.
Partially Met
The requirement is implemented in part or operates inconsistently. A finding is issued with a remediation window.
Not Met
Evidence is absent or the practice contradicts the requirement. A finding is issued and certification cannot issue until remediated.
Not Applicable
The requirement does not apply to the organization's processing, with the rationale documented by the assessor.
Whether privacy is owned, documented, and overseen as a program rather than treated as a policy page.
A named individual or role is accountable for the privacy program, with documented responsibilities and executive reporting.
Evidence accepted
Framework references
An internal privacy policy or program document defines principles, roles, and procedures, is approved by leadership, and is reviewed at least annually.
Evidence accepted
Framework references
The organization maintains a current inventory of personal information it processes, including categories, sources, purposes, recipients, and retention, updated when processing changes.
Evidence accepted
Framework references
New or materially changed processing of personal information is assessed for privacy risk before launch, with documented outcomes and mitigations.
Evidence accepted
Framework references
A retention and deletion schedule defines how long each category of personal information is kept and the basis for that period.
Evidence accepted
Framework references
Personal information is classified by sensitivity, and handling requirements are defined for each class.
Evidence accepted
Framework references
Privacy program status, incidents, and risks are reported to executive leadership or the board at least annually.
Evidence accepted
Framework references
Whether people are told the truth about processing, at the right time, and given real choices.
A consumer-facing privacy notice accurately describes categories collected, sources, purposes, disclosures, retention, consumer rights, and contact methods, and carries an effective date.
Evidence accepted
Framework references
Consumers are informed at or before the point of collection of the categories collected and the purposes of use.
Evidence accepted
Framework references
Where law or the organization's own notice requires consent, it is obtained through an affirmative act, is specific to the purpose, and is recorded.
Evidence accepted
Framework references
Where applicable, consumers can opt out of the sale or sharing of personal information through an accessible mechanism, and browser opt-out preference signals are honored.
Evidence accepted
Framework references
Consent, opt-out, and rights interfaces are designed so that declining is as easy as accepting and choices are not obtained through confusing or coercive design.
Evidence accepted
Framework references
Where the organization knowingly processes children's personal information, age screening, parental consent, and heightened protections are implemented as applicable.
Evidence accepted
Framework references
Whether people can actually exercise their rights, on time, without being punished for it.
Consumers can submit rights requests through at least the methods required by applicable law, and the channels are published in the privacy notice.
Evidence accepted
Framework references
Requester identity is verified using methods proportionate to the sensitivity of the data and the request, without collecting unnecessary additional information.
Evidence accepted
Framework references
Requests are tracked and fulfilled within statutory timelines, with extensions used only where permitted and communicated.
Evidence accepted
Framework references
Access requests return the specific personal information held, in a usable and where required portable format.
Evidence accepted
Framework references
Deletion requests are fulfilled across the organization's systems and communicated to service providers and third parties as required.
Evidence accepted
Framework references
Consumers can correct inaccurate personal information, and corrections propagate to relevant systems and recipients.
Evidence accepted
Framework references
Denied requests are documented with reasons and any appeal route, and consumers are not discriminated against for exercising rights.
Evidence accepted
Framework references
Whether the organization collects only what it needs and lets go of it when it should.
Personal information is used only for the purposes disclosed at collection or purposes compatible with them.
Evidence accepted
Framework references
Collection is limited to what is reasonably necessary and proportionate for the disclosed purposes.
Evidence accepted
Framework references
Retention periods are enforced through technical or procedural controls, not only stated in policy.
Evidence accepted
Framework references
Personal information beyond its retention period is disposed of securely, including on backups within a defined period and at vendors.
Evidence accepted
Framework references
Where the organization relies on de-identified or aggregated data, the method meets a recognized standard and re-identification is contractually and technically prohibited.
Evidence accepted
Framework references
Whether the information is protected in proportion to its sensitivity, and whether the organization would know if it were not.
A written information security program defines controls proportionate to the sensitivity and volume of personal information processed.
Evidence accepted
Framework references
Access to personal information follows least privilege, is reviewed periodically, and administrative and remote access require multi-factor authentication.
Evidence accepted
Framework references
Personal information is encrypted in transit and, for sensitive categories, at rest, using current standards with managed keys.
Evidence accepted
Framework references
Access to and changes in systems holding personal information are logged, retained, and monitored for anomalies.
Evidence accepted
Framework references
Systems are assessed for vulnerabilities on a defined cadence, including at least annual independent testing for internet-facing systems, and findings are remediated by severity.
Evidence accepted
Framework references
Systems that process personal information are built and changed under a process that includes security and privacy review before release.
Evidence accepted
Framework references
An incident response plan assigns roles, defines escalation, and is exercised at least annually.
Evidence accepted
Framework references
A breach procedure determines notification obligations and executes notice to individuals, regulators, and partners within statutory timeframes.
Evidence accepted
Framework references
Whether the organization's promises survive the handoff to everyone it shares data with.
Service providers and third parties that receive personal information are inventoried with the data shared and the purpose.
Evidence accepted
Framework references
Vendors are assessed for privacy and security practices before receiving personal information, proportionate to the risk of the sharing.
Evidence accepted
Framework references
Contracts with recipients of personal information include the terms required by applicable law, including purpose limitation, confidentiality, security, deletion, and cooperation with rights requests.
Evidence accepted
Framework references
Where personal information leaves its jurisdiction of collection, a lawful transfer mechanism is in place and documented.
Evidence accepted
Framework references
Vendor performance is monitored, and at termination personal information is returned or destroyed with confirmation.
Evidence accepted
Framework references
Whether the people who touch the data know what they are responsible for.
New personnel who handle personal information complete privacy training before receiving access.
Evidence accepted
Framework references
Personnel complete privacy training at least annually, with content tailored to the data and processes their role involves.
Evidence accepted
Framework references
Documented procedures exist for personnel who process rights requests, respond to incidents, or handle sensitive categories.
Evidence accepted
Framework references
Personnel know how to report suspected incidents and privacy concerns, and reports are acted on without retaliation.
Evidence accepted
Framework references
The program is accepting inquiries for its founding cohort. Founding organizations help shape how these criteria are applied in practice.