The eighteen checks behind the grade
We split the signal into three families, each contributing a third of the final grade:
Web posture (cookie banners, policies, disclosures)
- Privacy policy currency (last update, GDPR-correct vocabulary)
- Cookie banner compliance (IAB TCF v2.2, pre-consent trackers, “reject all” parity)
- DPO disclosure (named individual, contact route, escalation path)
- Sub-processor list (transparency, geographic scope, transfer mechanism)
- Data-subject rights statement (access, erasure, portability, objection)
- Public breach-notification history (last 24 months)
iXBRL filings (compliance-relevant disclosures)
- Audit qualification status (and the basis, if qualified)
- Going-concern statement (clean, mild flag, severe flag)
- Directors’ report data-protection language
- Beneficial-ownership clarity (PSC filings, transfer events)
- Audit-firm continuity (frequent rotations are amber)
- Late-filing history (an under-rated compliance smell)
2026 UK transparency standard alignment
- Sustainability-linked disclosure presence
- Modern Slavery Act statement (if turnover ≥ £36M)
- Section 172 (1) statement quality
- Stakeholder-engagement narrative
- Climate-related financial disclosure compliance
- Risk-management and internal-control statement
Each check returns one of five states (pass, mild fail, hard fail, not-applicable, evidence-missing). We weight the eighteen results into a single 0–100 score, then map to the A–F band. The full evidence pack, screenshots, filing references, web-archive timestamps, ships with every grade.