01 Implementation control catalogue
Thirty-two controls. Every label earns its place.
Search by a system problem, filter by operating area, then open a control to see the implementation pattern, evidence, owners, test and official-source trail.
Reviewed as an editorial record · 2026-08-30 · not counsel reviewed
MAP-01Inventory · Implementation evidence
Collection-point inventory
Know what personal data enters the organisation, why it is used and which system owner is accountable.Source-mapped2027-05-13
Inventory · Implementation evidence
Collection-point inventory
Know what personal data enters the organisation, why it is used and which system owner is accountable.Mapped provision: Act s. 4. This control is not a prescribed form and does not create a legal conclusion.
List forms, interfaces, imports and human collection paths.
- Owned register
- Field-to-system trace
- Dated review record
- Product
- Operations
- Privacy/Legal
Run one synthetic case end to end; save the dated result, owner and unresolved exceptions.
- Act No. 22 of 2023 · Sections 1 and 3–17; official Gazette PDF
- G.S.R. 843(E) · Paragraphs (a)–(c), page 2
Reviewed 2026-08-20 · not counsel reviewed
PURPOSE-01Inventory · Implementation evidence
Purpose register
Know what personal data enters the organisation, why it is used and which system owner is accountable.Source-mapped2027-05-13
Inventory · Implementation evidence
Purpose register
Know what personal data enters the organisation, why it is used and which system owner is accountable.Mapped provision: Act s. 4. This control is not a prescribed form and does not create a legal conclusion.
Record each business purpose beside the data category.
- Owned register
- Field-to-system trace
- Dated review record
- Product
- Operations
- Privacy/Legal
Run one synthetic case end to end; save the dated result, owner and unresolved exceptions.
- Act No. 22 of 2023 · Sections 1 and 3–17; official Gazette PDF
- G.S.R. 843(E) · Paragraphs (a)–(c), page 2
Reviewed 2026-08-20 · not counsel reviewed
NOTICE-01Notice · Legal-requirement topic
Notice version
Connect collection-point communication to a retrievable, plain-language notice record.Source-mapped2027-05-13
Notice · Legal-requirement topic
Notice version
Connect collection-point communication to a retrievable, plain-language notice record.Mapped provision: Act s. 5. This control is not a prescribed form and does not create a legal conclusion.
Archive the notice displayed at each collection point.
- Versioned notice
- Collection-surface capture
- Link and language review
- Product
- Content
- Privacy/Legal
Run one synthetic case end to end; save the dated result, owner and unresolved exceptions.
- Act No. 22 of 2023 · Sections 1 and 3–17; official Gazette PDF
- G.S.R. 843(E) · Paragraphs (a)–(c), page 2
Reviewed 2026-08-20 · not counsel reviewed
NOTICE-02Notice · Legal-requirement topic
Notice accessibility
Connect collection-point communication to a retrievable, plain-language notice record.Source-mapped2027-05-13
Notice · Legal-requirement topic
Notice accessibility
Connect collection-point communication to a retrievable, plain-language notice record.Mapped provision: Rules r. 3. This control is not a prescribed form and does not create a legal conclusion.
Review plain language and reachable notice links.
- Versioned notice
- Collection-surface capture
- Link and language review
- Product
- Content
- Privacy/Legal
Run one synthetic case end to end; save the dated result, owner and unresolved exceptions.
- Act No. 22 of 2023 · Sections 1 and 3–17; official Gazette PDF
- G.S.R. 843(E) · Paragraphs (a)–(c), page 2
- G.S.R. 846(E) · Rule 1 commencement; Rules 3–16; official Gazette PDF
- G.S.R. 892(E) · Items (i)–(v), Gazette page 1
Reviewed 2026-08-20 · not counsel reviewed
CONSENT-01Consent · Legal-requirement topic
Choice record
Make a choice and any later withdrawal traceable across the systems that act on it.Source-mapped2027-05-13
Consent · Legal-requirement topic
Choice record
Make a choice and any later withdrawal traceable across the systems that act on it.Mapped provision: Act s. 6. This control is not a prescribed form and does not create a legal conclusion.
Retrieve affirmative action where consent is relied on.
- Choice event
- Notice-version reference
- Preference propagation result
- Product
- Engineering
- Privacy/Legal
Run one synthetic case end to end; save the dated result, owner and unresolved exceptions.
- Act No. 22 of 2023 · Sections 1 and 3–17; official Gazette PDF
- G.S.R. 843(E) · Paragraphs (a)–(c), page 2
Reviewed 2026-08-20 · not counsel reviewed
CONSENT-02Consent · Legal-requirement topic
Withdrawal route
Make a choice and any later withdrawal traceable across the systems that act on it.Source-mapped2027-05-13
Consent · Legal-requirement topic
Withdrawal route
Make a choice and any later withdrawal traceable across the systems that act on it.Mapped provision: Act s. 6. This control is not a prescribed form and does not create a legal conclusion.
Test a route that is as easy to find as the consent path.
- Choice event
- Notice-version reference
- Preference propagation result
- Product
- Engineering
- Privacy/Legal
Run one synthetic case end to end; save the dated result, owner and unresolved exceptions.
- Act No. 22 of 2023 · Sections 1 and 3–17; official Gazette PDF
- G.S.R. 843(E) · Paragraphs (a)–(c), page 2
Reviewed 2026-08-20 · not counsel reviewed
RIGHTS-01Rights · Legal-requirement topic
Rights intake
Turn a Data Principal request into an owned, searchable and reviewable operating workflow.Source-mapped2027-05-13
Rights · Legal-requirement topic
Rights intake
Turn a Data Principal request into an owned, searchable and reviewable operating workflow.Mapped provision: Act ss. 11–15. This control is not a prescribed form and does not create a legal conclusion.
Name a channel, verification step and owner.
- Request register
- System search record
- Decision and response evidence
- Operations
- Support
- Privacy/Legal
Run one synthetic case end to end; save the dated result, owner and unresolved exceptions.
- Act No. 22 of 2023 · Sections 1 and 3–17; official Gazette PDF
- G.S.R. 843(E) · Paragraphs (a)–(c), page 2
Reviewed 2026-08-20 · not counsel reviewed
RIGHTS-02Rights · Legal-requirement topic
Grievance escalation
Turn a Data Principal request into an owned, searchable and reviewable operating workflow.Source-mapped2027-05-13
Rights · Legal-requirement topic
Grievance escalation
Turn a Data Principal request into an owned, searchable and reviewable operating workflow.Mapped provision: Act s. 13. This control is not a prescribed form and does not create a legal conclusion.
Keep an escalation log with outcome and response owner.
- Request register
- System search record
- Decision and response evidence
- Operations
- Support
- Privacy/Legal
Run one synthetic case end to end; save the dated result, owner and unresolved exceptions.
- Act No. 22 of 2023 · Sections 1 and 3–17; official Gazette PDF
- G.S.R. 843(E) · Paragraphs (a)–(c), page 2
Reviewed 2026-08-20 · not counsel reviewed
RIGHTS-03Rights · Implementation evidence
Correction workflow
Turn a Data Principal request into an owned, searchable and reviewable operating workflow.Source-mapped2027-05-13
Rights · Implementation evidence
Correction workflow
Turn a Data Principal request into an owned, searchable and reviewable operating workflow.Mapped provision: Act s. 12. This control is not a prescribed form and does not create a legal conclusion.
Exercise a correction through the systems of record.
- Request register
- System search record
- Decision and response evidence
- Operations
- Support
- Privacy/Legal
Run one synthetic case end to end; save the dated result, owner and unresolved exceptions.
- Act No. 22 of 2023 · Sections 1 and 3–17; official Gazette PDF
- G.S.R. 843(E) · Paragraphs (a)–(c), page 2
Reviewed 2026-08-20 · not counsel reviewed
RIGHTS-04Rights · Implementation evidence
Erasure workflow
Turn a Data Principal request into an owned, searchable and reviewable operating workflow.Source-mapped2027-05-13
Rights · Implementation evidence
Erasure workflow
Turn a Data Principal request into an owned, searchable and reviewable operating workflow.Mapped provision: Act s. 12. This control is not a prescribed form and does not create a legal conclusion.
Trace deletion through active and downstream systems.
- Request register
- System search record
- Decision and response evidence
- Operations
- Support
- Privacy/Legal
Run one synthetic case end to end; save the dated result, owner and unresolved exceptions.
- Act No. 22 of 2023 · Sections 1 and 3–17; official Gazette PDF
- G.S.R. 843(E) · Paragraphs (a)–(c), page 2
Reviewed 2026-08-20 · not counsel reviewed
RET-01Retention · Legal-requirement topic
Retention schedule
Translate retention decisions into detectable events, system actions and explainable exceptions.Source-mapped2027-05-13
Retention · Legal-requirement topic
Retention schedule
Translate retention decisions into detectable events, system actions and explainable exceptions.Mapped provision: Act s. 8. This control is not a prescribed form and does not create a legal conclusion.
Set an event trigger, owner and periodic review date.
- Event-based schedule
- Deletion run result
- Exception decision
- Records owner
- Engineering
- Privacy/Legal
Run one synthetic case end to end; save the dated result, owner and unresolved exceptions.
- Act No. 22 of 2023 · Sections 1 and 3–17; official Gazette PDF
- G.S.R. 843(E) · Paragraphs (a)–(c), page 2
Reviewed 2026-08-20 · not counsel reviewed
PROC-01Processors · Implementation evidence
Processor register
Connect external services, contracts, access paths, sub-processing and exit responsibilities.Source-mapped2027-05-13
Processors · Implementation evidence
Processor register
Connect external services, contracts, access paths, sub-processing and exit responsibilities.Mapped provision: Act s. 8. This control is not a prescribed form and does not create a legal conclusion.
List processors, data flows, access and review dates.
- Service register
- Contract reference
- Access and exit review
- Procurement
- System owner
- Privacy/Legal
Run one synthetic case end to end; save the dated result, owner and unresolved exceptions.
- Act No. 22 of 2023 · Sections 1 and 3–17; official Gazette PDF
- G.S.R. 843(E) · Paragraphs (a)–(c), page 2
Reviewed 2026-08-20 · not counsel reviewed
PROC-02Processors · Recommended practice
Processor instructions
Connect external services, contracts, access paths, sub-processing and exit responsibilities.Source-mapped2027-05-13
Processors · Recommended practice
Processor instructions
Connect external services, contracts, access paths, sub-processing and exit responsibilities.Mapped provision: Act s. 8. This control is not a prescribed form and does not create a legal conclusion.
Keep written purpose and security instructions.
- Service register
- Contract reference
- Access and exit review
- Procurement
- System owner
- Privacy/Legal
Run one synthetic case end to end; save the dated result, owner and unresolved exceptions.
- Act No. 22 of 2023 · Sections 1 and 3–17; official Gazette PDF
- G.S.R. 843(E) · Paragraphs (a)–(c), page 2
Reviewed 2026-08-20 · not counsel reviewed
SEC-01Security · Recommended practice
Access review
Link stated safeguards to real configurations, logs, owners and operating tests.Source-mapped2027-05-13
Security · Recommended practice
Access review
Link stated safeguards to real configurations, logs, owners and operating tests.Mapped provision: Act s. 8. This control is not a prescribed form and does not create a legal conclusion.
Review least-privilege access at a stated cadence.
- System control record
- Access or monitoring evidence
- Operating test result
- Security
- IT
- System owner
Run one synthetic case end to end; save the dated result, owner and unresolved exceptions.
- Act No. 22 of 2023 · Sections 1 and 3–17; official Gazette PDF
- G.S.R. 843(E) · Paragraphs (a)–(c), page 2
Reviewed 2026-08-20 · not counsel reviewed
SEC-02Security · Legal-requirement topic
Security safeguards
Link stated safeguards to real configurations, logs, owners and operating tests.Source-mapped2027-05-13
Security · Legal-requirement topic
Security safeguards
Link stated safeguards to real configurations, logs, owners and operating tests.Mapped provision: Act s. 8. This control is not a prescribed form and does not create a legal conclusion.
Link practical safeguards to systems and owners.
- System control record
- Access or monitoring evidence
- Operating test result
- Security
- IT
- System owner
Run one synthetic case end to end; save the dated result, owner and unresolved exceptions.
- Act No. 22 of 2023 · Sections 1 and 3–17; official Gazette PDF
- G.S.R. 843(E) · Paragraphs (a)–(c), page 2
Reviewed 2026-08-20 · not counsel reviewed
BREACH-01Breach · Legal-requirement topic
Breach triage and distinct clocks
Prepare the people, facts and distinct communication steps needed after awareness of a breach.Source-mapped2027-05-13
Breach · Legal-requirement topic
Breach triage and distinct clocks
Prepare the people, facts and distinct communication steps needed after awareness of a breach.Mapped provision: Act s. 8; Rules r. 7. This control is not a prescribed form and does not create a legal conclusion.
Record awareness time, affected-data analysis, owners and the separate actions: tell affected Data Principals without delay; give the Board an initial description without delay; then provide specified updated details within 72 hours after awareness unless the Board allows longer on written request.
- Incident timeline
- Communication decision
- Tabletop result
- Incident lead
- Security
- Privacy/Legal
Run a tabletop and verify that every participant distinguishes both without-delay steps from the later 72-hour detailed-information step.
- Act No. 22 of 2023 · Sections 1 and 3–17; official Gazette PDF
- G.S.R. 843(E) · Paragraphs (a)–(c), page 2
- G.S.R. 846(E) · Rule 1 commencement; Rules 3–16; official Gazette PDF
- G.S.R. 892(E) · Items (i)–(v), Gazette page 1
Reviewed 2026-08-20 · not counsel reviewed
CHILD-01Children · Legal-requirement topic
Under-18 journey scope review
Identify under-18 journeys and make fact-specific, risk-aware decisions before processing.Source-mapped2027-05-13
Children · Legal-requirement topic
Under-18 journey scope review
Identify under-18 journeys and make fact-specific, risk-aware decisions before processing.Mapped provision: Act s. 9. This control is not a prescribed form and does not create a legal conclusion.
For the Act, a child is an individual under 18. Map likely child journeys and test any claimed Rule 12 exception against its class, purpose and conditions; those exceptions do not include section 9(2).
- Applicability decision
- Journey risk review
- Verification design where relevant
- Product
- Privacy/Legal
- Safeguarding owner
Challenge product entry points, audience assumptions and each claimed exception with a fact-specific review.
- Act No. 22 of 2023 · Sections 1 and 3–17; official Gazette PDF
- G.S.R. 843(E) · Paragraphs (a)–(c), page 2
Reviewed 2026-08-20 · not counsel reviewed
CHILD-02Children · Legal-requirement topic
Parent or lawful-guardian pathway
Identify under-18 journeys and make fact-specific, risk-aware decisions before processing.Source-mapped2027-05-13
Children · Legal-requirement topic
Parent or lawful-guardian pathway
Identify under-18 journeys and make fact-specific, risk-aware decisions before processing.Mapped provision: Act s. 9; Rules r. 10. This control is not a prescribed form and does not create a legal conclusion.
Where section 9(1) applies, design a data-minimal way to obtain verifiable consent from a parent or lawful guardian and record why the chosen method fits the facts.
- Applicability decision
- Journey risk review
- Verification design where relevant
- Product
- Privacy/Legal
- Safeguarding owner
Walk through the pathway with synthetic records and verify that it does not collect more identity data than the design needs.
- Act No. 22 of 2023 · Sections 1 and 3–17; official Gazette PDF
- G.S.R. 843(E) · Paragraphs (a)–(c), page 2
- G.S.R. 846(E) · Rule 1 commencement; Rules 3–16; official Gazette PDF
- G.S.R. 892(E) · Items (i)–(v), Gazette page 1
Reviewed 2026-08-20 · not counsel reviewed
TRANSFER-01Transfers · Implementation evidence
Location and remote-access map
Make storage and remote-access locations visible before assessing any applicable restriction.Source-mapped2027-05-13
Transfers · Implementation evidence
Location and remote-access map
Make storage and remote-access locations visible before assessing any applicable restriction.Mapped provision: Act s. 16. This control is not a prescribed form and does not create a legal conclusion.
Record hosting, backups, support access and sub-processors. Do not assume blanket localisation, unrestricted transfer or an approved-country list; recheck government restrictions and stricter Indian laws.
- Location and remote-access map
- Contract review
- Restriction watch
- Procurement
- IT
- Privacy/Legal
Sample two services and compare the recorded locations and access paths with current contracts and official vendor records.
- Act No. 22 of 2023 · Sections 1 and 3–17; official Gazette PDF
- G.S.R. 843(E) · Paragraphs (a)–(c), page 2
Reviewed 2026-08-20 · not counsel reviewed
SDF-01SDF readiness · Conditional indicator
Significant Data Fiduciary notification watch
Prepare conditionally without implying that the organisation has been designated as a Significant Data Fiduciary.Source-mapped2027-05-13
SDF readiness · Conditional indicator
Significant Data Fiduciary notification watch
Prepare conditionally without implying that the organisation has been designated as a Significant Data Fiduciary.Mapped provision: Act s. 10. This control is not a prescribed form and does not create a legal conclusion.
The Central Government—not an internal score—may notify an organisation or class as an SDF. Keep a Gazette-watch owner and a factual impact note without claiming designation.
- Gazette watch record
- Conditional mobilisation plan
- Leadership decision
- Leadership
- Privacy/Legal
- Security
Confirm the owner can show the latest source-set check and the escalation route if a relevant Gazette notification appears.
- Act No. 22 of 2023 · Sections 1 and 3–17; official Gazette PDF
- G.S.R. 843(E) · Paragraphs (a)–(c), page 2
Reviewed 2026-08-20 · not counsel reviewed
CONTACT-01Rights · Implementation evidence
Public processing contact
Turn a Data Principal request into an owned, searchable and reviewable operating workflow.Source-mapped2027-05-13
Rights · Implementation evidence
Public processing contact
Turn a Data Principal request into an owned, searchable and reviewable operating workflow.Mapped provision: Act s. 10. This control is not a prescribed form and does not create a legal conclusion.
Maintain the business contact able to answer processing questions under Act section 8(9) and Rule 9. Keep this distinct from the DPO requirement that applies conditionally to a notified SDF.
- Request register
- System search record
- Decision and response evidence
- Operations
- Support
- Privacy/Legal
Send a synthetic question through the published route and confirm it reaches an accountable role.
- Act No. 22 of 2023 · Sections 1 and 3–17; official Gazette PDF
- G.S.R. 843(E) · Paragraphs (a)–(c), page 2
Reviewed 2026-08-20 · not counsel reviewed
SDF-02SDF readiness · Conditional indicator
Conditional SDF accountability pack
Prepare conditionally without implying that the organisation has been designated as a Significant Data Fiduciary.Source-mapped2027-05-13
SDF readiness · Conditional indicator
Conditional SDF accountability pack
Prepare conditionally without implying that the organisation has been designated as a Significant Data Fiduciary.Mapped provision: Act s. 10. This control is not a prescribed form and does not create a legal conclusion.
If the organisation or its class is later notified as an SDF, section 10 and Rule 13 duties become relevant. An internal DPIA is readiness practice, not proof of SDF status or a current statutory duty.
- Gazette watch record
- Conditional mobilisation plan
- Leadership decision
- Leadership
- Privacy/Legal
- Security
Tabletop a hypothetical designation and identify owners for the DPO, independent audit, DPIA and periodic-audit work.
- Act No. 22 of 2023 · Sections 1 and 3–17; official Gazette PDF
- G.S.R. 843(E) · Paragraphs (a)–(c), page 2
Reviewed 2026-08-20 · not counsel reviewed
GOV-01Governance · Recommended practice
Data inventory review
Give new data flows, unresolved gaps and resourcing decisions a visible owner and review route.EditorialNo legal date
Governance · Recommended practice
Data inventory review
Give new data flows, unresolved gaps and resourcing decisions a visible owner and review route.Mapped provision: Preview editorial method. This control is not a prescribed form and does not create a legal conclusion.
Review new systems before procurement or launch.
- Decision record
- Named owner
- Review date
- Programme owner
- Functional leads
Run one synthetic case end to end; save the dated result, owner and unresolved exceptions.
Editorial method only. No legal requirement is asserted for this control.
Reviewed 2026-08-20 · not counsel reviewed
PROC-03Processors · Recommended practice
Vendor exit plan
Connect external services, contracts, access paths, sub-processing and exit responsibilities.EditorialNo legal date
Processors · Recommended practice
Vendor exit plan
Connect external services, contracts, access paths, sub-processing and exit responsibilities.Mapped provision: Preview editorial method. This control is not a prescribed form and does not create a legal conclusion.
Plan export, deletion attestations and access removal.
- Service register
- Contract reference
- Access and exit review
- Procurement
- System owner
- Privacy/Legal
Run one synthetic case end to end; save the dated result, owner and unresolved exceptions.
Editorial method only. No legal requirement is asserted for this control.
Reviewed 2026-08-20 · not counsel reviewed
RET-02Retention · Recommended practice
Backup deletion review
Translate retention decisions into detectable events, system actions and explainable exceptions.EditorialNo legal date
Retention · Recommended practice
Backup deletion review
Translate retention decisions into detectable events, system actions and explainable exceptions.Mapped provision: Preview editorial method. This control is not a prescribed form and does not create a legal conclusion.
Record restore-window and deletion constraints.
- Event-based schedule
- Deletion run result
- Exception decision
- Records owner
- Engineering
- Privacy/Legal
Run one synthetic case end to end; save the dated result, owner and unresolved exceptions.
Editorial method only. No legal requirement is asserted for this control.
Reviewed 2026-08-20 · not counsel reviewed
GOV-02Governance · Recommended practice
Training record
Give new data flows, unresolved gaps and resourcing decisions a visible owner and review route.EditorialNo legal date
Governance · Recommended practice
Training record
Give new data flows, unresolved gaps and resourcing decisions a visible owner and review route.Mapped provision: Preview editorial method. This control is not a prescribed form and does not create a legal conclusion.
Train people who handle rights, sales and support requests.
- Decision record
- Named owner
- Review date
- Programme owner
- Functional leads
Run one synthetic case end to end; save the dated result, owner and unresolved exceptions.
Editorial method only. No legal requirement is asserted for this control.
Reviewed 2026-08-20 · not counsel reviewed
EVID-01Evidence · Implementation evidence
Evidence index
Make an implementation claim retrievable without needlessly centralising sensitive records.EditorialNo legal date
Evidence · Implementation evidence
Evidence index
Make an implementation claim retrievable without needlessly centralising sensitive records.Mapped provision: Preview editorial method. This control is not a prescribed form and does not create a legal conclusion.
Link each claim to an owner, record and review date.
- Evidence index entry
- Version record
- Retrieval test
- Programme owner
- Control owners
Run one synthetic case end to end; save the dated result, owner and unresolved exceptions.
Editorial method only. No legal requirement is asserted for this control.
Reviewed 2026-08-20 · not counsel reviewed
EVID-02Evidence · Implementation evidence
Change log
Make an implementation claim retrievable without needlessly centralising sensitive records.EditorialNo legal date
Evidence · Implementation evidence
Change log
Make an implementation claim retrievable without needlessly centralising sensitive records.Mapped provision: Preview editorial method. This control is not a prescribed form and does not create a legal conclusion.
Version notices, workflows and legal-status assessments.
- Evidence index entry
- Version record
- Retrieval test
- Programme owner
- Control owners
Run one synthetic case end to end; save the dated result, owner and unresolved exceptions.
Editorial method only. No legal requirement is asserted for this control.
Reviewed 2026-08-20 · not counsel reviewed
TEST-01Testing · Recommended practice
Request exercise
Exercise the workflow with synthetic data before a real request depends on it.EditorialNo legal date
Testing · Recommended practice
Request exercise
Exercise the workflow with synthetic data before a real request depends on it.Mapped provision: Preview editorial method. This control is not a prescribed form and does not create a legal conclusion.
Run a dry run before relying on a workflow.
- Exercise plan
- Findings log
- Retest result
- Operations
- System owners
- Privacy/Legal
Run one synthetic case end to end; save the dated result, owner and unresolved exceptions.
Editorial method only. No legal requirement is asserted for this control.
Reviewed 2026-08-20 · not counsel reviewed
GOV-03Governance · Recommended practice
Board/operator review
Give new data flows, unresolved gaps and resourcing decisions a visible owner and review route.EditorialNo legal date
Governance · Recommended practice
Board/operator review
Give new data flows, unresolved gaps and resourcing decisions a visible owner and review route.Mapped provision: Preview editorial method. This control is not a prescribed form and does not create a legal conclusion.
Review unresolved risks and resourcing decisions.
- Decision record
- Named owner
- Review date
- Programme owner
- Functional leads
Run one synthetic case end to end; save the dated result, owner and unresolved exceptions.
Editorial method only. No legal requirement is asserted for this control.
Reviewed 2026-08-20 · not counsel reviewed
CONSENT-03Consent · Legal-requirement topic
Consent Manager ecosystem readiness
Make a choice and any later withdrawal traceable across the systems that act on it.Source-mapped2026-11-13 / 2027-05-13
Consent · Legal-requirement topic
Consent Manager ecosystem readiness
Make a choice and any later withdrawal traceable across the systems that act on it.Mapped provision: Act section 6(7)–(9); Rule 4. This control is not a prescribed form and does not create a legal conclusion.
Keep the cohorts separate: Act section 6(9) and Rule 4 registration machinery are scheduled for 13 November 2026; section 6(7)–(8) is scheduled for 13 May 2027. A normal Data Fiduciary touchpoint is conditional preparation, not a universal Rule 4 duty.
- Choice event
- Notice-version reference
- Preference propagation result
- Product
- Engineering
- Privacy/Legal
Check that the record distinguishes Consent Manager provider registration from a Data Fiduciary’s conditional integration preparation.
- Act No. 22 of 2023 · Sections 1 and 3–17; official Gazette PDF
- G.S.R. 843(E) · Paragraphs (a)–(c), page 2
- G.S.R. 846(E) · Rule 1 commencement; Rules 3–16; official Gazette PDF
- G.S.R. 892(E) · Items (i)–(v), Gazette page 1
Reviewed 2026-08-20 · not counsel reviewed
BREACH-02Breach · Implementation evidence
Breach communication pack
Prepare the people, facts and distinct communication steps needed after awareness of a breach.Source-mapped2027-05-13
Breach · Implementation evidence
Breach communication pack
Prepare the people, facts and distinct communication steps needed after awareness of a breach.Mapped provision: Rules r. 7. This control is not a prescribed form and does not create a legal conclusion.
Maintain separate, fact-led checklists for affected Data Principals, the Board’s initial description and the Board’s later detailed information. Do not turn a template into a legal conclusion.
- Incident timeline
- Communication decision
- Tabletop result
- Incident lead
- Security
- Privacy/Legal
Use one tabletop scenario to draft all three outputs and verify their different content and timing owners.
- Act No. 22 of 2023 · Sections 1 and 3–17; official Gazette PDF
- G.S.R. 843(E) · Paragraphs (a)–(c), page 2
- G.S.R. 846(E) · Rule 1 commencement; Rules 3–16; official Gazette PDF
- G.S.R. 892(E) · Items (i)–(v), Gazette page 1
Reviewed 2026-08-20 · not counsel reviewed
No controls match those filters.
Try a broader term, choose another operating area or clear the filters.
02 Use the catalogue honestly
Start with a failed retrieval, not a perfect score.
The quickest useful test is simple: choose one claimed control, retrieve its current evidence, name its owner and run the stated procedure.